Power grid engineering supplier information access control method based on zero-trust architecture

Abstract

The invention discloses a power grid project supplier information access control method based on a zero-trust architecture, and the method comprises the following steps: S1, receiving an access request, and executing identity verification; s2, extracting supplier related information from the verified access request, and generating access context information; s3, generating an access control strategy according to the access context information; s4, a resource access path is established, and access connection is completed through an encryption communication mode; s5, collecting operation behavior data of the suppliers in the access process; s6, calculating a deviation degree between the operation behavior data and a preset behavior baseline, and generating a risk score; s7, when the risk score exceeds a set threshold value, executing a corresponding security processing operation; and S8, archiving the operation behavior data and the security processing record in the access process. According to the method, a dynamic access control and behavior risk response system is constructed based on a zero-trust architecture, and the method has the advantages of fine authorization, continuous verification and high security.

Description

Technical Field

[0001] The present invention relates to the field of network information security technology, and particularly to a method for accessing and controlling information of power grid project suppliers based on a zero-trust architecture. Background Art

[0002] In the process of power grid project construction, operation, and operation and maintenance management, as an important external participant, suppliers often need to remotely or on-site access the core information systems of power grid enterprises through the network to access key data including project plans, design materials, equipment parameters, construction progress, acceptance records, etc. This cross-border access mode of "external entities accessing internal systems" has become the norm in the information technology environment of the power grid industry. To ensure the business collaboration efficiency of suppliers, currently, mainstream power grid enterprises generally adopt unified identity authentication platforms combined with means such as VPN, bastion hosts, and permission management systems to achieve authentication and access control of suppliers' access behaviors. These technical means constitute the basic technical framework for the secure access of the current power industry's external information systems.

[0003] In the existing technical solutions, identity authentication usually adopts the username and password login method, supplemented by two-factor authentication such as hardware tokens or SMS verification codes. Some systems introduce external single sign-on mechanisms such as enterprise WeChat and DingTalk to improve the convenience of supplier access. At the access control level, most systems adopt the role-based access control (RBAC) model. According to the organization to which the supplier belongs and the engineering tasks they are responsible for, access permission roles are assigned, and resource authorization is carried out in a static manner. At the same time, to improve the controllability of access behaviors, some power grid enterprises have deployed bastion host systems to record screen and audit commands for operations; combined with firewall policies and whitelist configurations, the access paths and network boundaries are limited. These methods have improved the controllability and auditability of supplier access to a certain extent and alleviated the network access risks of "no distinction between internal and external" in the early stage.

[0004] However, with the complexity of power grid project operations, the increase in the number of suppliers, and the improvement of remote collaboration frequency, the traditional boundary-based access control system has gradually revealed various deficiencies in terms of security and refined control capabilities. First of all, the existing identity authentication mechanisms mostly rely on one-time verification and lack the ability of "continuous verification". Once a supplier passes the identity authentication and establishes a connection, its subsequent behaviors are default trusted, which is naturally incompatible with common account impersonation, session hijacking, and phishing attack methods in current network attacks. Secondly, although the RBAC model has certain permission management capabilities, since its authorization core is "role", the permission granularity is usually relatively coarse, and it is difficult to make dynamic and refined restrictions on "who accessed what resources and performed what operations at what time, from where". Once the role configuration is too wide, suppliers may access data resources unrelated to the current task, resulting in potential information leakage risks.

[0005] In addition, most of the existing access control policies are static configurations, which are difficult to dynamically adjust according to the actual business status, operating environment and behavioral characteristics of the supplier. For example, when a supplier initiates an access request during non-working hours, in an abnormal network environment or with an unregistered terminal device, the existing system is often unable to automatically identify it as a risky behavior and respond, resulting in a lag in security defense. For another example, although some systems have behavioral auditing functions, they are only used for post-analysis and compliance evidence collection. They lack real-time behavior-based analysis, scoring and risk perception capabilities, resulting in the long-term existence of "invaded but undetected" security vulnerabilities. Traditional VPNs, bastion hosts and other means are based on "trust boundaries" and rely on preset trusted networks and devices. They cannot meet the needs of modern scenarios where suppliers are widely distributed, devices are diverse, and access is dynamic.

[0006] At present, with the rise of the concept of zero-trust architecture, more and more industries have realized that "identity is boundary", "principle of least privilege" and "continuous verification" are the key to building a new generation of access control system. In the security management of power grid engineering supply chain, zero-trust architecture provides a security paradigm that defaults to distrust of all access requests, continuously verifies identity, and assesses risks in real time. Although zero-trust architecture has been applied to cloud computing, remote office, enterprise intranet protection and other scenarios, there is still a lack of a systematic, engineered, and implementable zero-trust access control method for the specific scenario of power grid engineering suppliers. Especially in the power grid engineering environment with multiple tasks running in parallel, dynamic changes in engineering cycles, and high equipment diversity, how to integrate identity attributes, task status, access time, terminal location, behavior patterns and other multi-dimensional factors to generate real-time and effective access control strategies and effectively integrate them with behavior monitoring and response mechanisms is a difficult problem in the current technical field.

[0007] In summary, the existing information access control technology for power grid engineering suppliers has problems such as single identity authentication, extensive authority allocation, inability to dynamically adjust policies, lack of real-time behavior perception and response, etc., which can hardly meet the access management requirements of modern power information systems for "safe, refined, intelligent, and controllable". Therefore, it is urgent to provide an information access control method based on zero-trust architecture, which can integrate multiple key technologies such as multi-factor identity authentication, context-aware policy generation, access path encryption isolation, real-time collection and analysis of behavior data, risk scoring and dynamic response, etc., to achieve refined control of the entire process of access behavior of power grid engineering suppliers, thereby improving the security, flexibility and adaptive defense capabilities of the system. Summary of the invention

[0008] An object of the present invention is to propose an information access control method for power grid project suppliers based on a zero-trust architecture. Based on the zero-trust architecture, the present invention integrates multi-factor authentication, context-aware policy generation, and behavior risk scoring mechanisms to achieve full-process dynamic control of the access behavior of power grid project suppliers, with the advantages of fine-grained authorization, continuous verification, real-time response, and high security, effectively solving the problems of coarse access control granularity, static policies, and lagging risk response in traditional access control.

[0009] An information access control method for power grid project suppliers based on a zero-trust architecture according to an embodiment of the present invention includes the following steps:

[0010] S1. Receive an access request from a supplier terminal device and perform multi-factor authentication;

[0011] S2. Extract the identity information, task status, project information, access time, and network location of the supplier from the verified access request, generate access context information, bind it to a session token, and transfer it to the next stage of the access control process;

[0012] S3. Generate an access control policy based on the access context information;

[0013] S4. Establish a resource access path according to the access control policy, limit the access request within the scope of the authorized resource list, and complete the access connection through an encrypted communication method;

[0014] S5. Collect the operation behavior data of the supplier during the access process;

[0015] S6. Analyze the collected operation behavior data, calculate the deviation degree between the operation behavior data and a preset behavior baseline, and generate a risk score;

[0016] S7. When the risk score exceeds a set threshold, perform corresponding security processing operations;

[0017] S8. Archive the operation behavior data and security processing records during the access process to form access log data.

[0018] Optionally, the multi-factor authentication includes account password verification, dynamic token verification, and terminal device fingerprint recognition.

[0019] Optionally, the S1 specifically includes:

[0020] S11. Receive an access request initiated by a supplier terminal, where the access request contains authentication information, and the authentication information includes an account, a password, a dynamic token, and terminal device identification information;

[0021] S12. Verify the account and password by calling the preset authentication database and determine whether they match by comparing the submitted account and password with the stored information;

[0022] S13. Perform time synchronization verification on the dynamic token by comparing the dynamic token submitted by the terminal device with the standard token generated by the current system to determine whether it is within the set time error range;

[0023] S14. Extract the identification information of the terminal device, where the identification information includes the MAC address, hard disk serial number, operating system information, and browser fingerprint information of the terminal, and generate a device identification summary after splicing the identification information;

[0024] S15. Compare the generated device identification summary with the registered legal device information to determine whether the current device is a trusted terminal;

[0025] S16. When the account password verification passes, the dynamic token verification passes, and the identification information of the terminal device is consistent with the registered information, confirm that the identity verification is successful. The system generates a unique session token, which is used as the identity credential in the subsequent access control process, and binds the session token to the current access request.

[0026] Optionally, the task status includes a task number, task type, task stage, and task progress status. The task stage includes a preparation stage, an execution stage, and a delivery stage. The task progress status includes not started, in progress, and completed.

[0027] Optionally, the access control policy includes authorized resources, allowed operation types, access time ranges, network address ranges, and device constraint conditions.

[0028] Optionally, the specific steps of S3 are as follows:

[0029] S31. Receive the generated access context information and identify the identity information, task status, project information, access time, and network location of the supplier;

[0030] S32. Retrieve the preset access control rule set according to the access context information. The access control rule set includes resource authorization rules, operation permission rules, time window rules, network source rules, and device trust rules;

[0031] S33. Match the list of allowed access resources in the resource authorization rules based on the identity identifier, role information, and project number to clarify the target data path and resource type corresponding to the access request;

[0032] S34. Limit the types of operations allowed to be executed according to the task status in the operation permission rules. The operation types include reading, writing, uploading, downloading, and deleting, and different task stages correspond to different combinations of operation permissions;

[0033] S35. Compare the access time with the authorized time period registered in the time window rule to determine whether the current access request is within the allowed time range. If it exceeds the authorized time period, mark it as a restricted status;

[0034] S36. Match the authorized address range in the network source rule based on the field of the network location. The authorized address range includes the registered office network, project-specific communication channels, or trusted device access networks. If there is no match, set a network restriction label;

[0035] S37. Based on the device information in the access context information, check it against the registered device fingerprint in the device trust rule to determine whether the current access terminal is an authorized device. If they do not match, mark the device access restriction;

[0036] S38. Integrate the matching results of each rule to generate an access control policy;

[0037] S39. Bind the generated access control policy to the access request and write it into the access context information.

[0038] Optionally, the specific steps of S4 include:

[0039] S41. Read the generated access control policy and extract the information of authorized resources, allowed operations, access time, network address range, and device restriction fields;

[0040] S42. Determine the allowed data directory, interface address, and application function list according to the authorized resource field;

[0041] S43. Set a request filtering rule based on the allowed operation field to verify the type of the access instruction, and only allow the matching operation type to enter the access link;

[0042] S44. Match and verify the timestamp of the access request with the access time field in the access control policy. If the current time is not within the authorized access time period, reject the establishment of the resource access path;

[0043] S45. Detect the source IP address of the access request and compare it with the network address range field defined in the access control policy to determine whether it belongs to a legal access address segment. If it is not within the authorized network range, mark it as an illegal network access and block the connection establishment;

[0044] S46. Verify whether the information of the access terminal device is consistent with the device restriction field in the access control policy. If the device is not registered or does not match, reject the access request;

[0045] S47. On the premise that all control fields are verified to pass, establish a resource access path for the access request. The resource access path is a logically isolated path, limited within the scope of the authorized resource list, and ensure that all nodes in the path meet the conditions of the access control policy;

[0046] S48. Implement encrypted communication configuration for the resource access path, call the preset transmission encryption protocol, perform encryption encapsulation on the communication data. The encryption process uses a symmetric key for encrypted transmission, and both communication parties establish an encrypted session based on the shared key;

[0047] S49. Bind the established resource access path to the current session token to form a bound access channel, set a unique identifier for the bound access, record the successfully established access path information, and write it into the current access context information as the basic data for access lifecycle management. The access path information includes the access target, operation type, establishment time, channel identifier, and policy number.

[0048] Optionally, the operation behavior data includes access frequency, operation type, access path, and data transmission volume.

[0049] Optionally, the specific content of S6 is as follows:

[0050] S61. Extract the timestamp, operation type, access frequency, access path, and data transmission volume of each access behavior record in the operation behavior data;

[0051] S62. Compare the data of the current access behavior record with the preset behavior baseline. The behavior baseline is a reference model constructed based on historical normal access behaviors, and the behavior baseline includes a baseline frequency range, a regular operation sequence, a path range, and a data transmission volume range;

[0052] S63. For the access frequency parameter, compare its relationship with the baseline frequency range. When the access frequency is less than the minimum value of the baseline frequency range or the access frequency is greater than the maximum value of the baseline frequency range, mark it as frequency anomaly;

[0053] S64. For the data transmission volume parameter, compare it with the average data transmission volume of historical similar operations, calculate the difference percentage. When the difference percentage exceeds the set threshold, mark it as data transmission anomaly;

[0054] S65. Analyze whether the operation type is consistent with the preset task operation process. If there is an unauthorized operation that does not conform to the task stage or a request for unauthorized resources, mark it as operation anomaly;

[0055] S66. Analyze the resource hierarchy, path hop count, and path pattern in the access path field. If there is a significant deviation from the path range defined in the behavior baseline, mark it as a path anomaly.

[0056] S67. Calculate the metric values of frequency anomaly, data transmission anomaly, operation anomaly, and path anomaly, and calculate the behavior deviation score for the metric values using a weighted scoring method.

[0057] S68. Compare the behavior deviation score with the risk threshold. When the behavior deviation score is greater than the risk threshold, generate a risk score and mark the current access behavior as a high-risk behavior.

[0058] Optionally, the security processing operations include access permission adjustment, connection interruption, re-verification of identity, and sending of warning information.

[0059] The beneficial effects of the present invention are as follows:

[0060] First, a method for accessing and controlling power grid project supplier information based on a zero-trust architecture provided by the present invention breaks through the traditional security model centered on boundary protection, and realizes a more detailed, dynamic, and intelligent access control strategy during the process of suppliers accessing the power grid project information system, improving the overall security and controllability of the system. By introducing a multi-factor authentication mechanism, the identity of the supplier no longer depends on a single credential, but is comprehensively verified through multiple dimensions such as account password, dynamic token, and terminal device fingerprint, effectively preventing the risk of illegal access brought by attack methods such as account theft and device forgery.

[0061] Second, in terms of access permission allocation, the present invention combines context elements such as the identity information, task status, affiliated project, access time, and network location of the supplier to construct a real-time access environment and generate a dynamic access control strategy, changing the limitations of the traditional RBAC model with coarse authorization granularity and slow response. This strategy can implement the principles of "authorize on demand" and "minimum privilege" according to the specific business context during access, thereby avoiding suppliers from accessing resources irrelevant to their tasks and effectively reducing the possibility of information over-authorization access.

[0062] In addition, the present invention further establishes an encrypted resource access path, logically isolates the access process, ensures that all access requests can establish a channel only after passing the access policy verification, and implements transmission encryption for the access link. By binding the access path to the current session token, the whole process identification and management of resource operations are realized, providing an accurate basis for subsequent behavior tracking and auditing. At the same time, operation behavior data is collected in real time during the access process, covering key parameters such as operation type, access frequency, data transmission volume, and access path, providing data support for behavior risk assessment.

[0063] Finally, the behavior analysis part conducts multi-dimensional comparison between the collected data and the historical behavior baseline, introduces a weighted scoring mechanism, and accurately evaluates the degree of behavior deviation. When the risk score exceeds the set threshold, the system can immediately execute response operations such as access permission adjustment, connection interruption, re-authentication, or sending security alerts, forming a dynamic security control system with a "recognition-judgment-disposal" closed-loop. This mechanism not only enhances the system's real-time perception ability but also significantly shortens the response time and improves the processing efficiency of security incidents.

[0064] Generally speaking, the present invention realizes the engineering implementation of the zero-trust security concept in the access control scenario of power grid project suppliers. It not only solves the problems of insufficient authentication, extensive permission control, lack of behavior recognition and response in the existing technology but also realizes the continuous verification, dynamic authorization, and risk perception processing of supplier access behaviors, constructing a flexible, intelligent, and sustainable evolving security protection system. Brief Description of the Drawings

[0065] The drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation to the present invention. In the drawings:

[0066] Figure 1 It is a flowchart of a method for accessing and controlling information of power grid project suppliers based on a zero-trust architecture proposed by the present invention;

[0067] Figure 2 It is a schematic diagram of constructing access context information of a method for accessing and controlling information of power grid project suppliers based on a zero-trust architecture proposed by the present invention;

[0068] Figure 3 It is a logical structure diagram of the access control policy generation process of a method for accessing and controlling information of power grid project suppliers based on a zero-trust architecture proposed by the present invention. Detailed Description of the Embodiments

[0069] Now, the present invention will be further described in detail with reference to the drawings. These drawings are all simplified schematic diagrams, only illustrating the basic structure of the present invention in a schematic way, so they only show the components related to the present invention.

[0070] Refer to Figures 1-3 , a method for accessing and controlling information of power grid project suppliers based on a zero-trust architecture, includes the following steps:

[0071] S1. Receive the access request from the supplier terminal device and perform multi-factor authentication;

[0072] S2. Extract the identity information, task status, project information, access time, and network location of the supplier from the verified access request, generate access context information, bind it to the session token, and pass it to the next stage of the access control process;

[0073] S3. Generate an access control policy based on the access context information;

[0074] S4. Establish a resource access path according to the access control policy, limit the access request within the scope of the authorized resource list, and complete the access connection through encrypted communication;

[0075] S5. Collect the operation behavior data of the supplier during the access process;

[0076] S6. Analyze the collected operation behavior data, calculate the deviation degree between the operation behavior data and the preset behavior baseline, and generate a risk score;

[0077] S7. When the risk score exceeds the set threshold, perform corresponding security handling operations;

[0078] S8. Archive the operation behavior data and security handling records during the access process to form access log data.

[0079] Through the introduction of the zero-trust architecture, the present invention constructs a full-process supplier access control system from identity authentication, context extraction, policy generation, encrypted path establishment, behavior collection to risk response, realizing minimum authorization for access, monitorable behavior, risk response, and full-chain traceability, and significantly improving the security and controllability of the power grid engineering information system.

[0080] In this embodiment, the multi-factor identity authentication includes account password verification, dynamic token verification, and terminal device fingerprint recognition.

[0081] The present invention adopts a multi-factor identity authentication mechanism of account password, dynamic token, and terminal device fingerprint, effectively preventing the illegal access risk brought by suppliers due to credential leakage, device forgery, etc., and improving the rigor and protection intensity of identity authentication.

[0082] In this embodiment, the specific content of S1 includes:

[0083] S11. Receive an access request initiated by a supplier terminal, where the access request contains identity authentication information, and the identity authentication information includes an account, a password, a dynamic token, and terminal device identification information;

[0084] S12. Verify the account and password, call the preset authentication database, and determine whether they match by comparing the submitted account and password with the stored information;

[0085] S13. Perform time synchronization verification on the dynamic token, compare the dynamic token submitted by the terminal device with the standard token generated by the current system, and determine whether it is within the set time error range;

[0086] S14. Extract the identification information of the terminal device. The identification information includes the MAC address of the terminal, the hard disk serial number, the operating system information, and the browser fingerprint information. After splicing and processing the identification information, generate a device identification summary;

[0087] S15. Compare the generated device identification summary with the registered legal device information to determine whether the current device is a trusted terminal;

[0088] S16. When the account password verification passes, the dynamic token verification passes, and the identification information of the terminal device is consistent with the registered information, confirm that the identity verification is successful. The system generates a unique session token, which is used as the identity credential in the subsequent access control process, and binds the session token to the current access request.

[0089] The present invention refines the execution process of multi-factor authentication to ensure the integrity and accuracy of the identity verification link, provides a trusted and unique session token binding basis for the subsequent steps of access control, and improves the security level of system identity management.

[0090] In this embodiment, the task status includes a task number, a task type, a task stage, and a task progress status. The task stage includes a preparation stage, an execution stage, and a delivery stage. The task progress status includes not started, in progress, and completed.

[0091] The present invention extracts the identity information, task status, project information, access time, and network location of the supplier to construct a multi-dimensional access context, provides basic data for dynamically generating accurate access control policies, and enhances the system's perception ability of the actual business status of the supplier.

[0092] In this embodiment, the access control policy includes authorized resources, allowed operation types, access time ranges, network address ranges, and device constraint conditions.

[0093] The access control policy of the present invention combines multiple restriction dimensions of authorized resources, operation types, time, network, and devices, has a high degree of customization and refinement capabilities, realizes a task-driven dynamic least privilege control mechanism, and effectively reduces the risks of unauthorized access and information leakage.

[0094] In this embodiment, the specific content of S3 includes:

[0095] S31. Receive the generated access context information, and identify the identity information, task status, project information, access time, and network location of the supplier;

[0096] S32. Retrieve the preset access control rule set according to the access context information. The access control rule set includes resource authorization rules, operation permission rules, time window rules, network source rules, and device trust rules;

[0097] S33. Based on the identity identifier, role information, and project number, match the list of resources allowed to be accessed in the resource authorization rules, and clarify the target data path and resource type corresponding to the access request;

[0098] S34. Limit the allowed operation types according to the task status in the operation permission rules. The operation types include read, write, upload, download, and delete, and different task stages correspond to different combinations of operation permissions;

[0099] S35. Compare the access time with the authorized time period registered in the time window rules to determine whether the current access request is within the allowed time range. If it exceeds the authorized time period, it is marked as a restricted status;

[0100] S36. Based on the field of the network location, match the authorized address range in the network source rules. The authorized address range includes the registered office network, project-specific communication channel, or trusted device access network. If there is no match, a network restriction label is set;

[0101] S37. Based on the device information in the access context information, check it against the registered device fingerprint in the device trust rules to determine whether the current access terminal is an authorized device. If they do not match, device access restrictions are marked;

[0102] S38. Integrate the matching results of each rule to generate an access control policy;

[0103] S39. Bind the generated access control policy to the access request and write it into the access context information.

[0104] The present invention realizes a closed-loop process from context information to policy rule matching and then to the formation of the final control policy by refining the generation process of the access control policy, enhances the adaptability, real-time performance, and accuracy of the policy, and significantly improves the system policy generation efficiency and coverage.

[0105] In this embodiment, the specific steps of S4 include:

[0106] S41. Read the generated access control policy, and extract the information of authorized resources, allowed operations, access time, network address range, and device restriction fields;

[0107] S42. Determine the allowed data directory, interface address, and application function list according to the authorized resource field;

[0108] S43. Set request filtering rules based on the allowed operation field, perform type verification on the access instruction, and only allow matching operation types to enter the access link;

[0109] S44. Match and verify the timestamp of the access request with the access time field in the access control policy. If the current time is not within the authorized access time period, reject the establishment of the resource access path;

[0110] S45. Detect the source IP address of the access request, compare it with the network address range field defined in the access control policy, and determine whether it belongs to the legal access address segment. If it is not within the authorized network range, mark it as an illegal network access and block the connection establishment;

[0111] S46. Verify whether the access terminal device information is consistent with the device restriction field in the access control policy. If the device is not registered or does not match, reject the access request;

[0112] S47. On the premise that all control field validations pass, establish a resource access path for the access request. The resource access path is a logically isolated path, limited within the authorized resource list, and ensure that all nodes in the path meet the conditions of the access control policy;

[0113] S48. Implement encrypted communication configuration for the resource access path, call the preset transmission encryption protocol, perform encryption packaging on the communication data. The encryption process uses a symmetric key for encrypted transmission, and the communication parties establish an encrypted session based on the shared key;

[0114] S49. Bind the established resource access path to the current session token to form a bound access channel, set a unique identifier for the bound access, record the successfully established access path information, and write it into the current access context information as the basic data for access lifecycle management. The access path information includes access target, operation type, establishment time, channel identifier, and policy number.

[0115] The present invention establishes a logically isolated resource access path based on policy verification, and ensures the confidentiality and integrity of the communication process through symmetric encryption technology, further strengthening the link security protection ability in the process of supplier data interaction.

[0116] The operation behavior data in this embodiment includes access frequency, operation type, access path, and data transfer volume.

[0117] The present invention realizes real-time monitoring of the entire access process by collecting key behavioral data such as access frequency, operation type, access path, and data transmission volume, provides detailed data support for behavioral analysis and security response, and enhances the active perception ability of the system.

[0118] In this embodiment, S6 specifically includes:

[0119] S61. Extract the timestamp, operation type, access frequency, access path, and data transmission volume of each access behavior record in the operation behavior data;

[0120] S62. Compare the data of the current access behavior record with a preset behavior baseline, where the behavior baseline is a reference model constructed based on historical normal access behaviors, and the behavior baseline includes a baseline frequency range, a conventional operation sequence, a path range, and a data transmission volume range;

[0121] S63. For the access frequency parameter, compare its relationship with the baseline frequency range. When the access frequency is less than the minimum value of the baseline frequency range or greater than the maximum value of the baseline frequency range, mark it as a frequency anomaly;

[0122] S64. For the data transmission volume parameter, compare it with the average data transmission volume of historical similar operations, calculate the difference percentage, and when the difference percentage exceeds the set threshold, mark it as a data transmission anomaly;

[0123] S65. Analyze whether the operation type is consistent with the preset task operation process. If there are unauthorized operations that do not conform to the task stage or requests for unauthorized resources, mark it as an operation anomaly;

[0124] S66. Analyze the resource level, path jump count, and path pattern in the access path field. If it significantly deviates from the path range defined in the behavior baseline, mark it as a path anomaly;

[0125] S67. Calculate the index values of frequency anomaly, data transmission anomaly, operation anomaly, and path anomaly, and calculate the behavior deviation score by using a weighted scoring method for the index values;

[0126] S68. Compare the behavior deviation score with the risk threshold. When the behavior deviation score is greater than the risk threshold, generate a risk score and mark the current access behavior as a high-risk behavior.

[0127] The present invention realizes intelligent identification of abnormal behaviors of suppliers and risk level assessment by making multi-dimensional comparisons between operation behaviors and a preset behavior baseline, and using a weighted scoring mechanism to quantify the deviation degree, effectively improving the intrusion detection and dynamic response capabilities of the system.

[0128] In this embodiment, the security processing operations include access permission adjustment, connection interruption, re-verification of identity, and sending warning messages.

[0129] Based on risk identification, the present invention sets up security disposal methods such as access permission adjustment, connection interruption, re-verification, and warning push, constructs a timely and flexible dynamic response mechanism, and significantly improves the system's control reaction speed and processing closed-loop ability for abnormal behaviors.

[0130] Example 1:

[0131] To verify the feasibility of the present invention in implementation, the present invention is applied to a new 500 kV substation project implemented by a power company in a southwestern region of China in the second half of 2024. Hierarchical authorized access control is performed on engineering documents, dispatching plans, and construction monitoring information for multiple external suppliers. The project lasts for six months and involves 8 external units such as design units, equipment suppliers, supervision units, and construction units. Among them, more than 30 third-party accounts need to remotely access the grid engineering management system through the public network to access task-related information.

[0132] In this scenario, the project security person deployed the access control method based on the zero-trust architecture proposed by the present invention at the initial stage of the project and integrated it with the existing engineering management information system and identity authentication platform. When the system receives an access request initiated by an external supplier, it first requires the user to complete multi-factor identity verification. Taking equipment supplier A as an example, its staff uses the registered account "sg-035", enters the account number, password, and dynamic token, and uploads fingerprint information (including device MAC address, terminal serial number, and system information digest) from the bound device. Only then does the system allow access to the next step of the access request processing flow.

[0133] After the system completes the identity verification, it automatically generates an access context based on the supplier's current task status (such as the "equipment commissioning" stage), the project number it belongs to, the access time period (such as 22:00 at night), and the access IP address (the resolved geographical location is "Shenzhen, Guangdong Province", while the project is located in "Kunming, Yunnan Province"). It identifies that there is a deviation between this access environment and the normal baseline. The system dynamically generates an access control policy, restricting it to only access device interface data and on-site test reports during the commissioning stage, and rejecting its attempt to download acceptance documents uploaded by other units. At the same time, it marks this behavior as an "over-authorization access attempt" and includes it in the behavior risk score.

[0134] During the subsequent operation process, the system continuously collects data such as operation types, access frequencies, data transmission volumes, and path hop counts for the access behaviors of all suppliers, and conducts real-time evaluation of the degree of behavior deviation.

[0135] Table 1 Performance comparison table

[0136]

[0137] In terms of the overall access scale, the total number of times suppliers accessed in the two projects was basically the same, being 28,102 times (traditional solution) and 27,865 times (the present invention) respectively. This shows that the test scenarios and access loads are highly comparable. On this basis, the system of the present invention identified a total of 193 abnormal access behaviors, far higher than the mere 64 times found in the traditional solution, indicating that the present invention has higher sensitivity and coverage in aspects such as behavior deviation identification and risk feature extraction, and the ability to detect abnormal behaviors has increased by more than 200%.

[0138] In terms of the key control effect, the system of the present invention achieved real-time interception of all unauthorized access behaviors with a success rate of 100%. However, there were 7 unauthorized accesses in the traditional solution that were not identified, directly exposing the failure risk of the static permission model in the scenario of dynamic task switching. At the same time, the present invention reduced the number of manual intervention processes from the traditional 53 times to 12 times, reducing the workload of security operation and maintenance personnel, and demonstrating the practicality and robustness of the automatic response mechanism.

[0139] In terms of response efficiency, the average risk response duration of the present invention is 2.7 seconds. Compared with the 9.8 seconds of the traditional solution, the overall processing speed has increased by approximately 72.4%, enabling policy judgment and control decision-making to be completed in a shorter time and effectively curbing the expansion of potential security incidents. In addition, in terms of the system identification accuracy, the present invention controls the false alarm rate at 4.4%, which is significantly lower than the 8.3% of the traditional solution, demonstrating its maturity in behavior modeling and multi-dimensional parameter analysis and improving the usability of actual deployment.

[0140] The present invention introduces a dynamic access policy generation mechanism, enabling the daily update frequency of access policies to reach 12 - 18 times. Compared with the passive maintenance method of the traditional solution that only updates 1 - 2 times a day, it realizes context-based policy adaptive updates, ensuring that access permissions are always synchronized with the business status. It is worth mentioning that throughout the project cycle, the system of the present invention ensured "zero security incidents" operation. Compared with the 3 security incidents in the traditional solution, the protection effect of the present invention has been significantly improved.

[0141] The above is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention, according to the technical solution and inventive concept of the present invention, making equivalent substitutions or changes, should be covered within the protection scope of the present invention.

Claims

1. A method for accessing control of power grid project supplier information based on a zero-trust architecture, characterized in that, It includes the following steps: S1. Receive the access request from the supplier's terminal device and perform multi-factor authentication; S2. Extract the supplier's identity information, task status, project information, access time, and network location from the verified access request, generate access context information, bind it with the session token, and transfer it to the next stage of the access control process; S3. Generate an access control policy based on the access context information; S4. Establish a resource access path according to the access control policy, limit the access request within the scope of the authorized resource list, and complete the access connection through encrypted communication; S5. Collect the operation behavior data of the supplier during the access process; S6. Analyze the collected operation behavior data, calculate the deviation degree between the operation behavior data and the preset behavior baseline, and generate a risk score; S7. When the risk score exceeds the set threshold, perform corresponding security handling operations; S8. Archive the operation behavior data and security handling records during the access process to form access log data.

2. The information access control method for grid project suppliers based on the zero-trust architecture according to claim 1, wherein The multi-factor authentication includes account password verification, dynamic token verification, and terminal device fingerprint recognition.

3. The information access control method for grid project suppliers based on the zero-trust architecture according to claim 1, characterized in that, The specific content of S1 includes: S11. Receive the access request initiated by the supplier's terminal. The access request contains authentication information, and the authentication information includes an account, a password, a dynamic token, and terminal device identification information; S12. Verify the account and password, call the preset authentication database, and determine whether they match by comparing the submitted account and password with the stored information; S13. Perform time synchronization verification on the dynamic token, compare the dynamic token submitted by the terminal device with the standard token generated by the current system, and determine whether it is within the set time error range; S14. Extract the identification information of the terminal device. The identification information includes the terminal's MAC address, hard disk serial number, operating system information, and browser fingerprint information, and splice the identification information to generate a device identification summary; S15. Compare the generated device identification summary with the registered legal device information to determine whether the current device is a trusted terminal; S16. When the account password verification passes, the dynamic token verification passes, and the identification information of the terminal device is consistent with the registered information, confirm that the identity verification is successful. The system generates a unique session token, which is used as the identity credential in the subsequent access control process, and binds the session token with the current access request.

4. The information access control method for power grid project suppliers based on a zero-trust architecture according to claim 1, wherein The task status includes a task number, a task type, a task stage, and a task progress status. The task stage includes a preparation stage, an execution stage, and a delivery stage. The task progress status includes not started, in progress, and completed.

5. The information access control method for grid project suppliers based on the zero-trust architecture according to claim 1, wherein The access control policy includes authorized resources, allowed operation types, access time ranges, network address ranges, and device constraint conditions.

6. The information access control method for grid project suppliers based on the zero-trust architecture according to claim 1, wherein The specific content of S3 includes: S31. Receive the generated access context information, and identify the supplier's identity information, task status, project information, access time, and network location; S32. Retrieve a preset access control rule set according to the access context information. The access control rule set includes resource authorization rules, operation permission rules, time window rules, network source rules, and device trust rules; S33. Based on the identity identifier, role information, and project number, match the list of resources allowed to be accessed in the resource authorization rules, and clarify the target data path and resource type corresponding to the access request; S34. Limit the types of operations allowed to be executed in the operation permission rules according to the task status. The operation types include read, write, upload, download, and delete, and different task stages correspond to different combinations of operation permissions; S35. Compare the access time with the authorized time period registered in the time window rules to determine whether the current access request is within the allowed time range. If it exceeds the authorized time period, it is marked as a restricted status; S36. Based on the field of the network location, match the authorized address range in the network source rules. The authorized address range includes the registered office network, project-specific communication channels, or trusted device access networks. If there is no match, a network restriction label is set; S37. Based on the device information in the access context information, check it against the registered device fingerprint in the device trust rules to determine whether the current access terminal is an authorized device. If they are inconsistent, a device access restriction is marked; S38. Integrate the matching results of each rule to generate an access control policy; S39. Bind the generated access control policy to the access request and write it into the access context information.

7. The information access control method for grid project suppliers based on the zero-trust architecture according to claim 1, characterized in that The specific steps of S4 are as follows: S41. Read the generated access control policy and extract the information of authorized resources, allowed operations, access time, network address range, and device restriction fields; S42. Determine the allowed data directory, interface address, and application function list according to the authorized resource field; S43. Set a request filtering rule according to the allowed operation field to perform type verification on the access instruction, and only allow the matching operation types to enter the access link; S44. Perform matching verification on the time stamp of the access request and the access time field in the access control policy. If the current time is not within the authorized access time period, the establishment of the resource access path is rejected; S45. Detect the source IP address of the access request, compare it with the network address range field defined in the access control policy, and determine whether it belongs to a legal access address segment. If it is not within the authorized network range, it is marked as an illegal network access and the connection establishment is blocked; S46. Verify whether the access terminal device information is consistent with the device restriction field in the access control policy. If the device is not registered or does not match, the access request is rejected; S47. On the premise that all control field validations pass, establish a resource access path for the access request. The resource access path is a logically isolated path, limited within the authorized resource list, and ensure that all nodes in the path meet the conditions of the access control policy; S48. Implement an encrypted communication configuration for the resource access path, call a preset transmission encryption protocol, perform encryption packaging on the communication data, and the encryption process uses a symmetric key for encrypted transmission. The communication parties establish an encrypted session based on the shared key; S49. Bind the established resource access path to the current session token to form a bound access channel, set a unique identifier for the bound access, record the successfully established access path information, and write it into the current access context information as the basic data for access lifecycle management. The access path information includes the access target, operation type, establishment time, channel identifier, and policy number.

8. A method for accessing and controlling power grid project supplier information based on a zero-trust architecture according to claim 1, characterized in that The operation behavior data includes access frequency, operation type, access path, and data transfer volume.

9. The information access control method for power grid project suppliers based on the zero-trust architecture according to claim 1, wherein S6 specifically includes: S61. Extract the timestamp, operation type, access frequency, access path, and data transfer volume of each access behavior record in the operation behavior data. S62. Compare the data of the current access behavior record with a preset behavior baseline, which is a reference model constructed based on historical normal access behaviors. The behavior baseline includes a baseline frequency range, a regular operation sequence, a path range, and a data transfer volume range. S63. For the access frequency parameter, compare its relationship with the baseline frequency range. When the access frequency is less than the minimum value of the baseline frequency range or greater than the maximum value of the baseline frequency range, mark it as a frequency anomaly. S64. For the data transfer volume parameter, compare it with the average data transfer volume of historical similar operations, calculate the percentage difference. When the percentage difference exceeds the set threshold, mark it as a data transfer anomaly. S65. Analyze whether the operation type is consistent with the preset task operation process. If there are unauthorized operations that do not conform to the task phase or requests for unauthorized resources, mark it as an operation anomaly. S66. Analyze the resource level, path hops, and path pattern in the access path field. If it significantly deviates from the path range defined in the behavior baseline, mark it as a path anomaly. S67. Calculate the index values of frequency anomaly, data transfer anomaly, operation anomaly, and path anomaly, and calculate the behavior deviation score using a weighted scoring method for the index values. S68. Compare the behavior deviation score with the risk threshold. When the behavior deviation score is greater than the risk threshold, generate a risk score and mark the current access behavior as a high-risk behavior.

10. The information access control method for grid project suppliers based on a zero-trust architecture according to claim 1, characterized in that The security processing operations include access permission adjustment, connection interruption, re-verification of identity, and sending warning information.

Images