A cross-domain zero-trust authentication system for power information communication system integrating cloud, edge and end

Abstract

The present invention discloses a cross-domain zero-trust authentication system for a cloud-edge-end integrated power information communication system, including a cloud resource navigation server and a number of mutually isolated trust domains; each of the trust domains includes a policy center and an agent gateway; a physical resource access channel is constructed between the agent gateways of the trust domain with resource access services; a zero-trust authentication channel is constructed between the policy centers of the trust domains participating in distributed authentication; the policy center runs on the edge side; a domain judgment module, a local domain authentication module, a cross-domain authentication module, and a behavior log recording module are deployed in the policy center. The present invention can realize zero trust by adopting a cloud-edge-end integrated architecture, can give full play to the advantages of cloud data sharing, rich edge-side computing resources, and convenient terminal-side access methods, etc., to perform targeted distributed authentication on resource requests, is easy to deploy, has strong compatibility, does not need to rely on the instant management of registered users, and has good user experience.

Description

Technical Field

[0001] The present invention relates to the field of zero-trust network technology, and in particular to a cross-domain zero-trust authentication system and method for a cloud-edge-end integrated power information communication system. Background Art

[0002] The zero-trust network (also known as zero-trust architecture) model was created by John Kindvig, chief analyst at Forrester, in 2010. With the complexity of network services and the diversification of attack types, the zero-trust model has gradually become one of the popular frameworks for network security. Zero trust is a security concept. The central idea is that enterprises should not automatically trust anyone / things / objects inside or outside, and should verify anyone / things / objects attempting to access the enterprise system before authorization. Therefore, the most critical thing in the zero-trust architecture is the authentication and authorization of resource access. In actual operation, all resource access processes need to be authenticated, similar to the idea of ​​a whitelist minimum permission set. Unless the network clearly knows the identity of the accessor, any unauthorized or unknown authorized path IP, host, ID and other entities are denied access.

[0003] "Zero Trust" requires enterprises to use micro-segmentation and fine-grained boundary rules to determine whether to trust users / hosts / applications that request access to a specific scope of the enterprise based on conditions such as users, user locations, and other data. Zero Trust relies on technologies such as multi-factor authentication, identity and access management (IAM), orchestration, analysis, encryption, security ratings, and file system permissions to do the above work. The principle of least privilege is also one of the regulatory strategies that Zero Trust relies on, that is, only granting users the minimum access rights required to complete a specific task.

[0004] For cross-domain resource access, the authentication process is more important and more complicated. However, existing research mainly focuses on authentication within the same trust domain, and less research is done on cross-domain situations.

[0005] The invention with the publication number of CN103973451A discloses a cross-trust domain authentication method for a distributed network system, which uses a distributed key generation and threshold signature mechanism based on the elliptic curve cryptography system to build a virtual bridge authentication center VBCA, and uses the virtual bridge authentication center VBCA to complete the cross-domain interactive authentication between entities in different trust domains in the distributed network system. The invention method has the advantages of universality for various organizational structures, agility and dynamics, low cost, short authentication path, high bit security, high efficiency and easy hardware implementation, which is conducive to solving the cross-domain interactive authentication problem between entities in different trust domains in dynamic distributed network systems under the condition of limited terminal resources or communication bandwidth, and has broad application prospects in cloud computing and cloud storage networks, the Internet of Things, wireless sensor networks, agile manufacturing systems, and virtual organizations. However, it does not consider how to effectively combine local and cross-domain authentication. Cross-domain authentication is highly dependent on the effective management of members' key shadows. Once the member's key shadow fails or the update is wrong, it is difficult to perform authentication, so it cannot be applied to cross-domain zero-trust authentication in the power information communication system of cloud edge fusion.

[0006] The invention with publication number CN103780393A discloses a virtual desktop security authentication system and method for multiple security levels, which involves an identity authentication method based on user behavior and system implementation. First, the security authentication method introduces a user behavior authentication mechanism, proposes a method for collecting, determining and predicting user domain and cross-domain behaviors, and implements a user behavior security authentication method combined with role permissions; secondly, the encryption part of the authentication method adopts a digital signature based on an elliptic curve, and a symmetric encryption algorithm is introduced in the signature algorithm. In order to reduce the computational complexity of the algorithm, the inversion operation of large integers is eliminated in the signature equation, which improves the efficiency of the signature and ensures the security of the authentication method and system; finally, the system realizes unified identity authentication of users, reduces the deployment of authentication servers, and reduces costs. This mechanism can be widely used in cloud computing virtual desktop security authentication, multiple security levels and other related fields. The invention proposes a method for collecting, determining and predicting user domain and cross-domain behaviors, which reduces the deployment of authentication servers. Users only need to log in once to conveniently switch virtual desktops of different security levels based on their past behaviors. However, the invention only considers user rights and user behaviors, and needs to predict user authentication in combination with the user's intra-domain and cross-domain behaviors. The prediction operation is complex and does not consider the specific situation of resources. Summary of the invention

[0007] In view of the deficiencies in the prior art, the present invention provides a cross-domain zero-trust authentication system and method for a cloud-edge-end integrated power information communication system. The system and method are based on the threshold signature mechanism in secure multi-party computing. The relevant trust domains simultaneously combine user historical behaviors and resource attributes to perform targeted distributed authentication on resource requests. The system is easy to deploy, has strong compatibility, does not rely on the immediate management of registered users, and has a good user experience.

[0008] To achieve the above object, the present invention adopts the following technical solutions:

[0009] A cross-domain zero-trust authentication system for a cloud-edge-end integrated power information communication system, wherein the cross-domain zero-trust authentication system is applied to a cloud-edge-end integrated power information communication system;

[0010] The cross-domain zero-trust authentication system includes a cloud resource navigation server and a plurality of mutually isolated trust domains; each of the trust domains has a plurality of registered users, and stores resource data to be accessed therein; the cloud resource navigation server is used to manage trust domain routing information and trust domain information associated with each registered user;

[0011] Each of the trust domains includes a policy center and a proxy gateway; a physical resource access channel is built between the proxy gateways of the trust domains with resource access services; a zero-trust authentication channel is built between the policy centers of the trust domains participating in distributed authentication; the policy center runs on the edge side;

[0012] The proxy gateway intercepts the resource access request received from the requester, returns the digital identity of the requester, generates an access request event and submits it to the policy center of the trust domain to which it belongs;

[0013] The policy center is deployed with a domain judgment module, a local domain authentication module, a cross-domain authentication module and a behavior log recording module; the behavior log recording module is used to store the access behavior logs of all users in the domain where the policy center is located; the domain judgment module is used to judge the domain to which the resource corresponding to the access request event belongs. If it belongs to the domain where the user is located, the access request event is transferred to the local domain authentication module; otherwise, the access request event is transferred to the cross-domain authentication module, triggering the cross-domain authentication module of the domain where the target resource is located to enter the authentication process; the local domain authentication module combines the digital identity of the requester and the matching result of the access policy library, and notifies the local proxy gateway to open the access rights of the resources corresponding to its authority to the user for a limited time; the cross-domain authentication module of the domain where the target resource is located accesses the cloud resource navigation server to obtain the policy centers of multiple trust domains associated with the requester to form a distributed authentication group, and the distributed authentication group does not include the trust domain where the requester is located and the trust domain where the resource is located;

[0014] Each member of the distributed authentication group conducts a comprehensive evaluation of the trust of the resource requester based on the historical behavior log of the resource requester stored in the cloud public database and the access behavior log of the resource requester stored in their respective behavior log recording modules. If the requester is considered trustworthy, the scoring data is encrypted based on the threshold signature algorithm of the elliptic curve encryption mechanism and submitted to the policy center of the trust domain where the resource is located, otherwise, the information that the evaluation cannot be performed is returned; the policy center of the trust domain where the resource is located performs trust authentication on the resource request based on the submission results of all members of the distributed authentication group, and for resource requests that pass the authentication, the proxy gateway is notified to open the corresponding access port, and the access rights to the resources corresponding to its authority are opened to the requester for a limited time.

[0015] To optimize the above technical solutions, the specific measures taken also include:

[0016] Furthermore, 5G slicing or IP tunnel technology is used to switch the resource access channel and the zero-trust authentication channel.

[0017] Further, the policy center includes a user registration module;

[0018] The user registration module receives the unique identifier Id and validity period T1 sent by the user, and generates a digital identity DID of the user with a preset validity period T1 =

[0019] After the validity period is reached, the user registration module updates the user's digital identity regularly or according to the update request sent by the user. The update is calculated based on the running time. After the T2 time period, the updated digital identity is DID=

[0020] Further, the local domain authentication module includes a resource management unit, a registered user management unit, a local domain access policy library, a user authority authentication unit and a local domain resource access management unit;

[0021] The resource management unit is used to manage the resource library of the trust domain, and each resource is set with a corresponding local domain access right; the registered user management unit is used to manage the registered users of the trust domain, and each registered user has an independent digital identity; the local domain access policy library is used to store the local domain resource rights corresponding to each access right of the registered user;

[0022] ​​The user authority authentication unit extracts the digital identity D1 of the requester contained in the access request event, matches the extracted digital identity D1 of the requester with the storage information of the local domain access policy library, and obtains the local domain resource authority X of the requester; then matches the local domain resource authority X with the accessed object, and obtains the open parameter F of the accessed object;

[0023] The domain resource access management unit is used to notify the local proxy gateway based on the open parameter F of the accessed object and the requester information sent by the user authority authentication unit, open the access permission with the open parameter F on the accessed object to the requester, and start the timer T. When the time ends, notify the local proxy gateway again to close the access permission, and record the access log of the requester to the behavior log recording module.

[0024] Further, the cross-domain authentication module includes a routing query unit, an authentication request detection unit, a cross-domain access policy library, an authentication management unit, a distributed authentication group generation unit, a scoring unit, a scoring authentication unit and a cross-domain resource access management unit;

[0025] The routing query unit is used to extract the information domain information of the resources contained in the access request event, and query the cloud resource navigation server whether there is a corresponding cross-domain route. If so, the authentication request detection unit is triggered, so that the authentication request detection unit initiates authentication request detection information to the policy center of the domain where the target resource is located. Otherwise, the cross-domain resource access management unit returns the information that the requester cannot access the information; if the authentication request detection unit receives the authentication request detection response sent by the authentication request detection unit of the domain where the requester is located, it indicates that the authentication management unit of the domain where the target resource is located has been triggered, and the authentication process has begun;

[0026] The cross-domain access policy library is used to store cross-domain access attributes and cross-domain access permissions of resources in the domain, as well as cross-domain resource permissions corresponding to each access permission of a registered user;

[0027] After the authentication management unit of the domain where the target resource is located is triggered, the digital identity of the requester and the target resource requested by the requester are extracted from the access request event, and the cross-domain access policy library is retrieved to verify whether the target resource has the cross-domain access attribute. If it has the cross-domain access attribute, the cross-domain resource permission X' of the requester is obtained, and then the cross-domain resource permission X' of the requester is matched with the cross-domain access permission of the target resource to obtain the open parameter F' of the target resource; at the same time, the digital identity of the requester and the attribute information of the target resource are sent to the distributed authentication group generation unit, and the distributed authentication group generation unit forms a distributed authentication group, so that the scoring unit of each member of the distributed authentication group retrieves the historical behavior log of the resource requester stored in the cloud public database and the access behavior log of the resource requester stored in each behavior log recording module according to the digital identity of the requester and the attribute information of the target resource, and comprehensively evaluates the trust of the resource requester. If the requester is considered to be trustworthy, the scoring data is encrypted based on the threshold signature algorithm of the elliptic curve encryption mechanism and submitted to the policy center of the trust domain where the resource is located, otherwise, the information that the evaluation cannot be performed is returned;

[0028] After receiving the submission results of all members of the distributed authentication group, if the total number of scoring data reaches t, the authentication management unit triggers the scoring authentication unit, so that the scoring authentication unit performs trust authentication on the resource request according to the submission results of all members of the distributed authentication group, otherwise, returns authentication failure information to the requester; the authentication management unit sends the authentication result to the cross-domain resource access management unit; the cross-domain resource access management unit notifies the proxy gateway to open the corresponding access port for the resource request that passes the authentication, opens the access rights of the resources corresponding to its authority to the requester for a limited time, opens the access rights of the accessed object with the opening parameter F' to the requester, and starts the timer T'. When the timing ends, it notifies the local proxy gateway to close the access rights again, and records the access log of the requester to the behavior log recording module.

[0029] Further, the distributed authentication group generation unit includes a related domain acquisition component, a target resource parsing component and a member screening component;

[0030] The related domain acquisition component is used to access the cloud resource navigation server, and obtain the policy centers of t trust domains associated with the requester according to the digital identity of the requester to form an access routing set R{};

[0031] The target resource parsing component parses the attribute information of the target resource, extracts relevant features, and obtains a corresponding attribute vector;

[0032] The member screening component cyclically accesses the elements in R{}, and obtains the trust domain policy center set S{} that are allowed to participate in the distributed authentication according to the attribute information of the target resource, until the number of members in the trust domain policy center set S{} reaches the threshold value t, forming a distributed authentication group; wherein, as the number of cycles increases, the difference between the attribute vector of the historical resource in the access log record of the selected member and the attribute vector of the target resource becomes larger; t is a positive integer greater than 1.

[0033] Furthermore, each member of the distributed authentication group comprehensively evaluates the trust of the resource requester based on the historical cross-domain access behavior logs of the resource requester stored in the cloud public database and the historical local domain access behavior logs of the resource requester stored in their respective behavior log recording modules. The specific process includes:

[0034] Initialize all nodes and assign initial values ​​to the trust values ​​of all nodes for resource requesters;

[0035] According to the resource access process and resource access results, multiple positive behavior elements and multiple negative behavior elements are set; the positive behavior elements are used to represent various successful access states of resources, including successful resource request, successful authorization of resources, successful resource access, and successful completion of access; the negative behavior elements are used to represent various failed access states of resources, including resource request failure, resource access failure, attempt to access unauthorized resources, requested resources not found, and exceeding the request range;

[0036] Each member of each distributed authentication group sets a weight for each resource based on the access rights corresponding to the resources stored locally; resources with higher access rights have higher corresponding weights;

[0037] Parse the historical local domain access behavior logs of the resource requester stored in the behavior log recording module to obtain the positive behavior vector X1 and negative behavior vector Y1 corresponding to each local domain access behavior; combine the weight of the resource corresponding to each local domain access behavior, the positive behavior vector X1 and the negative behavior vector Y1 to calculate the local domain trust score Score1 of the resource requester;

[0038] Parse the historical cross-domain access behavior logs of resource requesters stored in the cloud public database to obtain the positive behavior vector x2 and negative behavior vector Y2 corresponding to each cross-domain access behavior; combine the positive behavior vector X2 and the negative behavior vector Y2 to calculate the cross-domain trust score Score2 of the resource requester;

[0039] The trust score of the resource requester is generated by combining the local trust score Score1 and the cross-domain trust score Score2.

[0040] Furthermore, the cross-domain zero-trust authentication system includes a key management center deployed in the cloud, which is used to generate a public key and a private key pair for threshold signature based on the elliptic curve cryptography system;

[0041] The key management center includes a security parameter setting module, a public key publishing module and a private key publishing module;

[0042] The security parameter setting module is used to set security parameters in each key update cycle; the setting process includes the following steps: selecting a prime number q∈Z q , choose an elliptic curve y over a finite field GF(q) 2 =x 3 +x+1; select a random integer r as the signature private key and calculate the signature public key K pub =rG=(x, y), G is the base point on the elliptic curve, select the public parameter a and publish it; x, y are the independent variable and the dependent variable respectively;

[0043] The public key publishing module is used to publicly publish the signature public key in the policy centers of all trust domains;

[0044] The private key publishing module is used to generate a signature subkey and send it to the corresponding trust domain policy center; specifically, let the authentication threshold be t, and select the t-1 order polynomial on the finite field: f(x) = r + a1x + a2x 2 +…+a t-1 x t-1 mod q, calculate <x i , r i =f(x i )>, 1<i<n, send this data as the signature subkey to the corresponding trust domain policy center, denoted as i; n is the number of trust domains; t is the member threshold of the distributed authentication group; a1, a2, ..., a t-1 are polynomial coefficients, x i is the identifier of the i-th trust domain, r i is the subkey of the ith trust domain, f(x i ) is x i The result of the function f() on the independent variable.

[0045] Furthermore, each member of the distributed authentication group will sign information <a i , m i ,s i >, 0≤i≤t-1 is sent to the policy center of the trust domain where the requester is located; where s i =H2(m i )+ax,m i To confirm the encoding of the ticket, H2() is a one-way hash function;

[0046] The policy center of the trust domain where the requester is located aggregates t signature subkeys and uses the Lagrange interpolation polynomial to obtain the shared signature key: If the information of all members satisfies the equation Then generate the authentication pass instruction; where, r j is the subkey of the jth trust domain.

[0047] The present invention also mentions a cross-domain zero-trust authentication method for a cloud-edge-end integrated power information communication system, wherein the cross-domain zero-trust authentication method processes resource requests of registered members based on the cross-domain zero-trust authentication system as described above;

[0048] The cross-domain zero-trust authentication method comprises the following steps:

[0049] S1, the registered user submits a resource access request to the proxy gateway of the trust domain where the request is located. The proxy gateway intercepts the resource access request, returns the digital identity of the registered user, generates an access request event and submits it to the policy center of the trust domain to which it belongs;

[0050] S2, the policy center where the requester is located determines the domain to which the resource corresponding to the access request event belongs. If it belongs to the domain where the requester is located, it proceeds to step S3; otherwise, it proceeds to step S4;

[0051] S3, match the digital identity D1 of the requester with the access policy library of this domain, obtain the resource permission X corresponding to the digital identity D1 of the requester; match the resource permission X with the target resource, obtain the open parameter F of the target resource; notify the local proxy gateway to open the access right of the target resource with the open parameter F to the requester, and start the timer T; close the access right when the timer ends, and record the access log of the requester to the behavior log recording module; end the process;

[0052] S4, the proxy gateway of the domain where the requester is located queries the resource navigation server deployed in the cloud whether there is a cross-domain route between the domain where the requester is located and the domain where the resource is located. If it can be found, an authentication request detection message is initiated to the policy center of the domain where the target resource is located. If an authentication request detection response is received from the policy center of the domain where the target resource is located, it indicates that the policy center of the domain where the target resource is located has been triggered to enter the authentication process, and the process goes to step S5; otherwise, it returns: the target resource cannot be accessed, and the process ends;

[0053] S5: The policy center of the domain where the target resource is located performs threshold signature authentication on the access request event, which specifically includes the following sub-steps:

[0054] S51, extract the digital identity of the requester and the target resource information from the access request event, query the cross-domain access policy library, and verify whether the target resource has the cross-domain access attribute. If it does not have the cross-domain access attribute, return to the requester: access denied, and end the process; otherwise, obtain the cross-domain access attribute parameter F' of the target resource;

[0055] S52, accessing the cloud resource navigation server to obtain a distributed authentication group composed of policy centers of multiple trust domains associated with the requester; the distributed authentication group does not include the trust domain where the requester is located and the trust domain where the resource is located;

[0056] S53, issuing the authentication task to the members of the distributed authentication group. All members of the distributed authentication group parse the authentication task and make a comprehensive evaluation of the trust of the resource requester based on the historical behavior log of the resource requester stored in the cloud public database and the access behavior log of the resource requester stored in their respective behavior log recording modules. If the requester is considered to be trustworthy, the scoring data is encrypted based on the threshold signature algorithm of the elliptic curve encryption mechanism and submitted to the policy center of the trust domain where the resource is located. Otherwise, the information that the evaluation cannot be made is returned.

[0057] S54, the policy center of the trust domain where the resource is located obtains the score values ​​submitted by all members of the distributed authentication group and performs trust authentication on the resource request; if the authentication is successful, for the authenticated resource request, the proxy gateway is notified to open the corresponding access port, and the access rights to the resources corresponding to its authority are opened to the requester for a limited time; otherwise, it returns: authentication failed.

[0058] The beneficial effects of the present invention are:

[0059] First, the cross-domain zero-trust authentication system and method of the cloud-edge-end integrated power information and communication system of the present invention adopts a cloud-edge-end integrated architecture to achieve zero trust, which can give full play to the advantages of cloud data sharing, rich edge-side computing resources, and convenient terminal-side access. It has good adaptability to existing power information and communication systems, can be easily deployed in various power application scenarios, and has good compatibility.

[0060] Second, the cross-domain zero-trust authentication system and method of the cloud-edge-end integrated power information communication system of the present invention can conveniently expand the trust domain based on cloud computing, and can cover cross-domain access of heterogeneous trust domains. It has the characteristics of easy deployment, convenient management, and easy operation and maintenance.

[0061] Third, the cross-domain zero-trust authentication system and method of the cloud-edge-end integrated power information communication system of the present invention adopts a threshold signature system based on elliptic curves to encrypt the information transmitted by each trust domain, which can achieve stronger security under a shorter key length, facilitate lightweight deployment, and save storage and communication overhead. In addition, the present invention is based on distributed authentication in the zero-trust framework. In the specific implementation process, the encryption algorithm therein can be easily replaced with a more advanced public key encryption system, which has certain deployment flexibility.

[0062] Fourth, the cross-domain zero-trust authentication system and method of the cloud-edge-end integrated power information communication system of the present invention, the distributed authentication group performs authentication evaluation based on the user's historical access logs to the same or similar resources, the evaluation process does not rely on real-time management of registered users, the evaluation results are highly targeted, the authentication results are highly accurate, and the user experience is good. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a structural diagram of the cross-domain zero-trust authentication system of the cloud-edge-end integrated power information communication system of the present invention.

[0064] Figure 2 It is a flow chart of cross-domain authentication request and verification interaction of the present invention. DETAILED DESCRIPTION

[0065] The present invention will now be described in further detail with reference to the accompanying drawings.

[0066] It should be noted that the terms such as "upper", "lower", "left", "right", "front", "back", etc. used in the invention are only for the convenience of description and are not used to limit the scope of the invention. The change or adjustment of the relative relationship shall also be regarded as the scope of the invention without substantially changing the technical content.

[0067] Embodiment 1

[0068] See also Figure 1 , this embodiment proposes a cross-domain zero-trust authentication system for a cloud-edge-end integrated power information communication system, and the cross-domain zero-trust authentication system is applied to a cloud-edge-end integrated power information communication system.

[0069] The cross-domain zero-trust authentication system includes a cloud resource navigation server and several trust domains isolated from each other; each of the trust domains has several registered users and stores resource data to be accessed; the cloud resource navigation server is used to manage trust domain routing information and trust domain information associated with each registered user.

[0070] Each of the trust domains includes a policy center and a proxy gateway; a physical resource access channel is built between the proxy gateways of the trust domains with resource access services; a zero-trust authentication channel is built between the policy centers of the trust domains participating in distributed authentication; and the policy center runs on the edge side.

[0071] The proxy gateway intercepts the resource access request received from the requester, returns the digital identity of the requester, generates an access request event and submits it to the policy center of the trust domain to which it belongs.

[0072] The policy center is deployed with a domain judgment module, a local domain authentication module, a cross-domain authentication module and a behavior log recording module; the behavior log recording module is used to store the access behavior logs of all users in the domain where the policy center is located; the domain judgment module is used to judge the domain to which the resource corresponding to the access request event belongs. If it belongs to the domain where the user is located, the access request event is transferred to the local domain authentication module; otherwise, the access request event is transferred to the cross-domain authentication module, triggering the cross-domain authentication module of the domain where the target resource is located to enter the authentication process; the local domain authentication module combines the digital identity of the requester and the matching result of the access policy library, and notifies the local proxy gateway to open the access rights of the resources corresponding to its authority to the user for a limited time; the cross-domain authentication module of the domain where the target resource is located accesses the cloud resource navigation server to obtain the policy centers of multiple trust domains associated with the requester to form a distributed authentication group, and the distributed authentication group does not include the trust domain where the requester is located and the trust domain where the resource is located.

[0073] Each member of the distributed authentication group conducts a comprehensive evaluation of the trust of the resource requester based on the historical behavior log of the resource requester stored in the cloud public database and the access behavior log of the resource requester stored in their respective behavior log recording modules. If the requester is considered trustworthy, the scoring data is encrypted based on the threshold signature algorithm of the elliptic curve encryption mechanism and submitted to the policy center of the trust domain where the resource is located, otherwise, the information that the evaluation cannot be performed is returned; the policy center of the trust domain where the resource is located performs trust authentication on the resource request based on the submission results of all members of the distributed authentication group, and for resource requests that pass the authentication, the proxy gateway is notified to open the corresponding access port, and the access rights to the resources corresponding to its authority are opened to the requester for a limited time.

[0074] Depend on Figure 1 It can be seen that the policy center implements authentication and authorization of user access through the zero-trust authentication channel, and the proxy gateway is responsible for opening corresponding resources according to user permissions and implementing resource access through the resource access channel. This embodiment involves two data channels: a resource access channel and a zero-trust authentication channel; preferably, 5G slicing or IP tunneling technology can be used to switch the resource access channel and the zero-trust authentication channel.

[0075] (1) User Registration Module

[0076] The policy center includes a user registration module; the user registration module receives a unique identifier Id and a validity period T1 sent by a user, and generates a digital identity DID of the user with a preset validity period T1, where DID=

[0077] After the validity period is reached, the user registration module updates the user's digital identity regularly or according to the update request sent by the user. The update is calculated based on the running time. After the T2 period, the updated digital identity is DID=

[0078] The user registers in this trust domain. After successful registration, he submits an access request to the local proxy gateway. The local proxy gateway intercepts the request information, returns the digital identity of the requesting user, and submits the access request event to the policy center. The policy center determines whether the requested resource is in this domain based on the identifier of the requested resource. If it is a local domain access, the local domain authentication module will directly authorize it through the local policy. For authorized access requests, the local proxy gateway will be notified to open resources according to the local security policy. If accessing cross-domain resources, it will be handed over to the cross-domain authentication module to make a resource request to the policy center of the trust domain where the resource is located through the zero-trust authentication channel.

[0079] (2) Local domain authentication module

[0080] The local domain authentication module includes a resource management unit, a registered user management unit, a local domain access policy library, a user authority authentication unit and a local domain resource access management unit.

[0081] ​​The resource management unit is used to manage the resource library of the trust domain to which it belongs, and each resource is provided with a corresponding local domain access right. The registered user management unit is used to manage the registered users of the trust domain to which it belongs, and each registered user has an independent digital identity. The local domain access policy library is used to store the local domain resource rights corresponding to each access right of the registered user. The user authority authentication unit extracts the digital identity D1 of the requester contained in the access request event, matches the extracted digital identity D1 of the requester with the storage information of the local domain access policy library, obtains the local domain resource right X of the requester; then matches the local domain resource right X with the accessed object to obtain the open parameter F of the accessed object. The local domain resource access management unit is used to notify the local proxy gateway according to the open parameter F of the accessed object sent by the user authority authentication unit and the requester information, open the access right with the open parameter F on the accessed object to the requester, and start the timer T, and notify the local proxy gateway again to close the access right when the timer ends, and record the access log of the requester to the behavior log recording module.

[0082] (3) Cross-domain authentication module

[0083] The cross-domain authentication module includes a routing query unit, an authentication request detection unit, a cross-domain access policy library, an authentication management unit, a distributed authentication group generation unit, a scoring unit, a scoring authentication unit and a cross-domain resource access management unit.

[0084] The routing query unit is used to extract the information domain information of the resources contained in the access request event, and query the cloud resource navigation server whether there is a corresponding cross-domain route. If so, the authentication request detection unit is triggered to initiate the authentication request detection information to the policy center of the domain where the target resource is located. Otherwise, the cross-domain resource access management unit returns the information that the requester cannot access the information; if the authentication request detection unit receives the authentication request detection response sent by the authentication request detection unit of the domain where the requester is located, it indicates that the authentication management unit of the domain where the target resource is located has been triggered and the authentication process has begun.

[0085] The cross-domain access policy library is used to store the cross-domain access attributes and cross-domain access permissions of resources in the domain, as well as the cross-domain resource permissions corresponding to each access permission of a registered user.

[0086] After the authentication management unit of the domain where the target resource is located is triggered, the digital identity of the requester and the target resource requested by the requester are extracted from the access request event, and the cross-domain access policy library is retrieved to verify whether the target resource has the cross-domain access attribute. If it has the cross-domain access attribute, the cross-domain resource authority X' of the requester is obtained, and then the cross-domain resource authority X' of the requester is matched with the cross-domain access authority of the target resource to obtain the open parameter F' of the target resource; at the same time, the digital identity of the requester and the attribute information of the target resource are sent to the distributed authentication group generation unit, and the distributed authentication group generation unit forms a distributed authentication group, so that the scoring unit of each member of the distributed authentication group retrieves the historical behavior log of the resource requester stored in the cloud public database and the access behavior log of the resource requester stored in each behavior log recording module according to the digital identity of the requester and the attribute information of the target resource, and comprehensively evaluates the trust of the resource requester. If the requester is considered to be trustworthy, the scoring data is encrypted based on the threshold signature algorithm of the elliptic curve encryption mechanism and submitted to the policy center of the trust domain where the resource is located, otherwise, the information that it cannot be evaluated is returned. After receiving the submission results of all members of the distributed authentication group, if the total number of scoring data reaches t, the scoring authentication unit is triggered, so that the scoring authentication unit performs trust authentication on the resource request according to the submission results of all members of the distributed authentication group, otherwise, the authentication failure information is returned to the requester. The authentication management unit sends the authentication result to the cross-domain resource access management unit. For the resource request that passes the authentication, the cross-domain resource access management unit notifies the proxy gateway to open the corresponding access port, opens the access rights of the resources corresponding to its authority to the requester for a limited time, opens the access rights of the accessed object with the parameter F' to the requester, and starts the timer T'. When the timer ends, it notifies the local proxy gateway to close the access rights again, and records the access log of the requester to the behavior log recording module.

[0087] Exemplarily, the distributed authentication group generation unit includes a related domain acquisition component, a target resource resolution component and a member screening component.

[0088] The related domain acquisition component is used to access the cloud resource navigation server, and obtains the policy centers of t trust domains associated with the requester according to the digital identity of the requester to form an access routing set R{}; the target resource parsing component parses the attribute information of the target resource, extracts relevant features, and obtains the corresponding attribute vector; the member screening component cyclically accesses the elements in R{}, and obtains the trust domain policy center set S{} allowed to participate in distributed authentication according to the attribute information of the target resource, until the number of members in the trust domain policy center set S{} reaches a threshold value t, forming a distributed authentication group; wherein, as the number of cycles increases, the difference between the attribute vector of the historical resource in the access log record of the selected member and the attribute vector of the target resource becomes larger; t is a positive integer greater than 1.

[0089] Whether the resource requester can successfully access across domains actually depends on the evaluation of the authentication group members. If all authentication group members use the same evaluation criteria to judge based on the resource requester's historical access behavior logs, the significance of forming an authentication group will be greatly reduced, and the security of resource access will be reduced. If all authentication groups judge the resource requester's historical access behavior logs according to their own evaluation criteria, the access threshold of the resource requester will become higher, which can certainly increase security, but the success rate of cross-domain access will also be reduced. Therefore, this embodiment combines the unique access method of the cross-domain zero-trust authentication system of the electric power information communication system to set up a comprehensive evaluation method to maximize the resource access success rate of the requester while ensuring resource security. Specifically, each member of the distributed authentication group conducts a comprehensive evaluation of the trust of the resource requester based on the resource requester's historical cross-domain access behavior logs stored in the cloud public database and the resource requester's historical local domain access behavior logs stored in their respective behavior log recording modules. The specific process includes:

[0090] Initialize all nodes and assign initial values ​​to the trust values ​​of all nodes for resource requesters; set multiple positive behavior elements and multiple negative behavior elements according to the resource access process and resource access results; positive behavior elements are used to represent various successful access states of resources, including successful resource request, successful authorization of resources, successful access to resources, and successful completion of access; negative behavior elements are used to represent various failed access states of resources, including failed resource request, failed resource access, attempt to access unauthorized resources, requested resources not found, and exceeding the request range; each member in each distributed authentication group sets a weight for each resource according to the access rights corresponding to the resources stored locally; the higher the access rights, the higher the corresponding weight; the resources stored in the behavior log recording module are The source requester's historical local domain access behavior log is parsed to obtain the positive behavior vector X1 and negative behavior vector Y1 corresponding to each local domain access behavior; the resource requester's local domain trust score Score1 is calculated by combining the weight of the resource corresponding to each local domain access behavior, the positive behavior vector X1 and the negative behavior vector Y1; the resource requester's historical cross-domain access behavior log stored in the cloud public database is parsed to obtain the positive behavior vector X2 and the negative behavior vector Y2 corresponding to each cross-domain access behavior; the resource requester's cross-domain trust score Score2 is calculated by combining the positive behavior vector X2 and the negative behavior vector Y2; the local domain trust score Score1 and the cross-domain trust score Score2 are combined to generate the resource requester's trust score. Exemplarily, the resource requester's trust score can be the weighted addition of the local domain trust score Score1 and the cross-domain trust score Score2, or the smaller value can be selected.

[0091] The elements of the positive behavior vector X1 and the positive behavior vector X2 may be the same or different, and exemplarily include the following elements: (1) successful resource request x1; (2) successful authorization resource x2; (3) successful access to resource x3; (4) successful access x4. Similarly, the elements of the negative behavior vector Y1 and the negative behavior vector Y2 may be the same or different, and exemplarily include the following elements: (1) resource request failure y1; (2) resource access failure y2; (3) attempt to access unauthorized resources y3; (4) requested resource not found y4; (5) out of request range y5.

[0092] According to the parsing results of the resource requester's access behavior log, the positive behavior elements and negative behavior elements corresponding to each access behavior of the resource requester can be obtained. By combining the positive behavior elements and negative behavior elements of all access behavior logs, the positive behavior vector and negative behavior vector of the resource requester can be obtained. For example, a resource requester successfully requested a resource in a certain access behavior, but failed to successfully obtain the authorized resource because it exceeded the request scope. The corresponding positive behavior elements are x1 and x3, and the negative behavior element is y5. For a certain authentication group member, if the resource requester requests access to the resources of this domain, considering the resource access rights, the obtained positive behavior elements x1 and x3, and the negative behavior element y5 are multiplied by the weight of the corresponding resource to correct the element value, and then the local trust score of the resource requester in this access behavior is obtained by analysis; correspondingly, this access is a cross-domain access for other authentication group members, and there is no need to multiply the resource weight, and the cross-domain trust score of the resource requester in this access behavior is directly analyzed. This method does not require different trust domains to share their own resource access rights in the log, ensuring the independence of each trust domain. At the same time, the evaluation results of the domain access behavior are corrected using resource access rights, improving the access success rate of honest resource visitors, avoiding resource access failures due to failed access records of some low-authority resources, or avoiding some resource requesters with high success rates of low-authority resource access from arbitrarily accessing high-authority resources, reducing resource security. Since the authentication group members are randomly selected, the trust score results are also random, which in a certain way increases the security of resource access.

[0093] Exemplarily, the resource permission types in the zero-trust management of the electric power information communication system are shown in Table 1.

[0094] Table 1

[0095]

[0096]

[0097] (4) Authentication process

[0098] The cross-domain zero-trust authentication system includes a key management center deployed in the cloud, which is responsible for generating public and private key pairs for threshold signatures based on the elliptic curve encryption system.

[0099] The key management center includes a security parameter setting module, a public key publishing module and a private key publishing module; the security parameter setting module is used to set security parameters in each key update cycle; the setting process includes the following steps: selecting a prime number q∈Z q , select an elliptic curve E(a, b) over a finite field GF(q): y 2 =x 3+ax+b,a∈Z q , b∈Z q , G is the base point on the elliptic curve; select a random integer r as the signature private key and calculate the signature public key K pub = rG = (x, y), select a public parameter a and publish it; the public key publishing module is used to publicly publish the signature public key in the policy center of all trust domains; the private key publishing module is used to generate a signature subkey and send it to the corresponding trust domain policy center; specifically, let the authentication threshold be t, select the t-1 order polynomial on the finite field: f(x) = r + a1x + a2x 2 +…+a t-1 x t-1 mod q, calculate <x i , r i =f(x i )>, 1<i<n, send this data as the signature subkey to the corresponding trust domain policy center; t is the member threshold value of the distributed authentication group.

[0100] The trust domain policy center participating in the distributed authentication evaluates the trust of the resource requester based on the historical behavior log of the resource requester stored in the cloud public database and the access behavior log stored in the domain policy center. If the requester is considered trustworthy, the threshold signature is submitted as confirmation information. Otherwise, no action is taken. Specifically, each member of the distributed authentication group sends the signature information < a i , m i ,s i >Sent to the policy center of the trust domain where the requester is located; where s i =H2(m i )+ax,m i To confirm the encoding of the ticket, H2() is a one-way hash function.

[0101] The policy center of the authentication request trust domain collects the signature information sent by the authentication group policy center. If more than the threshold value of t trust domain policy centers have sent signature information, the authentication request trust domain policy center can recover the group signature private key and obtain the confirmation information. Specifically, the policy center of the trust domain where the requester is located aggregates t signature subkeys and uses the Lagrange interpolation polynomial to obtain the shared signature key: If the information of all members satisfies the equation Then generate the authentication pass instruction; where,

[0102] Embodiment 2

[0103] See also Figure 2, the present invention also mentions a cross-domain zero-trust authentication method for a cloud-edge-end integrated power information communication system, wherein the cross-domain zero-trust authentication method is based on the cross-domain zero-trust authentication system as described above, and processes the resource request of the registered member;

[0104] The cross-domain zero-trust authentication method comprises the following steps:

[0105] S1, the registered user submits a resource access request to the proxy gateway of the trust domain where the request is located. The proxy gateway intercepts the resource access request, returns the digital identity of the registered user, generates an access request event and submits it to the policy center of the trust domain to which it belongs;

[0106] S2, the policy center where the requester is located determines the domain to which the resource corresponding to the access request event belongs. If it belongs to the domain where the requester is located, the process proceeds to step S3; otherwise, the process proceeds to step S4.

[0107] S3, matches the digital identity D1 of the requester with the access policy library of this domain, and obtains the resource permission X corresponding to the digital identity D1 of the requester; matches the resource permission X with the target resource, and obtains the open parameter F of the target resource; notifies the local proxy gateway to open the access right of the target resource with the open parameter F to the requester, and starts the timer T; closes the access right when the timer ends, and records the access log of the requester to the behavior log recording module; ends the process.

[0108] S4, the proxy gateway of the domain where the requester is located queries the resource navigation server deployed in the cloud to see whether there is a cross-domain route between the domain where the requester is located and the domain where the resource is located. If it can be found, an authentication request probe message is initiated to the policy center of the domain where the target resource is located. If an authentication request probe response is received from the policy center of the domain where the target resource is located, it indicates that the policy center of the domain where the target resource is located has been triggered to enter the authentication process, and the process goes to step S5; otherwise, it returns: the target resource cannot be accessed, and the process ends.

[0109] S5: The policy center of the domain where the target resource is located performs threshold signature authentication on the access request event, which specifically includes the following sub-steps:

[0110] S51, extract the digital identity of the requester and the target resource information from the access request event, query the cross-domain access policy library, and verify whether the target resource has the cross-domain access attribute. If it does not have the cross-domain access attribute, return to the requester: access denied, and end the process; otherwise, obtain the cross-domain access attribute parameter F' of the target resource.

[0111] S52, accessing a cloud resource navigation server to obtain a distributed authentication group composed of policy centers of multiple trust domains associated with the requester; the distributed authentication group does not include the trust domain where the requester is located and the trust domain where the resource is located.

[0112] S53, publish the authentication task to the members of the distributed authentication group, all members of the distributed authentication group parse the authentication task, and make a comprehensive evaluation of the trust of the resource requester based on the historical behavior log of the resource requester stored in the cloud public database and the access behavior log of the resource requester stored in their respective behavior log recording modules. If the requester is considered trustworthy, the scoring data is encrypted based on the threshold signature algorithm of the elliptic curve encryption mechanism and submitted to the policy center of the trust domain where the resource is located, otherwise the information that it cannot be evaluated is returned.

[0113] S54, the policy center of the trust domain where the resource is located obtains the score values ​​submitted by all members of the distributed authentication group and performs trust authentication on the resource request; if the authentication is successful, for the authenticated resource request, the proxy gateway is notified to open the corresponding access port, and the access rights to the resources corresponding to its authority are opened to the requester for a limited time; otherwise, it returns: authentication failed.

[0114] The above are only preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should be regarded as the protection scope of the present invention.

Claims

1. A cross-domain zero-trust authentication system for a cloud-edge-end integrated power information communication system, characterized in that: The cross-domain zero-trust authentication system is applied to the cloud-edge-end integrated power information communication system; The cross-domain zero-trust authentication system includes a cloud resource navigation server and a plurality of mutually isolated trust domains; each of the trust domains has a plurality of registered users, and stores resource data related to power information to be accessed; the cloud resource navigation server is used to manage trust domain routing information and trust domain information associated with each registered user; Each of the trust domains includes a policy center and a proxy gateway; a physical resource access channel is constructed between the proxy gateways of the trust domains with resource access services; a zero-trust authentication channel is constructed between the policy centers of the trust domains participating in distributed authentication; The policy center runs on the edge side; The proxy gateway intercepts the resource access request received from the requester, returns the digital identity of the requester, generates an access request event and submits it to the policy center of the trust domain to which it belongs; The policy center is deployed with a domain judgment module, a local domain authentication module, a cross-domain authentication module and a behavior log recording module; the behavior log recording module is used to store the access behavior logs of all users who access the domain where the policy center is located; the domain judgment module is used to judge the domain to which the resource corresponding to the access request event belongs. If it belongs to the domain where the user is located, the access request event is transferred to the local domain authentication module; otherwise, the access request event is transferred to the cross-domain authentication module, triggering the cross-domain authentication module of the domain where the target resource is located to enter the authentication process; The local domain authentication module combines the digital identity of the requester with the matching result of the access policy library, and notifies the local proxy gateway to open the access rights of the resources corresponding to its authority to the user for a limited time; the cross-domain authentication module of the domain where the target resource is located accesses the cloud resource navigation server to obtain the policy centers of multiple trust domains associated with the requester to form a distributed authentication group, and the distributed authentication group does not include the trust domain where the requester is located and the trust domain where the resource is located; Each member of the distributed authentication group conducts a comprehensive evaluation of the trust of the resource requester based on the historical cross-domain access behavior logs of the resource requester stored in the cloud public database and the historical local domain access behavior logs of the resource requester stored in their respective behavior log recording modules. If the requester is considered trustworthy, the scoring data is encrypted based on the threshold signature algorithm of the elliptic curve encryption mechanism and submitted to the policy center of the trust domain where the resource is located, otherwise, the information that the evaluation cannot be performed is returned; the policy center of the trust domain where the resource is located performs trust authentication on the resource request based on the submission results of all members in the distributed authentication group, and for resource requests that pass the authentication, the proxy gateway is notified to open the corresponding access port, and the access rights to the resources corresponding to its authority are opened to the requester for a limited time.

2. According to claim 1, the cross-domain zero-trust authentication system for the power information communication system with cloud-edge-end integration is characterized in that: Use 5G slicing or IP tunnel technology to switch resource access channels and zero-trust authentication channels.

3. According to claim 1, the cross-domain zero-trust authentication system for the power information communication system with cloud-edge-end integration is characterized in that: The policy center includes a user registration module; The user registration module receives the unique identifier Id and validity period T1 sent by the user, and generates a digital identity DID of the user with a preset validity period T1 = <H1(Id||T1), P); wherein P is the access permission; H1() is a one-way hash function; After the validity period is reached, the user registration module updates the user's digital identity regularly or according to the update request sent by the user. The update is calculated based on the running time. After the T2 time period, the updated digital identity is DID=<H1(Id||(T1+T2)), P).

4. According to claim 1, the cross-domain zero-trust authentication system for the power information communication system with cloud-edge-end integration is characterized in that: The local domain authentication module includes a resource management unit, a registered user management unit, a local domain access policy library, a user authority authentication unit and a local domain resource access management unit; The resource management unit is used to manage the resource library of the trust domain, and each resource is set with a corresponding local domain access right; the registered user management unit is used to manage the registered users of the trust domain, and each registered user has an independent digital identity; the local domain access policy library is used to store the local domain resource rights corresponding to each access right of the registered user; The user authority authentication unit extracts the digital identity D1 of the requester contained in the access request event, matches the extracted digital identity D1 of the requester with the storage information of the local domain access policy library, and obtains the local domain resource authority X of the requester; then matches the local domain resource authority X with the accessed object, and obtains the open parameter F of the accessed object; The domain resource access management unit is used to notify the local proxy gateway based on the open parameter F of the accessed object and the requester information sent by the user authority authentication unit, open the access permission with the open parameter F on the accessed object to the requester, and start the timer T. When the time ends, notify the local proxy gateway again to close the access permission, and record the access log of the requester to the behavior log recording module.

5. According to claim 1, the cross-domain zero-trust authentication system for the power information communication system with cloud-edge-end integration is characterized in that: The cross-domain authentication module includes a routing query unit, an authentication request detection unit, a cross-domain access policy library, an authentication management unit, a distributed authentication group generation unit, a scoring unit, a scoring authentication unit and a cross-domain resource access management unit; The routing query unit is used to extract the information domain information of the resources contained in the access request event, and query the cloud resource navigation server whether there is a corresponding cross-domain route. If so, the authentication request detection unit is triggered, so that the authentication request detection unit initiates authentication request detection information to the policy center of the domain where the target resource is located. Otherwise, the cross-domain resource access management unit returns the information that the requester cannot access the information; if the authentication request detection unit receives the authentication request detection response sent by the authentication request detection unit of the domain where the requester is located, it indicates that the authentication management unit of the domain where the target resource is located has been triggered, and the authentication process has begun; The cross-domain access policy library is used to store cross-domain access attributes and cross-domain access permissions of resources in the domain, as well as cross-domain resource permissions corresponding to each access permission of a registered user; After the authentication management unit of the domain where the target resource is located is triggered, the digital identity of the requester and the target resource requested by the requester are extracted from the access request event, and the cross-domain access policy library is retrieved to verify whether the target resource has the cross-domain access attribute. If it has the cross-domain access attribute, the cross-domain resource permission X' of the requester is obtained, and then the cross-domain resource permission X' of the requester is matched with the cross-domain access permission of the target resource to obtain the open parameter F' of the target resource; at the same time, the digital identity of the requester and the attribute information of the target resource are sent to the distributed authentication group generation unit, and the distributed authentication group generation unit forms a distributed authentication group, so that the scoring unit of each member of the distributed authentication group retrieves the historical behavior log of the resource requester stored in the cloud public database and the access behavior log of the resource requester stored in each behavior log recording module according to the digital identity of the requester and the attribute information of the target resource, and comprehensively evaluates the trust of the resource requester. If the requester is considered to be trustworthy, the scoring data is encrypted based on the threshold signature algorithm of the elliptic curve encryption mechanism and submitted to the policy center of the trust domain where the resource is located, otherwise, the information that the evaluation cannot be performed is returned; After receiving the submission results of all members of the distributed authentication group, the authentication management unit triggers the scoring authentication unit if the total amount of scoring data reaches t, so that the scoring authentication unit performs trust authentication on the resource request according to the submission results of all members of the distributed authentication group, otherwise, returns authentication failure information to the requester; The authentication management unit sends the authentication result to the cross-domain resource access management unit; The cross-domain resource access management unit notifies the proxy gateway to open the corresponding access port for the resource request that has passed the authentication, opens the access rights of the resources corresponding to its authority to the requester for a limited time, opens the access rights with the open parameter F' on the accessed object to the requester, and starts the timer T'. When the time ends, it notifies the local proxy gateway again to close the access rights, and records the access log of the requester in the behavior log recording module.

6. The cross-domain zero-trust authentication system for the cloud-edge-end integrated power information communication system according to claim 5 is characterized in that: The distributed authentication group generation unit includes a related domain acquisition component, a target resource parsing component and a member screening component; The related domain acquisition component is used to access the cloud resource navigation server, and obtain the policy centers of t trust domains associated with the requester according to the digital identity of the requester to form an access routing set R{}; The target resource parsing component parses the attribute information of the target resource, extracts relevant features, and obtains a corresponding attribute vector; The member screening component cyclically accesses the elements in R{}, and obtains the trust domain policy center set S{} that are allowed to participate in the distributed authentication according to the attribute information of the target resource, until the number of members in the trust domain policy center set S{} reaches the threshold value t, forming a distributed authentication group; wherein, as the number of cycles increases, the difference between the attribute vector of the historical resource in the access log record of the selected member and the attribute vector of the target resource becomes larger; t is a positive integer greater than 1.

7. The cross-domain zero-trust authentication system for the cloud-edge-end integrated power information communication system according to claim 1 is characterized in that: Each member of the distributed authentication group conducts a comprehensive evaluation of the trust of the resource requester based on the historical cross-domain access behavior logs of the resource requester stored in the cloud public database and the historical local domain access behavior logs of the resource requester stored in their respective behavior log recording modules. The specific process includes: Initialize all nodes and assign initial values ​​to the trust values ​​of all nodes for resource requesters; According to the resource access process and resource access results, multiple positive behavior elements and multiple negative behavior elements are set; the positive behavior elements are used to represent various successful access states of resources, including successful resource request, successful authorization of resources, successful resource access, and successful completion of access; the negative behavior elements are used to represent various failed access states of resources, including resource request failure, resource access failure, attempt to access unauthorized resources, requested resources not found, and exceeding the request range; Each member of each distributed authentication group sets a weight for each resource based on the access rights corresponding to the resources stored locally; resources with higher access rights have higher corresponding weights; Parse the historical local domain access behavior logs of the resource requester stored in the behavior log recording module to obtain the positive behavior vector X1 and negative behavior vector Y1 corresponding to each local domain access behavior; combine the weight of the resource corresponding to each local domain access behavior, the positive behavior vector X1 and the negative behavior vector Y1 to calculate the local domain trust score Score1 of the resource requester; Parse the historical cross-domain access behavior logs of resource requesters stored in the cloud public database to obtain the positive behavior vector X2 and negative behavior vector Y2 corresponding to each cross-domain access behavior; combine the positive behavior vector X2 and the negative behavior vector Y2 to calculate the cross-domain trust score Score2 of the resource requester; The trust score of the resource requester is generated by combining the local trust score Score1 and the cross-domain trust score Score2.

8. The cross-domain zero-trust authentication system for the cloud-edge-end integrated power information communication system according to claim 1 is characterized in that: The cross-domain zero-trust authentication system includes a key management center deployed in the cloud, which is used to generate a public key and a private key pair for threshold signature based on an elliptic curve cryptography system; The key management center includes a security parameter setting module, a public key publishing module and a private key publishing module; The security parameter setting module is used to set security parameters in each key update cycle; the setting process includes the following steps: selecting a prime number q∈Z q , choose an elliptic curve y over a finite field GF(q) 2 =x 3 +x+1; select a random integer r as the signature private key and calculate the signature public key K pub =rG=(x, y), G is the base point on the elliptic curve, select the public parameter a and publish it; x, y are the independent variable and the dependent variable respectively; The public key publishing module is used to publicly publish the signature public key in the policy centers of all trust domains; The private key publishing module is used to generate a signature subkey and send it to the corresponding trust domain policy center; specifically, let the authentication threshold be t, and select the t-1 order polynomial on the finite field: f(x) = r + a1x + a2x 2 +…+a t-1 x t-1 modq, calculate < x i , r i =f(x i )>, 1<i<n, send this data as the signature subkey to the corresponding trust domain policy center, denoted as i; n is the number of trust domains; t is the member threshold of the distributed authentication group; a1, a2, ..., a t-1 are polynomial coefficients, x i is the identifier of the i-th trust domain, r i is the subkey of the ith trust domain, f(x i ) is x i The result of the function f() on the independent variable.

9. The cross-domain zero-trust authentication system for the cloud-edge-end integrated power information communication system according to claim 8 is characterized in that: Each member of the distributed authentication group will sign information <a i , m i ,s i >, 0≤i≤t-1 is sent to the policy center of the trust domain where the requester is located; where s i =H2(m i )+ax,m i To confirm the encoding of the ticket, H2() is a one-way hash function; The policy center of the trust domain where the requester is located aggregates t signature subkeys and uses the Lagrange interpolation polynomial to obtain the shared signature key: If the information of all members satisfies the equation Then generate the authentication pass instruction; where, r j is the subkey of the jth trust domain.

10. A cross-domain zero-trust authentication method for a cloud-edge-end integrated power information communication system, characterized in that: The cross-domain zero-trust authentication method is based on the cross-domain zero-trust authentication system as claimed in any one of claims 1 to 9, and processes the resource request of the registered member; The cross-domain zero-trust authentication method comprises the following steps: S1, the registered user submits a resource access request to the proxy gateway of the trust domain where the request is located. The proxy gateway intercepts the resource access request, returns the digital identity of the registered user, generates an access request event and submits it to the policy center of the trust domain to which it belongs; S2, the policy center where the requester is located determines the domain to which the resource corresponding to the access request event belongs. If it belongs to the domain where the requester is located, it proceeds to step S3; otherwise, it proceeds to step S4; S3, match the digital identity D1 of the requester with the access policy library of this domain, obtain the resource permission X corresponding to the digital identity D1 of the requester; match the resource permission X with the target resource, obtain the open parameter F of the target resource; notify the local proxy gateway to open the access right of the target resource with the open parameter F to the requester, and start the timer T; close the access right when the timer ends, and record the access log of the requester to the behavior log recording module; end the process; S4, the proxy gateway of the domain where the requester is located queries the resource navigation server deployed in the cloud whether there is a cross-domain route between the domain where the requester is located and the domain where the resource is located. If it can be found, an authentication request detection message is initiated to the policy center of the domain where the target resource is located. If an authentication request detection response is received from the policy center of the domain where the target resource is located, it indicates that the policy center of the domain where the target resource is located has been triggered to enter the authentication process, and the process goes to step S5; otherwise, it returns: the target resource cannot be accessed, and the process ends; S5: The policy center of the domain where the target resource is located performs threshold signature authentication on the access request event, which specifically includes the following sub-steps: S51, extract the digital identity of the requester and the target resource information from the access request event, query the cross-domain access policy library, and verify whether the target resource has the cross-domain access attribute. If it does not have the cross-domain access attribute, return to the requester: access denied, and end the process; otherwise, obtain the cross-domain access attribute parameter F' of the target resource; S52, accessing the cloud resource navigation server to obtain a distributed authentication group composed of policy centers of multiple trust domains associated with the requester; the distributed authentication group does not include the trust domain where the requester is located and the trust domain where the resource is located; S53, issuing the authentication task to the members of the distributed authentication group. All members of the distributed authentication group parse the authentication task and make a comprehensive evaluation of the trust of the resource requester based on the historical behavior log of the resource requester stored in the cloud public database and the access behavior log of the resource requester stored in their respective behavior log recording modules. If the requester is considered to be trustworthy, the scoring data is encrypted based on the threshold signature algorithm of the elliptic curve encryption mechanism and submitted to the policy center of the trust domain where the resource is located. Otherwise, the information that the evaluation cannot be made is returned. S54, the policy center of the trust domain where the resource is located obtains the score values ​​submitted by all members of the distributed authentication group and performs trust authentication on the resource request; if the authentication is successful, for the authenticated resource request, the proxy gateway is notified to open the corresponding access port, and the access rights to the resources corresponding to its authority are opened to the requester for a limited time; otherwise, it returns: authentication failed.

Images