Power business anti-quantum cryptography migration progressive control method based on risk perception

Abstract

The invention provides a power business anti-quantum cryptography migration progressive control method based on risk awareness, and belongs to the technical field of migration control, and the method comprises the steps: collecting key parameters of all to-be-migrated businesses in a power system, carrying out the standardization preprocessing of the collected key parameters, and constructing a business feature matrix; acquiring relevant parameters of quantum attacks in real time, and calculating a real-time quantum attack risk value of each service to be migrated; based on the service feature matrix and the real-time quantum attack risk value, constructing a dynamic migration rhythm adaptation model, and calculating a migration priority, a migration rate and a migration interval of each service to be migrated; and constructing a migration fault-tolerant and recovery model, monitoring the migration process in real time, calculating a fault influence range and recovery cost based on fault information, and executing corresponding adjustment operation. Accurate, dynamic and high-reliability control of anti-quantum password migration of the power business is realized, safe and stable operation of the power business in the migration process is guaranteed, and the migration efficiency and the anti-quantum attack capability are improved.

Description

Technical Field

[0001] This invention belongs to the field of migration control technology, specifically relating to a risk-aware, quantum cryptographic-resistant progressive migration control method for power business. Background Technology

[0002] With the rapid iteration of quantum computing technology and the maturation of quantum attack methods such as Shor's algorithm and Grover's algorithm, classical cryptographic systems such as RSA and ECC, which are relied upon by traditional power businesses, are at risk of being efficiently cracked.

[0003] To address the aforementioned quantum attack threats, the power industry is gradually migrating its power operations to quantum-resistant cryptographic systems. The incremental migration method, which avoids the business interruption risk of a one-time migration, has become the mainstream migration model. However, existing incremental migration methods for power operations have significant drawbacks. They are ill-suited to the complex security requirements of a quantum attack environment. Their migration strategies are rigid, simply migrating in segments according to the type of power business, such as production control and management, without considering the differences in quantum attack risks among different businesses, their interrelationships, and the dynamic changes in risks during the migration process. This results in delayed migration of high-risk businesses and excessive migration of low-risk businesses, failing to effectively resist quantum attacks. Furthermore, they lack a dynamic adaptation mechanism for controlling the migration pace; the migration progress and sequence are pre-set and cannot be adjusted based on real-time quantum attack risks. The system lacks dynamic adjustments based on risk intensity, business operation status, and system resource load. When a sudden quantum attack occurs, it cannot quickly adjust migration priorities, potentially leading to the target business being compromised due to incomplete migration. Furthermore, the lack of a robust fault tolerance mechanism means that if migration failures, business interruptions, or password mismatches occur during the migration process, timely fault location and rollback recovery are impossible. Additionally, the inability to optimize subsequent migration strategies based on fault information results in frequent migration interruptions, low migration efficiency, and even secondary security risks. Finally, the system's risk perception capability is weak, only able to simply determine the existence of a quantum attack without accurately quantifying its intensity or attack path. It also fails to dynamically match migration risks with business security by considering the importance and data sensitivity of the power business itself, leading to a lack of scientific basis for migration decisions.

[0004] Currently, some solutions attempt to introduce quantum key scheduling to optimize power service security, but they do not incorporate dynamic design of rhythm control and fault tolerance mechanisms for the migration process, thus failing to address the main shortcomings in incremental migration. Therefore, there is an urgent need for a progressive control method for quantum-resistant cryptographic migration of power services that can accurately detect quantum attack risks, dynamically adapt to the migration rhythm, and possess comprehensive fault tolerance capabilities. This method can overcome current problems and ensure the security, stability, and efficiency of the power service migration process. Summary of the Invention

[0005] The purpose of this section is to outline some aspects of the embodiments of the present invention and to briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section, as well as in the abstract and title of the present application, to avoid obscuring the purpose of this section, the abstract and title of the invention. Such simplifications or omissions shall not be used to limit the scope of the present invention.

[0006] In view of the aforementioned existing problems, the present invention is proposed.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution: This invention provides a risk-aware, quantum-resistant cryptographic migration asymptotic control method for power business, comprising: Collect key parameters of all services to be migrated in the power system, perform standardized preprocessing on the collected key parameters, and construct a service feature matrix. Construct a quantum attack risk perception model, collect relevant parameters of quantum attacks in real time, and calculate the real-time quantum attack risk value of each service to be migrated through the quantum attack risk perception model; Based on the business feature matrix and real-time quantum attack risk value, a dynamic migration rhythm adaptation model is constructed to calculate the migration priority, migration rate and migration interval of each business to be migrated. Build a migration fault tolerance and recovery model, monitor the migration process in real time, calculate the scope of fault impact and recovery cost based on fault information, and execute corresponding adjustment operations.

[0008] The beneficial effects of the present invention are as follows, compared with the prior art: This invention constructs a dynamic migration rhythm adaptation system that integrates quantum attack risks and business characteristics. By dynamically linking risk perception, migration priority, migration rate, and migration interval, it achieves accurate adaptation between migration strategies and risk states. By quantifying quantum attack risks in real time and dynamically adjusting the migration rhythm, it ensures that high-risk businesses are migrated quickly and prioritized, effectively resisting quantum attacks. A migration fault tolerance and recovery model is introduced. By accurately identifying faults, quantifying their impact range and recovery costs, and combining them with graded fault handling rules, the reliability and stability of the migration process are improved. It can quickly locate faults and handle them in a graded manner, preventing fault escalation and ensuring that the migration process does not affect the normal operation of power services. A quantum attack risk perception model is constructed, integrating the dynamic characteristics of quantum attacks and the security characteristics of the business itself, achieving precise risk quantification and providing a scientific basis for migration decisions. Through multi-faceted quantification, accurate risk perception and dynamic tracking are achieved. Attached Figure Description

[0009] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein: Figure 1 This is an overall flowchart of the risk-aware-based quantum cryptographic migration incremental control method for power business described in this invention; Figure 2 This is a flowchart of the method described in this invention for constructing a migration fault tolerance and recovery model, monitoring the migration process in real time, calculating the scope of fault impact and recovery cost based on fault information, and executing corresponding adjustment operations. Detailed Implementation

[0010] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0011] Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without inventive effort should fall within the scope of protection of this invention.

[0012] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0013] According to an embodiment of the present invention, in combination Figure 1 The flowchart shown illustrates a risk-aware, quantum-resistant cryptographic migration asymptotic control method for power business based on risk perception, as described in this invention. S1. Collect key parameters of all services to be migrated in the power system, perform standardized preprocessing on the collected key parameters, and construct a service feature matrix. Note that the following points should be noted in this step: In a preferred embodiment, the key parameters of the service to be migrated include the transmission rate of service data, the amount of service-sensitive data, the real-time requirements of the service, the frequency of interaction of service data, the historical operation failure records of the service, and the type of classic cryptographic system corresponding to the service.

[0014] In this embodiment, the services to be migrated are those in the power system that are currently using traditional classical cryptography and need to be gradually migrated to quantum-resistant cryptography. The power services include production control services, dispatch communication services, user electricity information management services, and office management services.

[0015] Furthermore, production control is a key business of the power system, responsible for the control of power grid production and operation and maintenance; dispatch communication is responsible for ensuring the transmission and interaction of power grid dispatch instructions and supporting the efficient operation of power grid dispatch; user electricity information management is responsible for the collection, statistics, management, and association of user electricity safety and billing with user electricity data; and office management is responsible for the internal office business of the power company, ensuring the daily operation of the power company.

[0016] Furthermore, the business data for production control includes real-time load data of the power grid, equipment operation and maintenance logs, fault alarm details, operator operation records, equipment operating temperature, voltage and current monitoring data, fault handling time and equipment maintenance records; the business data for dispatch communication includes dispatch instruction text, instruction transmission time, instruction execution feedback results, communication link status, communication delay fluctuation data, dispatcher operation logs and communication fault alarm records; the business data for user electricity information management includes user names, electricity addresses, meter numbers, real-time electricity consumption details, monthly billing records, payment records, electricity consumption anomaly alarm data, user repair records and peak and valley electricity consumption statistics; and the business data for office management includes employee office accounts, office approval process records, document circulation records, meeting minutes, attendance data, internal communication records, office software usage logs and administrative reimbursement data.

[0017] In a preferred embodiment, the method for standardizing and preprocessing the collected key parameters to construct a business feature matrix specifically includes: The mathematical expression for standardizing and preprocessing the key parameters collected is as follows: ; In this mathematical expression, For the first The first business to be migrated Standardized values ​​of key parameters, ∈[1, ], ∈[1, ], The number of services to be migrated. The dimensions of key parameters for the business to be migrated; For the first The first business to be migrated The values ​​of the key parameters; For all businesses to be migrated, the first The minimum value of each key parameter; For all businesses to be migrated, the first The maximum value of each key parameter; Next, construct the business feature matrix. , That is The Middle Line 1 The elements of the column.

[0018] It should be noted that the dimensions of the key parameters of the service to be migrated are the number of key parameters of the service to be migrated; the data transmission rate of the service is the data capacity of the service data transmitted by the service to be migrated per unit time before the current time; the amount of sensitive data is the total data capacity of the service data marked as sensitive in the service to be migrated, and the larger the data capacity, the higher the sensitivity; the real-time requirement of the service is the maximum latency threshold for the data transmission of the power service to be migrated; the interaction frequency of the service data is the number of interactions between the service to be migrated and other services to be migrated per unit time before the current time, and the higher the interaction frequency, the closer the correlation between the power services to be migrated; the service historical operation fault record is the operation fault of the migrated service in the past three years. The number of failures; the classical cryptosystem type corresponding to the business is the value of the classical cryptosystem type of the business to be migrated. When the classical cryptosystem type of the business to be migrated is RSA-2048 algorithm, its value is 1; when the classical cryptosystem type of the business to be migrated is ECC-256 algorithm, its value is 2; when the classical cryptosystem type of the business to be migrated is AES-256 algorithm, its value is 3. The value of the classical cryptosystem type is positively correlated with the quantum attack resistance of the classical cryptosystem, that is, the larger the value, the stronger the quantum attack resistance of the cryptosystem. If the classical cryptosystem type of the business to be migrated has more than one algorithm, the value of the classical cryptosystem type of the business to be migrated is the smallest value among its various algorithms.

[0019] For example, the sensitive business data in the business to be migrated is set according to specific requirements. For instance, when the business to be migrated is production control business, the sensitive business data may include real-time operating parameters of power plant units such as unit load and voltage and current thresholds, grid dispatch instructions, and confidential equipment operation and maintenance data such as core equipment passwords and permission information in operation and maintenance logs. When the business to be migrated is dispatch communication business, the sensitive business data may include dispatch instruction transmission records of the power system, encrypted communication data between upper and lower level dispatch centers, and confidential information of the grid topology. When the business to be migrated is user electricity information management business, the sensitive business data may include user ID numbers, home addresses, electricity account passwords, real-time electricity data, and sensitive electricity payment records of the power system. When the business to be migrated is office management business, the sensitive business data may include internal personnel permission information of the power system, confidential meeting minutes, and confidential financial data.

[0020] S2. Construct a quantum attack risk perception model, collect relevant parameters of quantum attacks in real time, and calculate the real-time quantum attack risk value of each service to be migrated through the quantum attack risk perception model to achieve accurate perception and quantification of quantum attack risks. Note that the following points should be noted in this step: In a preferred embodiment, the relevant parameters of the quantum attack include the signal strength of the quantum attack, the frequency of the quantum attack, the duration of the quantum attack, and the complexity of the attack path.

[0021] In a preferred embodiment, the mathematical expression of the quantum attack risk perception model is: ; In this mathematical expression, For the first Each business awaiting migration is at a certain time. The real-time quantum attack risk value is the value of the quantum attack. The larger the real-time quantum attack risk value, the higher the risk value, indicating the risk of the first quantum attack. The higher the risk of quantum attacks faced by each business to be migrated; For a moment Regarding the first The signal strength of a quantum attack on a business to be migrated; The maximum threshold for the signal strength of a quantum attack is set. For a moment Regarding the first The quantum attack frequency of each business to be migrated; For a moment Regarding the first The duration of a quantum attack on a business to be migrated; The maximum threshold for the set quantum attack frequency; The maximum threshold for the duration of a quantum attack; For a moment Regarding the first The attack path complexity of a quantum attack on a business to be migrated. Quantify the number of nodes and jumps in the attack path. The more complex the attack path, the more nodes and jumps it contains. The larger the value; This is the maximum threshold for the complexity of the quantum attack path. For the first The data volume of critical data for the business to be migrated Reflecting the The importance of the business data of the business to be migrated, the larger the data volume, the higher the value of the attack. The maximum data capacity for important data in all businesses to be migrated; For the first The numerical values ​​of classic cryptographic systems for the business to be migrated; For the first The first business to be migrated Standardized values ​​of key parameters.

[0022] It should be noted that the maximum threshold for the signal strength of a quantum attack can be the maximum signal strength of a quantum attack in the history of the power system. If such a maximum signal strength does not exist, it should be set to 0.001 dBm to avoid the denominator being zero; at time... Regarding the first The quantum attack frequency of a service to be migrated can be at time [time]. In the previous 1 second, for the first The number of quantum attacks on a business to be migrated; time. Regarding the first The duration of a quantum attack on a service to be migrated can be at time 1. The ongoing incident targeting the first The duration of a quantum attack on a service to be migrated, from the start to the end of the attack; the maximum threshold for the quantum attack frequency can be the maximum value of the quantum attack frequency that the power system can withstand, for example, it can be set to 10 times / second; the maximum threshold for the duration of a quantum attack can be the duration of a single quantum attack that the power system can withstand, for example, it can be set to 60 seconds; time Regarding the first The attack path complexity of a quantum attack on a business to be migrated can be calculated from the time interval [time]. Regarding the first The attack path information of this quantum attack on a service to be migrated has been determined. This attack path information includes the number of network nodes traversed by the attack path and the number of hops between network nodes within the attack path. =Number of network nodes × 0.6 + Number of hops × 0.4, where network nodes can be servers, communication nodes, and terminal devices in the power system, and the number of hops is the number of times to switch from one network node to another. 0.6 and 0.4 are the weights of the number of network nodes and the number of hops, respectively. This weighting is in line with the network characteristics of the power system, that is, the number of network nodes has a greater impact on the complexity of the attack path; the maximum threshold for the complexity of the quantum attack path can be set to 10.

[0023] For example, the key data for the business to be migrated is set according to specific requirements. For instance, when the business to be migrated is production control, the key data may include the output power of the power system's generator units, bus voltage and current, power equipment operation fault records, maintenance data, access permission data for the production control network, and equipment encryption and authentication data. When the business to be migrated is dispatch communication, the key data may include the power system's grid dispatch plan, emergency response instructions, instruction issuance, execution logs, and abnormal event records. When the business to be migrated is user electricity information management, the key data may include the power system's user identity information, electricity address, electricity bill settlement data, user payment information, identity authentication data, and electricity behavior analysis data. When the business to be migrated is office management, the key data may include the power system's employee information, office approval process data, enterprise financial basic data, and office system access data.

[0024] In this embodiment, the mathematical expression of the quantum attack risk perception model is as follows: The direct threat of quantum attacks is quantified by standardizing and integrating five aspects: the signal strength of quantum attacks, the product of attack frequency and duration of quantum attacks, attack path complexity, data capacity of important data, and the numerical values ​​of classical cryptographic system types that demonstrate quantum resistance. By using the logarithmic function of the summation of the elements of the business feature matrix, the security characteristics of the business to be migrated are integrated to achieve an accurate match between quantum attack risk and business characteristics, avoiding the limitations of assessing quantum attack risk from a single perspective.

[0025] Furthermore, in the mathematical expression of the quantum attack risk perception model, For the mean value parameter, For a moment Regarding the first The standardized value of the signal strength of a quantum attack on a service to be migrated accurately reflects the intensity threat of the quantum attack. This squared term can amplify the impact of high signal strength in quantum attacks, for example, when... When = 0.8, the squared result is 0.64; when When the value is 0.9, the squared value is 0.81, and the difference between the two values ​​increases significantly, which can accurately identify high signal strength. The product of attack frequency and duration of quantum attack is a standardized value. Using the product of attack frequency and duration of quantum attack as an important indicator can more comprehensively cover different types of quantum attack modes. This squared term can also amplify the threat scenarios of quantum attacks. This is a standardized value for the complexity of the attack path. This standardized value can accurately reflect the complexity of the quantum attack path. The more complex the attack path, the stronger the concealment, the higher the difficulty of cracking, and the greater the threat to the migrated business. The standardized value of the data capacity of important data is the larger the value, the higher the attack value of quantum attacks, and the more accurately it can reflect the attack value of the business to be migrated. The larger the value of , the weaker the resistance to quantum attacks, and the greater the risk of quantum attacks. This squared term can also amplify the threat scenarios of quantum attacks. This can fully reflect the importance of the services to be migrated. The risks of the services to be migrated in the power system depend not only on the quantum attack itself, but also on the importance of the services themselves. It can achieve accurate matching between attack risks and business characteristics. In addition, its logarithmic function has the characteristic of slow growth, which can avoid overcalibration caused by excessive accumulation and large size of the elements of the business feature matrix.

[0026] S3. Based on the business feature matrix and real-time quantum attack risk value, construct a dynamic migration rhythm adaptation model to calculate the migration priority, migration rate, and migration interval of each business to be migrated, thereby achieving dynamic adjustment of the migration rhythm and ensuring that high-risk businesses are migrated first and that the migration progress is adapted to the resource load and business operation status of the power system. Note that the following should be noted in this step: In a preferred embodiment, the dynamic migration rhythm adaptation model includes a mathematical expression for migration priority, which is: ; In this mathematical expression, For the first Each business awaiting migration is at a certain time. Migration priority, The larger the value, the more... The higher the migration priority of the first service to be migrated, the better. Migrate the business to be migrated; For the first Each business awaiting migration is at a certain time. Real-time quantum attack risk value; For the first Each business awaiting migration is at a certain time. Real-time quantum attack risk value; For the first The first business to be migrated Standardized values ​​of key parameters; For the first The first business to be migrated Standardized values ​​of key parameters.

[0027] In this embodiment, For the first The rate of change of quantum attack risk for each business to be migrated. It reflects the first The risk of quantum attack on a business to be migrated is trending upward or downward, with positive values ​​indicating an increase in risk and negative values ​​indicating a decrease in risk. It is an exponential function of the risk change rate, used to amplify the impact of the risk upward trend, ensuring that the migration priority of businesses with rapidly rising risks can be quickly improved to cope with sudden quantum attacks.

[0028] Furthermore, in the mathematical expression for migration priority, Indicates the first Each business awaiting migration is at a certain time. Real-time quantum attack risk value and the first The product of the standardized cumulative values ​​of the key parameters of each business to be migrated reflects the deep integration of real-time quantum attack risk and the importance of the business itself, ensuring that priority calculation takes into account both the level of risk and the value of the business. This is a normalization process for the molecules; overall, the mathematical expression integrates three factors: real-time quantum attack risk, the importance of the business itself, and dynamic changes in risk, making the priority calculation more comprehensive and more in line with the actual scenario of power business.

[0029] In a preferred embodiment, the dynamic migration rhythm adaptation model further includes a mathematical expression for the migration rate, which is: ; In this mathematical expression, For the first Each business awaiting migration is at a certain time. The adapted migration rate, i.e., the first Each business awaiting migration is at a certain time. The amount of data that can be adapted for migration within a unit of time; The set migration baseline rate; For the first Each business awaiting migration is at a certain time. Migration priority; For the first The first business to be migrated Standardized values ​​of key parameters; For a moment Resource load factor of the power system; The maximum threshold for the resource load rate of the power system; For the first Each business awaiting migration is at a certain time. The real-time quantum attack risk value.

[0030] In this embodiment, the migration reference rate can be the maximum transmission rate of normally transmitted data in the history of the power system, and normally transmitted data means that no packet loss occurred during data transmission. It depends on the specific requirements, but it can usually be set to 100%; time The resource load factor of a power system can be the average of the CPU utilization, memory utilization, and bandwidth utilization of all network nodes in the power system.

[0031] It should be noted that, The expression for the exponential decay of risk value is used to determine the value based on the first... Each business awaiting migration is at a certain time. The real-time quantum attack risk value adjusts the migration rate, the first Each business awaiting migration is at a certain time. The higher the real-time quantum attack risk value, the closer the migration rate is to the upper limit of the baseline rate. Each business awaiting migration is at a certain time. The lower the real-time quantum attack risk value, the lower the migration rate should be to avoid wasting resources.

[0032] Furthermore, Multiplication achieves a balance between risk and business importance, meeting the actual needs of power systems for prioritizing the protection of important business operations. This enables the system to function when the power system's resource load rate is low. When the migration rate approaches 1, it approaches the migration baseline rate; when the resource load factor of the power system increases, Increase the utilization of system resources to the maximum extent possible, provided that it does not exceed the upper limit of the power system's resource load.

[0033] In a preferred embodiment, the dynamic migration rhythm adaptation model further includes a mathematical expression for the migration interval, which is: ; In this mathematical expression, For the first Each business awaiting migration is at a certain time. The adaptation migration interval, i.e., the first The adaptation time interval between two migration batches of a service to be migrated, where the start time of the first migration batch can be set to time [time value missing]. ; The set migration reference interval; For the first Each business awaiting migration is at a certain time. Real-time quantum attack risk value; For a moment Resource load factor of the power system; The maximum threshold for the resource load rate of the power system; For the first Each business awaiting migration is at a certain time. Migration priority; For the first The first business to be migrated Standardized values ​​of key parameters, This is the MAX function.

[0034] In this embodiment, the first The services to be migrated are performed in batches using quantum-resistant cryptography; the migration reference interval is the basic migration interval preset by the power system according to specific requirements, for example, it can be preset to 60 seconds.

[0035] Furthermore, in the mathematical expression for the migration interval, Indicates the first Each business awaiting migration is at a certain time. Real-time quantum attack risk value The higher, The smaller the value, and even closer to 0, the shorter the migration interval, which meets the requirement of prioritizing rapid migration of high-risk businesses and slowing down low-risk businesses as needed; The higher the priority and the more important the business, the larger the denominator and the shorter the migration interval, which reflects both priority and business importance. This ensures that high-priority and high-importance businesses have shorter migration intervals and are migrated first. This demonstrates that when the power system load is low, the migration interval can be shortened and the migration efficiency improved; when the power system load is high, the migration interval can be extended to avoid power system overload, which meets the high reliability operation requirements of the power system.

[0036] Furthermore, the migration priority in the dynamic migration rhythm adaptation model is jointly determined by the risk value, business characteristics, and risk change trends, ensuring that high-risk and high-importance businesses are migrated first. The migration rate and migration interval are dynamically adjusted according to priority, risk value, and system resource load, which not only avoids power system overload but also rapidly improves the migration efficiency of high-risk businesses in the event of a sudden quantum attack, achieving dynamic adaptation of the migration rhythm and overcoming the problem of fixed migration rhythm in existing technologies.

[0037] S4. Construct a migration fault tolerance and recovery model, monitor the migration process in real time, calculate the scope of fault impact and recovery cost based on fault information, and execute corresponding adjustment operations to ensure that the migration process is uninterrupted and services are not lost. The corresponding adjustment operations are the execution of the corresponding fault handling rules. It should be noted that the following points are important in this step: like Figure 2 As shown, in a preferred embodiment, the method for constructing a migration fault tolerance and recovery model, monitoring the migration process in real time, calculating the fault impact range and recovery cost based on fault information, and executing corresponding adjustment operations specifically includes: S4.1, after acquiring all the services to be migrated at a given time... After determining the migration priority, the quantum-resistant cryptographic migration of the services to be migrated is performed in descending order of migration priority. The initial migration rate and migration interval are respectively... and .

[0038] Furthermore, the moment here This refers to the current moment.

[0039] S4.2 Real-time monitoring of the monitoring parameters of the services to be migrated during the migration process. The monitoring parameters include service operation parameters, password adaptation parameters, and data transmission parameters.

[0040] Furthermore, the operational parameters include data transmission success rate; cryptographic adaptation parameters include the operating efficiency of quantum-resistant cryptographic algorithms and the success rate of encryption and decryption; data transmission parameters include transmission latency; and therefore, the specific monitoring parameters include data transmission success rate, the operating efficiency of quantum-resistant cryptographic algorithms, the success rate of encryption and decryption, and transmission latency.

[0041] It should be noted that the data transmission success rate is the ratio of the volume of business data successfully transmitted from the source to the destination during the migration process to the total volume of data transmitted. The data transmission success rate mainly reflects the stability of data transmission. The source is often a server in a power system equipped with a classical cryptographic system, and the destination is often a server in a power system equipped with a quantum-resistant cryptographic algorithm. The operating efficiency of the quantum-resistant cryptographic algorithm is the number of data packets encrypted and decrypted by the quantum-resistant cryptographic algorithm per unit time during the migration process. The operating efficiency of the quantum-resistant cryptographic algorithm reflects its adaptability. The encryption and decryption success rate is the ratio of the number of times the quantum-resistant cryptographic algorithm successfully completes data encryption and decryption operations to the total number of operations during the migration process. The encryption and decryption success rate reflects the stability and correctness of the quantum-resistant cryptographic algorithm. The transmission delay is the total time taken for the migrated data to be sent from the source to the destination and successfully received. The transmission delay reflects the time consumed in the data transmission process.

[0042] For example, the quantum-resistant cryptographic algorithm can be the CRYSTALS-Kyber algorithm; the data transmission success rate can be calculated by monitoring the total data capacity of the data transmitted during the migration process of the service to be migrated, and the data capacity of the successfully transmitted data. The ratio of the successfully transmitted data capacity to the total data capacity is the data transmission success rate, which can be updated every 1 second. The total data capacity is the total data capacity sent by the source, and the data capacity of the successfully transmitted data is the data capacity confirmed and verified by the target. The operating efficiency of the quantum-resistant cryptographic algorithm can be measured in real time by collecting the number of data packets encrypted and decrypted by the quantum-resistant cryptographic algorithm per unit time before the current moment in the migration process; the transmission delay can be measured by the average of the total time taken for each migrated data to be successfully received by the target during the migration process. This average value is the transmission delay.

[0043] S4.3. Based on the monitoring parameters during the migration process, calculate the fault identification indicators to determine whether a migration fault exists. Note that the following points should be noted in this step: In a preferred embodiment, the mathematical expression for the fault identification index is: ; In this mathematical expression, For the first in the migration Each business awaiting migration is at a certain time. Fault identification indicators The larger the value, the more likely it is to be the first migration. The higher the probability of failure for each service to be migrated; For the first in the migration Each business awaiting migration is at a certain time. The The values ​​of each monitoring parameter; Dimensions for monitoring parameters; For the first in the migration The first business to be migrated Standard values ​​for each monitoring parameter; The method to determine if a migration failure exists is as follows: when At that time, it was determined that the migration was in progress. The migration process for one of the services to be migrated encountered a failure; when At that time, it was determined that the migration was in progress. The migration process for the services to be migrated is proceeding normally. The set fault identification threshold, This is used to ensure the accuracy of fault identification, that is, to determine whether there is a migration fault, and to avoid misjudgment and omission.

[0044] In this embodiment, the dimension of the monitoring parameter is the number of monitoring parameters; To meet the needs of the electricity business that is being migrated The specific normal migration operation requirements for each service to be migrated The values ​​of each monitoring parameter.

[0045] Furthermore, in the mathematical expression of fault identification indicators, the essence of a migrating fault is that the monitoring parameters deviate from the preset normal standard of the power system, and the difference between the two is... It directly quantifies the degree of deviation of the monitoring parameters. The larger the difference, the more serious the deviation of the monitoring parameters from the normal state, which is completely consistent with the actual performance of the fault. The denominator of the mathematical expression of the fault identification index is used for normalization.

[0046] For example, The setting method can begin by using monitoring parameters of normally migrated power services from historically migrated power services in the power system. Then, each set of monitoring parameters is substituted into the mathematical expression of the fault identification index to obtain several fault identification indices. Finally, the average value of these fault identification indices is calculated. and standard deviation Then according to 3 The principle will The value is set to ,For example The value is 1.5, where the normally migrated power service is the power service in which all monitoring parameters are within the standard range of the preset monitoring parameters for normal operation of the migration service during the migration process from classical cryptography to quantum-resistant cryptography.

[0047] S4.4 When a fault is detected in the migration process, calculate the fault's impact range and recovery cost, and then execute the corresponding fault handling rules accordingly. Note that the following points should be noted in this step: In a preferred embodiment, the mathematical expression for the fault impact range is: ; In this mathematical expression, To determine the first fault in the migration process Each business awaiting migration is at a certain time. The scope of the fault's impact, The larger the value, the wider the range of the fault's impact. For the first The business to be migrated and the first The correlation coefficient of each business to be migrated, in = Under the conditions, ,exist Under the conditions, , For the first The frequency of interaction of business data for each business to be migrated For the first The frequency of interaction of business data for each business to be migrated The higher the coefficient, the greater the correlation coefficient, and the wider the scope of the fault's impact. For the first Each business awaiting migration is at a certain time. Real-time quantum attack risk value; For the first in the migration Each business awaiting migration is at a certain time. Fault identification indicators; The set fault identification threshold.

[0048] In this embodiment, Both considered The number represented The business to be migrated and the first The strength of the correlation between the businesses to be migrated, combined with... The associated first The inherent quantum attack risk of each business to be migrated should be considered to avoid the one-sidedness of only looking at the correlation without considering the risk; denominator It is used to standardize its molecules; This is reflected in the migration of the first The standardization of the severity of faults in each business to be migrated; Overall, the mathematical expression of the fault impact range accurately quantifies and integrates the severity of the fault itself and the business-related risks, achieving the function of objectively quantifying the fault impact range, providing a scientific basis for fault classification and handling, and meeting the requirements of high reliability and anti-cascading faults in the power business.

[0049] In a preferred embodiment, the mathematical expression for the fault recovery cost is: ; In this mathematical expression, To determine the first fault in the migration process Each business awaiting migration is at a certain time. The cost of fault recovery The larger the value, the more... The higher the recovery cost for each business to be migrated; For the first The amount of business-sensitive data for the business to be migrated; For the first Each business awaiting migration is at a certain time. The appropriate migration rate; To determine the first fault in the migration process Each business awaiting migration is at a certain time. The scope of the fault's impact; For the first Each business awaiting migration is at a certain time. The appropriate migration interval; For the first in the migration Each business awaiting migration is at a certain time. Fault identification indicators; For the first The first business to be migrated Standardized values ​​of key parameters.

[0050] Furthermore, within the mathematical expression of fault recovery cost middle, This reflects the data capacity of the business data transmitted within the unit's migration batch. The larger the data capacity, the more data needs to be retransmitted during recovery, and the higher the corresponding cost. For the first in the migration Each business awaiting migration is at a certain time. The more severe the fault, the more important it is to identify the fault indicators. The larger the size, the more problems need to be fixed during recovery, and the higher the cost. In Its function is to standardize the molecules on it; Reflecting the first The importance and complexity of the business to be migrated are considered. The more important and complex the business, the more complete the corresponding supporting mechanisms will be, and the lower the cost of recovery. In other words, the larger the denominator, the smaller the overall value. The greater the scope of the impact, the higher the cost of recovery.

[0051] In the above embodiments, the migration fault tolerance and recovery model includes mathematical expressions for fault identification indicators, mathematical expressions for fault impact range, and mathematical expressions for fault recovery costs.

[0052] In a preferred embodiment, the fault handling rules include: exist <0.3 and Under a value <0.3, it indicates that the detected fault is a minor fault with a small impact and low recovery cost, so a fault repair operation is performed. This involves adjusting the operating parameters of the quantum-resistant cryptographic algorithm and the data transmission link based on the deviation of the monitoring parameters. After repair, migration continues. At a value <0.3... <0.7 and 0.3 If the value is less than 0.7, it indicates that the identified fault is a moderate fault with a moderate impact range and moderate recovery cost. In this case, a fault rollback operation is performed, which means that the fault identified during the migration process is rolled back. The migration status of each service to be migrated is rolled back to its most recent normal state before the failure. After adjusting the migration rate and migration interval, the migration is restarted. and Under other conditions, if the identified fault is a serious fault with a wide impact and high recovery cost, then the migration process that was identified as having a fault will be suspended. For each business to be migrated, priority should be given to migrating the business with the highest risk value among its related businesses. After the related businesses have been migrated, the fault status should be reassessed, the migration strategy should be adjusted, and then the migration should be started.

[0053] In this embodiment, 0.3 and 0.7 are used as dividing points to clearly divide the interval into three levels: [0, 0.3), [0.3, 0.7), and [0.7, 1], avoiding ambiguity in the classification and conforming to the principle of accurate classification and differentiated processing in power systems. In the case of minor faults, monitoring parameters outside the standard range of monitoring parameters for normal operation of the migration service are extracted. If the password adaptation parameters contain monitoring parameters outside the standard range, Adjust the operating parameters of the quantum-resistant cryptographic algorithm, such as increasing the key update frequency from once per minute to twice per minute and the encryption block size from 128 bits to 256 bits, to ensure that the cryptographic adaptation parameters return to their standard values. If there are monitoring parameters outside the standard range in the business operation parameters or data transmission parameters... Switch the backup transmission link for the service to be migrated that has been identified as having a fault during the migration process, for example, switch from a fiber optic link to a redundant microwave link. Optimize the bandwidth allocation of the link for the service to be migrated that has been identified as having a fault during the migration process, for example, by increasing the link bandwidth of that service by 20%-30%. Close data transmissions unrelated to the migration service in the backup transmission link to reduce congestion on the backup transmission link. After the adjustment is completed, continuously collect and monitor parameters. Calculate fault identification indicators ,like < Once the repair is deemed complete, the migration process for the service will be immediately resumed, retaining the original migration priority, migration rate, and migration interval, without the need to adjust other parameters.

[0054] Furthermore, under the condition of a moderate fault, the time of the most recent normal migration state before the fault is determined. ,Right now < The transition state at time is denoted as time . The status will be rolled back to the previous state. ,delete arrive Data migrated during the failure period, recovery The cryptographic adaptation parameters at any given time, such as the operating parameters and key state of quantum-resistant cryptographic algorithms, are used to reset the operational state of this service to that time. For example, the response time and data transmission success rate of this service, based on the current moment. The resource load factor of the power system and the real-time risk value of this business Get the current time Adaptive migration rate and the appropriate migration interval In that The migration rate for this service should be reduced by 10%-20% from the current rate to avoid further failures due to excessively high rates. Based on this, extend the migration interval for this service by 20%-30%, increase the status verification time between migration batches, and restart the migration process for this service after the adjustment is completed.

[0055] Furthermore, in the event of a severe failure, the process of determining that a fault exists in the migration process is paused. The migration process of the first business to be migrated is selected, and the first one that is determined to have a fault in the migration process is identified. All related businesses of the business to be migrated, which are the related businesses. The non-zero first One business to be migrated, among which And obtain the real-time status of each related business. Real-time quantum attack risk value , will be selected The migration priority of the associated business with the highest value is raised to the highest level, and the value is calculated. The highest value of the associated business at time The appropriate migration rate and interval are used as the migration rate and interval for the associated service, respectively, and the migration of the associated service is initiated to ensure that the core associated service can quickly complete the quantum-resistant cryptographic migration and avoid the attack risk caused by fault propagation. After the associated service has completed the migration, the monitoring parameters of the services to be migrated that have faults in the migration process are collected again, and their fault identification indicators are calculated. Based on the fault identification indicators, the method for judging whether there is a migration fault is used to determine whether the services to be migrated that have faults in the migration process have recovered to normal. If the migration has recovered to normal, the migration strategy of the services to be migrated is adjusted, such as reducing the migration rate, extending the migration interval, and optimizing the running parameters of the cryptographic algorithm. Then the migration process of the services to be migrated is initiated. If the migration has not yet recovered to normal, the migration of the service is suspended again, the root cause of the fault is manually inspected and troubleshooted, and the migration process of the services to be migrated is initiated again after the root cause of the fault is repaired.

[0056] The method of this invention overcomes the shortcomings of current gradual migration methods for power services, which simply migrate in segments according to service type, lack dynamic migration rhythm control, lack a sound fault tolerance mechanism, and cannot cope with the risk of sudden quantum attacks. By constructing a quantum attack risk quantification model, a dynamic migration rhythm adaptation model, and a migration fault tolerance and recovery model, it achieves accurate, dynamic, and highly reliable control of quantum cryptographic migration of power services, ensuring the safe and stable operation of power services during the migration process, and improving migration efficiency and resistance to quantum attacks.

[0057] It should be recognized that embodiments of the present invention may be implemented or carried out by computer hardware, a combination of hardware and software, or by computer instructions stored in a non-transitory computer-readable storage medium.

[0058] The method can be implemented using standard programming techniques, including a non-transitory computer-readable storage medium configured with a computer program in the computer program, wherein the storage medium is configured such that the computer operates in a specific and predefined manner.

[0059] Each program can be implemented in a high-level procedural or object-oriented programming language to communicate with the computer system; however, if required, the program can be implemented in assembly or machine language.

[0060] In any case, the language can be either compiled or interpreted.

[0061] Furthermore, for this purpose, the program can run on programmed application-specific integrated circuits.

[0062] The processes described herein (or variations and / or combinations thereof) can be executed under the control of one or more computer systems configured with executable instructions, and can be implemented by hardware or a combination thereof as code (e.g., executable instructions, one or more computer programs, or one or more applications) that commonly executes on one or more processors. The computer program includes a plurality of instructions executable by one or more processors.

[0063] Furthermore, the method can be implemented in any suitable computing platform, including but not limited to personal computers, minicomputers, mainframes, workstations, networked or distributed computing environments, standalone or integrated computer platforms, or in communication with charged particle tools or other imaging devices.

[0064] Various aspects of the present invention can be implemented in machine-readable code stored on a non-transitory storage medium or device, whether portable or integrated into a computing platform, such as a hard disk, optical read and / or write storage medium, RAM, ROM, etc., such that it can be read by a programmable computer, and when the storage medium or device is read by the computer, it can be used to configure and operate the computer to perform the processes described herein.

[0065] Furthermore, machine-readable code, or parts thereof, can be transmitted via wired or wireless networks.

[0066] When such media includes instructions or programs that combine with a microprocessor or other data processor to implement the steps described above, the invention described herein includes these and other different types of non-transitory computer-readable storage media.

[0067] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A risk-aware, quantum-cryptographic migration-based progressive control method for power business, characterized in that, include: Collect key parameters of all services to be migrated in the power system, perform standardized preprocessing on the collected key parameters, and construct a service feature matrix. Construct a quantum attack risk perception model, collect relevant parameters of quantum attacks in real time, and calculate the real-time quantum attack risk value of each service to be migrated through the quantum attack risk perception model; Based on the business feature matrix and real-time quantum attack risk value, a dynamic migration rhythm adaptation model is constructed to calculate the migration priority, migration rate and migration interval of each business to be migrated. Build a migration fault tolerance and recovery model, monitor the migration process in real time, calculate the scope of fault impact and recovery cost based on fault information, and execute corresponding adjustment operations.

2. The risk-aware-based quantum cryptographic migration asymptotic control method for power business as described in claim 1, characterized in that, Key parameters for the services to be migrated include the data transmission rate, the amount of sensitive data, the real-time requirements, the frequency of data interaction, historical operational failure records, and the type of classic cryptographic system corresponding to the services.

3. The risk-aware, quantum-resistant, incremental control method for power business migration based on risk perception, as described in claim 2, is characterized in that... The method for standardizing and preprocessing the collected key parameters to construct a business feature matrix includes: The mathematical expression for standardizing and preprocessing the key parameters collected is as follows: ； In this mathematical expression, For the first The first business to be migrated Standardized values ​​of key parameters, ∈[1, ], ∈[1, ], The number of services to be migrated. The dimensions of key parameters for the business to be migrated; For the first The first business to be migrated The values ​​of the key parameters; For all businesses to be migrated, the first The minimum value of each key parameter; For all businesses to be migrated, the first The maximum value of each key parameter; Next, construct the business feature matrix. , That is The Middle Line number The elements of the column.

4. The risk-aware, quantum-resistant, incremental control method for power business migration based on risk perception, as described in claim 3, is characterized in that... The relevant parameters of a quantum attack include the signal strength, frequency, duration, and path complexity.

5. The risk-aware, quantum-resistant, incremental control method for power business migration based on risk perception, as described in claim 4, is characterized in that... The mathematical expression for the quantum attack risk perception model is: ； In this mathematical expression, For the first Individual businesses awaiting migration are at any time Real-time quantum attack risk value; This is a quantization coefficient for the complexity of the attack path; The impact coefficient of the data volume of important data; For a moment Regarding the first The signal strength of a quantum attack on a business to be migrated; The maximum threshold for the signal strength of a quantum attack is set. For a moment Regarding the first The quantum attack frequency of each business to be migrated; For a moment Regarding the first The duration of a quantum attack on a business to be migrated; The maximum threshold for the set quantum attack frequency; The maximum threshold for the duration of a quantum attack; For a moment Regarding the first The attack path complexity of a quantum attack on a business to be migrated; This is the maximum threshold for the complexity of the quantum attack path. For the first The data volume of critical data for the business to be migrated; The maximum data capacity for important data in all businesses to be migrated; For the first The numerical values ​​of classic cryptographic systems for the business to be migrated; For the first The first business to be migrated Standardized values ​​of key parameters.

6. The risk-aware, quantum-resistant cryptographic migration asymptotic control method for power business based on claim 5, characterized in that, The dynamic migration pacing adaptation model includes a mathematical expression for migration priorities, which is: ； In this mathematical expression, For the first Individual businesses awaiting migration are at any time Migration priority; For the first Individual businesses awaiting migration are at any time Real-time quantum attack risk value; For the first Individual businesses awaiting migration are at any time Real-time quantum attack risk value; For the first The first business to be migrated Standardized values ​​of key parameters; For the first The first business to be migrated Standardized values ​​of key parameters; The dynamic migration pacing adaptation model also includes a mathematical expression for the migration rate, which is: ； In this mathematical expression, For the first Individual businesses awaiting migration are at any time The appropriate migration rate; The set migration baseline rate; For the first Individual businesses awaiting migration are at any time Migration priority; For the first The first business to be migrated Standardized values ​​of key parameters; For a moment Resource load factor of the power system; The maximum threshold for the resource load rate of the power system; For the first Individual businesses awaiting migration are at any time Real-time quantum attack risk value; The dynamic migration pacing adaptation model also includes a mathematical expression for the migration interval, which is: ； In this mathematical expression, For the first Individual businesses awaiting migration are at any time The appropriate migration interval; The set migration reference interval; For the first Individual businesses awaiting migration are at any time Real-time quantum attack risk value; For a moment Resource load factor of the power system; The maximum threshold for the resource load rate of the power system; For the first Individual businesses awaiting migration are at any time Migration priority; For the first The first business to be migrated Standardized values ​​of key parameters.

7. The risk-aware, quantum-resistant, incremental control method for power business migration based on risk perception, as described in claim 6, is characterized in that... A method for constructing a migration fault tolerance and recovery model, monitoring the migration process in real time, calculating the scope of fault impact and recovery cost based on fault information, and executing corresponding adjustment operations, specifically includes: After acquiring all the business processes to be migrated at any time After determining the migration priority, the quantum-resistant cryptographic migration of the services to be migrated is carried out in descending order of migration priority. Real-time monitoring of the parameters of the services to be migrated during the migration process, including service operation parameters, password adaptation parameters, and data transmission parameters; Based on the monitoring parameters during the migration process, fault identification indicators are calculated to determine whether migration faults exist. When a fault is detected in the migration process, the scope of the fault's impact and the cost of fault recovery are calculated, and the corresponding fault handling rules are executed accordingly.

8. The risk-aware, quantum-resistant cryptographic migration asymptotic control method for power business based on claim 7, characterized in that, The mathematical expression for the fault identification index is: ； In this mathematical expression, For the first in the migration Individual businesses awaiting migration are at any time Fault identification indicators; For the first in the migration Individual businesses awaiting migration are at any time The Real-time values ​​of each monitoring parameter; Dimensions for monitoring parameters; For the first in the migration The first business to be migrated Standard values ​​for each monitoring parameter; The method to determine if a migration failure exists is as follows: when At that time, it was determined that the migration was in progress. The migration process for one of the services to be migrated encountered a failure; when At that time, it was determined that the migration was in progress. The migration process for the services to be migrated is proceeding normally. The set fault identification threshold; The mathematical expression for the scope of the fault's impact is: ； In this mathematical expression, The first step in identifying a fault in the migration process Individual businesses awaiting migration are at any time The scope of the fault's impact; For the first The business to be migrated and the first The correlation coefficient of each business to be migrated, in = Under the conditions, ,exist Under the conditions, , For the first The frequency of interaction of business data for each business to be migrated For the first The frequency of interaction of business data for each business to be migrated; For the first Individual businesses awaiting migration are at any time Real-time quantum attack risk value; For the first in the migration Individual businesses awaiting migration are at any time Fault identification indicators; The set fault identification threshold; The mathematical expression for the cost of fault recovery is: ； In this mathematical expression, To determine the first fault in the migration process Individual businesses awaiting migration are at any time The cost of fault recovery; For the first The amount of business-sensitive data for the business to be migrated; For the first Individual businesses awaiting migration are at any time The appropriate migration rate; To determine the first fault in the migration process Individual businesses awaiting migration are at any time The scope of the fault's impact; For the first Individual businesses awaiting migration are at any time The appropriate migration interval; For the first in the migration Individual businesses awaiting migration are at any time Fault identification indicators; For the first The first business to be migrated Standardized values ​​of key parameters; Fault handling rules include: exist <0.3 and Under the condition of <0.3, it indicates that the detected fault is a minor fault, and a fault repair operation is performed. That is, based on the deviation of the monitoring parameters, the running parameters of the quantum-resistant cryptographic algorithm and the data transmission link are adjusted, and the migration continues after the repair is completed. At 0.3 <0.7 and 0.3 If the value is less than 0.7, it indicates that the identified fault is a moderate fault, and a fault rollback operation is performed, that is, the fault identified during the migration process is rolled back. The migration status of each service to be migrated is rolled back to the most recent normal state before the failure. After adjusting the migration rate and migration interval, the migration is restarted. exist and Under other conditions, if the identified fault is a serious fault, the process of determining that the migration process has a fault will be suspended. For each business to be migrated, priority should be given to migrating the business with the highest risk value among its related businesses. After the related businesses have been migrated, the fault status should be reassessed, the migration strategy should be adjusted, and then the migration should be started.

Images