A smart grid security access control method, system and terminal device
By analyzing communication behavior and trust values in the smart grid and dynamically adjusting the authorization level, the network attacks and unauthorized access problems faced by the smart grid are solved, and the communication process is highly secure and reliable.
Patent Information
- Application Number
- CN202411268260.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-11
- Publication Date
- 2024-12-13
- Estimated Expiration
- 2044-09-11
Smart Images
Figure CN118802373B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of smart grid security access technology, and in particular to a smart grid security access control method, system and terminal equipment. Background Art
[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.
[0003] With the development of smart grid technology, the importance of network security for substations, power stations, and distribution stations as key nodes of the power system has become increasingly prominent. Smart grids integrate advanced information technology and automation control technology to make power supply more efficient and reliable. However, since smart grid devices and systems need to communicate through the Internet, they may be exposed to the risk of cyber attacks and unauthorized access.
[0004] In traditional power grids, the monitoring and control of key equipment mainly rely on manual operation and limited automation systems, which limits their response speed and efficiency. With the widespread application of smart devices such as smart meters, remote terminal units (RTUs), and supervisory control and data acquisition systems (SCADA), the automation level and data collection capabilities of power grids have been significantly improved. But at the same time, these devices have also become potential network security vulnerabilities. Secondly, traditional security mechanisms, such as static rules and specific pattern recognition algorithms, are facing increasingly severe tests. The diversification of security threats and the evolving means of attack make traditional communication protocols and encryption technologies unsustainable, and there is a risk of being exploited by hackers, which may lead to the leakage of sensitive information and even threaten the security of critical infrastructure such as power systems. Summary of the invention
[0005] In order to solve the technical problems existing in the above-mentioned background technology, the present invention provides a smart grid security access control method, system and terminal device. The present invention continuously analyzes communication behavior and integrates continuous behavior analysis with the zero-trust security concept. It can timely discover and effectively respond to the evolution of security threats, thereby ensuring the security and reliability of the smart grid communication process.
[0006] In order to achieve the above object, the present invention adopts the following technical solution:
[0007] A first aspect of the present invention provides a smart grid security access control method.
[0008] A smart grid security access control method, applied to key equipment, comprising:
[0009] Receiving an access request sent by an access network device;
[0010] In response to the access request, according to the performance indicator data and network flow data of the key devices in the access process and all access behaviors of the access network devices, respectively calculate the trust values corresponding to the performance indicators, network flow and access behaviors of the access network devices;
[0011] Based on the comparison of the trust values corresponding to the performance indicators, network traffic and access behaviors of the access network device with their respective corresponding thresholds, the performance indicator authorization level, network traffic authorization level and access behavior authorization level are determined;
[0012] The lowest levels among the performance indicator authorization level, network traffic authorization level and access behavior authorization level are screened out respectively and used as the final authorization level for access network devices to determine the access scope.
[0013] Furthermore, after receiving the access request sent by the access network device, it also includes: evaluating the access network device request according to a preset security policy and access control list, and determining a preliminary access level to grant to the access network device so that the access network device can only access an authorized resource range.
[0014] Furthermore, the trust values corresponding to the performance indicators, network traffic and access behaviors of the access network device are respectively: access network device performance indicator trust value, access network device network traffic trust value and access network device access behavior trust value; if at least one of the access network device performance indicator trust value, the access network device network traffic trust value or the access network device access behavior trust value is lower than the respective corresponding thresholds, the access is terminated.
[0015] Furthermore, the access network device performance indicator trust value is obtained by multiplying the control trust value change rate parameter in different modes by the weighted sum of all performance indicators.
[0016] Furthermore, the network traffic trust value of the access network device is obtained by the difference between 1 and the ratio of the number of abnormalities predicted by the decision tree to the total number of all decision trees.
[0017] Furthermore, according to the performance indicator data and network flow data of the key devices in the access process, the trust values corresponding to the performance indicators and network flow of the access network devices are calculated respectively; the method includes:
[0018] Based on the key equipment performance indicator data, the machine learning-based random forest classifier algorithm is used to analyze and determine the classification results of normal behavior patterns and abnormal behavior patterns; based on the classification results, the trust value of the access network equipment performance indicator is calculated;
[0019] Based on the network traffic data of key devices, a random forest classifier model based on machine learning is used to output whether there are any abnormalities in the network traffic; based on the output results, the trust value of the network traffic of the access network device is calculated.
[0020] Furthermore, the access network device access behavior trust value is obtained by multiplying the access network device access behavior trust value at the previous moment by a correlation coefficient of whether the current access behavior is within the authorized scope.
[0021] Furthermore, the key equipment performance indicator data include: CPU utilization, memory utilization, disk utilization, network utilization and equipment connection number indicators; the key equipment network traffic data include: duration, number of data packets, data packet length, number of traffic bytes per second, number of data packets per second and average arrival time between flows; all access behaviors of the access network devices include: resource access requests and execution operations on key devices, and are recorded in the security log in a standardized format.
[0022] Furthermore, after the access network device initiates an access request to the key device, the key device divides the resources in the key device into four different levels: highest level, high level, medium level and low level based on the principle of least privilege and taking into account the importance of the access rights and data sensitivity of the access network device, and grants the highest level access rights, high level access rights, medium level access rights and low level access rights accordingly.
[0023] A second aspect of the present invention provides a smart grid security access control method.
[0024] A smart grid security access control method is applied to a smart grid security access control system, wherein the smart grid security access control system includes key equipment and at least one access network device, and the method includes:
[0025] An access request sent by an access network device to a key device;
[0026] The key device responds to the access request and calculates the trust values corresponding to the performance index, network traffic and access behavior of the access network device according to the performance index data and network traffic data of the key device during the access process and all access behaviors of the access network device;
[0027] The key device determines the performance indicator authorization level, network flow authorization level and access behavior authorization level based on the trust values corresponding to the performance indicators, network flow and access behavior of the access network device and their corresponding thresholds;
[0028] The key device respectively selects the lowest level among the performance indicator authorization level, the network traffic authorization level and the access behavior authorization level, and uses it as the final authorization level of the access network device to determine the access scope.
[0029] Furthermore, if the key device determines that at least one of the trust values corresponding to the performance indicators, network traffic, and access behavior of the access network device is lower than the corresponding threshold, the access is terminated.
[0030] A third aspect of the present invention provides a smart grid security access control system.
[0031] A smart grid security access control system, configured in key equipment, comprising:
[0032] A request receiving module, used for receiving an access request sent by an access network device;
[0033] A response module, used to respond to the access request, and calculate the trust values corresponding to the performance indicators, network traffic and access behaviors of the access network devices according to the performance indicator data and network traffic data of the key devices in the access process and all access behaviors of the access network devices;
[0034] A processing module, for determining a performance indicator authorization level, a network flow authorization level, and an access behavior authorization level based on comparison of the trust values corresponding to the performance indicators, network flow, and access behavior of the access network device with their respective corresponding thresholds;
[0035] The access module is used to filter out the lowest level among the performance indicator authorization level, network traffic authorization level and access behavior authorization level, and use it as the final authorization level of the access network device to determine the access scope.
[0036] Furthermore, the access module is further configured to terminate access when it is determined that at least one of the trust values corresponding to the performance indicators, network traffic, and access behavior of the access network device is lower than the corresponding threshold value; wherein the trust values corresponding to the performance indicators, network traffic, and access behavior of the access network device are: the access network device performance indicator trust value, the access network device network traffic trust value, and the access network device access behavior trust value, respectively.
[0037] Furthermore, the respective corresponding thresholds include: an access network device performance indicator trust value threshold, an access network device network traffic trust value threshold, and an access network device access behavior trust value threshold;
[0038] The processing module is also used to: dynamically adjust the access network device performance indicator trust value threshold by using a percentile dynamic threshold update mechanism according to real-time analysis results and performance changes; dynamically adjust the access network device network traffic trust value threshold by using a percentile algorithm according to changes in network traffic; dynamically adjust the access network device access behavior trust value threshold by using a percentile algorithm according to changes in access network device behavior patterns and communication environment.
[0039] Furthermore, the processing module is also used for:
[0040] evaluating the performance indicator according to the access network device performance indicator trust value and the access network device performance indicator trust value threshold to grant a performance indicator authorization level according to the performance indicator;
[0041] Analyze network traffic data and determine the network traffic authorization level based on the network traffic trust value of the access network device and the network traffic trust value threshold of the access network device;
[0042] Based on the access behavior trust value of the access network device and the access behavior trust value threshold of the access network device, monitor and analyze the access behavior, evaluate the access behavior's compliance with resource access mode and operation, and calculate the access behavior authorization level.
[0043] A fourth aspect of the present invention provides a terminal device.
[0044] A terminal device comprises a memory, a processor and a computer program stored in the memory and capable of running on the processor, wherein when the processor executes the program, the smart grid security access control method as described in the first aspect or the second aspect is implemented.
[0045] Compared with the prior art, the present invention has the following beneficial effects:
[0046] The present invention calculates the access network device performance index trust value, the access network device network traffic trust value and the access network device access behavior trust value respectively according to the performance index data and network traffic data of key devices in the access process and all access behaviors of the access network device; determines the performance index authorization level, the network traffic authorization level and the access behavior authorization level according to the comparison of the access network device performance index trust value, the access network device network traffic trust value and the access network device access behavior trust value with their respective corresponding thresholds; respectively screens out the lowest level among the performance index authorization level, the network traffic authorization level and the access behavior authorization level, and uses it as the final authorization level of the access network device to determine the access scope. The present invention can ensure that even if the trust value decreases during the communication process, the access network device can still maintain the necessary access rights, unless its trust value drops below the minimum security threshold, at which time the access will decisively terminate the authorization to ensure the high security of smart grid communication.
[0047] The present invention focuses on real-time monitoring of the communication process between key equipment in the smart grid and the corresponding access network equipment. The key equipment mainly includes substations, power stations, and distribution stations. By continuously conducting in-depth analysis of key equipment performance indicators, network traffic patterns, and access network equipment access behaviors, the security and reliability of the communication process are ensured. Through comprehensive behavioral analysis, the present invention can effectively identify and respond to potential security threats, thereby providing a highly dynamic and adaptive security measure for the communication process of the smart grid.
[0048] In the smart grid, the present invention can ensure secure communication between access network devices and key devices. Following the principle of least privilege, resource access rights in key devices are divided into four levels: highest level, high level, medium level and low level, ensuring that access network devices are only granted the lowest level of access rights necessary to perform their functions, thereby minimizing potential security risks. When an access network device sends an access request to a key device, the key device will initially grant the lowest authorization level according to the preset security policy, thereby ensuring that the initial stage of communication is carried out within a controllable range. During the process of access network devices accessing key devices, the present invention continuously monitors key device performance indicators, network traffic and access behavior of access network devices to detect abnormal behavior. BRIEF DESCRIPTION OF THE DRAWINGS
[0049] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.
[0050] Figure 1 is a flow chart of a smart grid security access control method shown in Embodiment 1 of the present invention;
[0051] Figure 2 is a framework diagram of a smart grid security access control method shown in Embodiment 1 of the present invention;
[0052] Figure 3 is a line graph showing changes in the trust value and trust threshold of the access network device performance indicator over time shown in the first embodiment of the present invention;
[0053] Figure 4 is a line graph showing changes in the authorization level of the access network device performance indicator over time shown in the first embodiment of the present invention;
[0054] Figure 5 is a line graph showing changes in the network traffic trust value and the trust threshold of the access network device over time shown in the first embodiment of the present invention;
[0055] Figure 6 is a line graph showing changes in the network traffic authorization level of an access network device over time, shown in the first embodiment of the present invention;
[0056] Figure 7 is a line graph showing changes in the access behavior trust value and the trust threshold of the access network device over time shown in the first embodiment of the present invention;
[0057] Figure 8 is a line graph showing changes in the access behavior authorization level of an access network device over time, shown in the first embodiment of the present invention;
[0058] Fig. 9 is a line graph showing changes in the final authorization level of an access network device over time as shown in the first embodiment of the present invention;
[0059] Fig.10 is a flow chart of a smart grid security access control method shown in Embodiment 2 of the present invention;
[0060] Fig.11 is a structural diagram of a smart grid security access control system shown in Embodiment 3 of the present invention;
[0061] Fig.12 It is a structural diagram of a terminal device shown in Embodiment 4 of the present invention. DETAILED DESCRIPTION
[0062] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.
[0063] It should be noted that the following detailed descriptions are all illustrative and intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.
[0064] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.
[0065] Embodiment 1
[0066] Figure 1 This is a flow chart of a smart grid security access control method shown in the first embodiment of the present invention. The embodiment of the present invention can be applied to a substation, a power station or a distribution station for security access. The method is executed by a smart grid security access control system provided by the embodiment of the present invention. The system can be implemented by software and configured with key equipment applications. This embodiment specifically includes the following steps:
[0067] Receiving an access request sent by an access network device;
[0068] In response to the access request, according to the performance indicator data and network flow data of the key devices in the access process and all access behaviors of the access network devices, respectively calculate the trust values corresponding to the performance indicators, network flow and access behaviors of the access network devices;
[0069] Based on the comparison of the trust values corresponding to the performance indicators, network traffic and access behaviors of the access network device with their respective corresponding thresholds, the performance indicator authorization level, network traffic authorization level and access behavior authorization level are determined;
[0070] The lowest levels among the performance indicator authorization level, network traffic authorization level and access behavior authorization level are screened out respectively and used as the final authorization level for access network devices to determine the access scope.
[0071] The present invention analyzes the access behavior of the access network device, calculates the compliance of the access behavior with the preset rules, and uses the initial access behavior trust value of the access network device as the access behavior trust value. , using percentile algorithm to dynamically adjust the access behavior trust threshold of network access devices .pass and Compare and grant access authorization levels to network devices Ensure that all resource access is within the authorized scope and log any unauthorized access attempts. Follow the authorization mechanism based on the principle of least trust and conduct a comprehensive assessment. After that, the authorization level of the access network device is readjusted. In this dynamic adjustment process, special attention is paid to the lowest authorization level among various indicators, which is used as the final authorization level of the access network device. The present invention ensures that even if the trust value decreases during the communication process, the access network device can still maintain the necessary access rights, unless its trust value drops below the minimum security threshold, at which time the access authorization will be decisively terminated to ensure the high security of smart grid communication.
[0072] The present invention calculates the performance trust value of access network equipment by regularly collecting and updating key performance indicator data in the database and using the average weighted summation algorithm. , using the random forest classifier algorithm to analyze key equipment performance indicators, and dynamically adjust access network equipment based on the classifier results . Use percentile algorithm to dynamically adjust the performance trust threshold of access network equipment .pass and Compare and grant access network equipment performance authorization levels Define a callback function that is automatically triggered each time a data packet is captured, use the random forest classifier algorithm to analyze the network traffic of key devices, and use the classifier abnormality as the initial network traffic trust value of the access network device , using percentile algorithm to dynamically adjust the network traffic trust threshold of access network devices .pass and Compare and grant network traffic authorization levels to network access devices .
[0073] The steps in the smart grid security access control method described in this embodiment are described in detail below. Figure 2 As shown:
[0074] Step 1: Follow the principle of least privilege and design a hierarchical access permission architecture to set clear access control for different levels of data and resources. Authorize different levels, which are divided into four levels: highest level (sensitive data), high level (important data), medium level (low-sensitivity data) and low level (secondary data). Each level corresponds to different resource access scopes and operation permissions to ensure communication security and data confidentiality.
[0075] (1)
[0076] in, Indicates four levels of access rights, including Indicates the highest level, Indicates high level, Indicates the middle level, Indicates low level.
[0077] (2)
[0078] in, Indicates that key equipment is at the authorized level Perform corresponding operations on the specified resources. Indicates the authorization level i The first rule in the authorization level i There are a total of n Rules, Represents the elements in A.
[0079] (3)
[0080] in, Indicates the authorization level is S All rule sets in Indicates the authorization level is H All rule sets in Indicates the authorization level is M All rule sets in Indicates the authorization level is L All rule sets in It is the highest authorization level for key devices; if you operate a resource is not in any defined rule set, then for the highest authorization level α in A, the access control function f() will return "deny".
[0081] The highest level of access rights grants full access to the most sensitive and important data of access network devices, mainly including core databases, key operating systems, and major communication interface data. High-level access rights allow read and write operations on important data of access network devices, such as user data and operation logs. Such data is critical to the operation of access network devices, but usually does not involve core control permissions. Medium-level access rights are applicable to access to low-sensitivity data, which includes common business files and secondary system information, but does not involve core security. Low-level access rights are limited to read permissions for non-critical systems and data, such as public information and auxiliary systems. Such data has little impact on the security of critical equipment and the execution of major tasks, and is suitable for sharing non-critical communication information.
[0082] When the access network device initiates a request to access the key device When the key device verifies the login password of the network access device, it will initially grant low-level access rights to the network access device. To ensure that network access devices can perform basic communication interactions without compromising communication security and data privacy.
[0083] (4)
[0084] in, Indicates that B initiates the first visit to A.
[0085] As the interaction between the two deepens and the trust value of access network devices is gradually adjusted, key devices dynamically adjust the access level of access network devices based on the analysis results. This strategy not only ensures the security of initial interactions, but also allows access network devices to access a wider range of resources and data after sufficient trust is established to meet their communication needs.
[0086] Step 2: During the communication process, it is crucial to ensure stability and performance reliability. The present invention proposes a performance monitoring and evaluation mechanism, which first comprehensively collects performance indicators of key devices, including CPU usage, memory usage, disk usage, network usage, and device connection number indicators.
[0087] Define the monitoring performance indicator process:
[0088] (5)
[0089] in, Indicates the current time t Next, a set of performance indicators, including CPU usage, memory usage, disk usage, network usage, and device connection number indicators; Indicates collecting CPU usage at time t , memory usage , disk usage , network usage , number of device connections .
[0090] The collected data is used as input to a machine learning-based random forest classifier algorithm for in-depth analysis, which can effectively learn and identify normal and abnormal performance behavior patterns from the data.
[0091] Random forest classifier classification results:
[0092] (6)
[0093] in, represents a classification function, which is used to make classification decisions based on input data, features, and the number of decision trees; D represents the collection of CPU usage, memory usage, disk usage, network usage, and number of device connections; F represents the extraction of feature sets from data D; Indicates the function that determines the final classification result based on the majority voting principle. express It is a decision tree Predict the result for the input feature F; n Represents the total number of decision trees in the random forest.
[0094] Through pattern recognition, it is possible to calculate the , the trust value reflects the current performance status and reliability.
[0095] In this process, a higher trust value is assigned to normal data, while a lower trust value is assigned to abnormal data. Differentiated trust value assignment strategies help to quickly identify and respond to potential performance issues. At the same time, a percentile dynamic threshold update mechanism is used to continuously adjust the access network devices based on real-time analysis results and performance changes. , ensuring that trust assessment can flexibly adapt to changes in the operating environment.
[0096] Access network equipment Access network equipment performance indicator trust value :
[0097] (7)
[0098] in, In normal mode, Slowly increase; in abnormal mode, Rapid descent. Represents the parameter that controls the rate of change of the trust value. When it is abnormal, it is -1, and when it is normal, it is 1. Indicates that performance indicator values are collected. Indicates that each performance indicator value corresponds to a weight, and the weight is the average.
[0099] Access network equipment performance indicator trust value threshold , calculated using the following formula:
[0100] (8)
[0101] in, represents the percentile function; Indicates the entire column of access network devices Sort by Indicates that the entire array of devices , one percent of the data is greater than this value, and the remaining percent The data is less than this value.
[0102] like Figure 3As shown in the figure, when the access network device accesses the key device, the performance indicators of the key device are collected and analyzed. In the first five visits, the performance indicators of the key device are normal, and the access network device performance trust value increases slowly. In the sixth visit, due to the access of the access network device, the performance indicators of the key device are abnormal, and the access network device performance trust value drops rapidly and is lower than the access network device performance trust threshold.
[0103] like Figure 4 As shown, by comparing the access network device performance trust value with the access network device performance trust threshold, the access network device performance is authorized. In the sixth access process, since the access network device performance trust value is lower than the access network device performance trust threshold, the cancellation level is granted.
[0104] Step 3: Design and implement a network traffic anomaly monitoring solution, using a portion of the CICIDS2017 dataset to record various network traffic characteristics in detail. Six key attributes, including duration, number of packets, packet length, traffic bytes per second, number of packets per second, and average inter-flow arrival time, are selected as input features to build a network traffic analysis behavior model.
[0105] (9)
[0106] in, Indicates the selection of six key attributes.
[0107] To optimize the model training and evaluation process, the data set was divided into a training set and a test set at a ratio of 70% to 30%. A random forest classifier model based on machine learning was selected, which is suitable for processing complex data sets and identifying hidden patterns. The model was trained using the training set and the model parameters were adjusted to improve its ability to identify normal and abnormal behaviors of network traffic.
[0108] Model training process:
[0109] (10)
[0110] Represents the number of decision trees trained on the six key attributes of traffic flow and the random forest classifier model; Indicates t The decision tree i Features The classification voting results; by constructing T decision trees and Conduct classification voting and then reach the final classification result based on the majority voting principle.
[0111] After the model training is completed, the test set is used to evaluate the model performance, and a series of indicators are used to measure the model accuracy and generalization ability. In order to achieve real-time network traffic monitoring, a callback function is defined, which can be automatically triggered every time a data packet on a key device is captured. This function extracts the traffic information in the data packet, first preprocesses it, and then uses the trained random forest classifier model to predict the preprocessed data to determine whether there is an anomaly in the current network traffic.
[0112] Real-time network traffic monitoring:
[0113] (11)
[0114] in, Indicates processing of data packets X The process, Indicates the capture of data packets ; Indicates the extraction of features from data packets; Represents the process of analyzing feature sets; It indicates the process of issuing an alarm based on the analysis result A.
[0115] Calculate the abnormality of the access network devices based on the model prediction , and use percentile algorithm to dynamically update This can adapt to changes in network traffic and adjust trust thresholds in a timely manner, thereby effectively identifying and responding to potential network threats.
[0116] Calculation of network traffic trust value of access network devices:
[0117] (12)
[0118] in, represents the network traffic trust value of the access network device, N represents the total number of decision trees, Indicates The number of times a decision tree predicts anomalies.
[0119] (13)
[0120] in, Indicates the network traffic analysis results. Under normal conditions, ; Under abnormal conditions, ; Indicates the trust value of the last network traffic. Indicates the trust value of this network traffic.
[0121] Calculation of network traffic trust threshold for access network devices:
[0122] (14)
[0123] (15)
[0124] in, Indicates the network traffic trust threshold of the access network device. Can be expressed , ; n represents the number of trust values. They respectively represent the ranking of the network traffic trust value and access behavior trust value generated by each access.
[0125] like Figure 5 As shown in the figure, when the access network device accesses the key device, the network traffic data packets of the key device are collected and analyzed. In the 6 visits, the network traffic of the key device is normal, and the trust value of the network traffic of the access network device increases slowly.
[0126] like Figure 6 As shown, by comparing the network traffic trust value of the access network device with the network traffic trust threshold of the access network device, the network traffic of the access network device is authorized.
[0127] Step 4: After the access network device is authorized and starts communicating with key devices, the access behavior monitoring mechanism is started to track and record all resource access behaviors of the access network device in real time, including resource access requests and execution operations on key devices, and record them in the security log in a standardized format to facilitate subsequent analysis and auditing.
[0128] Log format:
[0129] (16)
[0130] in, Indicates that the record t All operations performed by access network devices on key devices at a point in time; () indicates the time point t On the other hand, the operations performed by the access network equipment on the key equipment; t Indicates a point in time, Indicates that the access network device B has a significant impact on the key device A in time t Perform actions on resources.
[0131] Implement an automated log analysis process to compare logged actions with established authorization rules.
[0132] (17)
[0133] The Compare function operates on each log entry Compare with all authorization rules to check whether the operation is authorized; Indicates the access to key devices by network access devices within a given authorization level. Indicates that the access to critical equipment by the network device exceeds the given authorization level.
[0134] Log processing process:
[0135] (18)
[0136] in, represents the output of the analysis process, Indicates the time point in the log is t Access records, Represents the comparison process, the time point in the log is t The operation type in the access record is matched with the authorization rule; Indicates the authorization status of each operation; t Indicates a point in time; It's in time t A collection of log entries; HandlingMechanism represents the process of handling unauthorized operations and records violations.
[0137] This process ensures that the operation of the access network device is completely in compliance with the permission boundaries defined by the authorization level. If it is detected that the operation of the access network device is completely within the authorization scope, the operation will be allowed to continue; if an unauthorized behavior is found, the operation will be immediately rejected and the violation will be marked and recorded in the log so that further security measures can be taken. This value quantifies the degree to which the access network device complies with the authorization rules. The percentile algorithm is used to dynamically update This method enables the trust threshold to be adaptively adjusted according to the behavior pattern of the access network device and the changes in the communication environment. Based on real-time monitoring, log analysis and trust value calculation methods, a dynamic and responsive security control strategy is provided for inter-device communication. By continuously updating the trust threshold, the access rights of the access network devices are effectively managed and adjusted to ensure communication security and reasonable use of resources, and maintain the integrity and reliability of the entire communication network.
[0138] (19)
[0139] (20)
[0140] Calculation of access behavior trust value in continuous analysis:
[0141] (twenty one)
[0142] in, It represents the access behavior trust value of the network device at the current time t. represents the access behavior trust value of the network device at time (t-1), Indicates the prescribed operation level (the highest, high, medium, and low levels are quantized as 4, 3, 2, and 1 respectively); Indicates the actual operation level; Indicates the specified resources (sensitive, important, general and minor resources are quantified separately); Indicates actual access to resources; Indicates the specified operation type (delete, write, read, create for quantization); Indicates the actual operation type; Indicates the compliance between actual access and preset rules; Indicates that the adjustment compliance Influence parameter, take 0.5 ， Indicates whether the current access behavior is within the authorized scope. If yes, it is equal to 1, otherwise, it is equal to -1.
[0143] like Figure 7 As shown, when the access network device accesses the key device, the access behavior of the access network device is recorded and analyzed. In the first four visits, the access behavior of the access network device is normal, and the access trust value of the access network device increases slowly. In the fifth access process, because the access network device tampered with the resources on the key device, the access network device access behavior trust value dropped rapidly, but it was higher than the access network device access behavior trust threshold (this setting is to prevent contingency). In the sixth access process, the access network device still tampered with the resources on the key device, and the access network device access behavior trust value dropped rapidly, which was lower than the access network device access behavior trust threshold.
[0144] like Figure 8 As shown, by comparing the access trust value of the access network device with the access behavior trust threshold of the access network device, the access behavior of the access network device is authorized. Since the first four access behaviors are normal, the access behavior trust value of the access network device increases slowly. During the fourth access, the access network device is granted a high-level access level. During the fifth access process, due to abnormal access behavior, the access behavior trust value of the access network device drops rapidly, and the access network device is granted a medium-level level. During the sixth access process, since the access behavior trust value of the access network device is lower than the access behavior trust threshold of the access network device, the access network device is granted a cancellation level.
[0145] Step 5: To ensure high security and reliability of communications, a comprehensive assessment method is used to determine the authorization level of network access devices. This method is based on in-depth analysis of performance indicators, network traffic and access behavior, combined with strict authorization rules.
[0146] First, performance indicators are evaluated, including key parameters such as CPU usage, memory usage, and disk usage, and performance authorization levels are granted based on these indicators. .
[0147] (twenty two)
[0148] in, It represents a function used to compare the access network device performance trust value with the access network device performance trust threshold, and finally obtains the performance authorization level of the access network device.
[0149] Analyze network traffic data, including traffic size, packet behavior, etc., to determine network traffic authorization levels .
[0150] (twenty three)
[0151] in, It represents a function used to compare the network traffic trust value of the access network device with the network traffic trust threshold of the access network device, and finally obtains the network traffic authorization level of the access network device.
[0152] Monitor and analyze access behavior, evaluate its resource access mode and operational compliance, and calculate the access behavior authorization level .
[0153] (twenty four)
[0154] in, It represents a function used to compare the access behavior trust value of the access network device with the access behavior trust threshold of the access network device, and finally obtains the access behavior authorization level of the access network device.
[0155] The authorization levels are divided into the highest level, high level, medium level and low level, and each level corresponds to different operation permissions and access scopes. The lowest authorization level among these three dimensions will be considered when performing network access control. This approach ensures that even if a device performs well in some aspects, its overall access rights will not exceed the minimum level limit, thereby achieving strict management and control of the access rights of network access devices.
[0156] The authorization level of the access network device indicates:
[0157] (25)
[0158] like Fig. 9 As shown, based on the principle of minimum trust, the performance, network traffic, and access behavior level of the access network device during each access process are compared, and the minimum level is taken to finally authorize the access network device.
[0159] The present invention can effectively manage and monitor device operations through this detailed hierarchical authorization mechanism to ensure that all actions are performed within the authorized scope, thereby preventing unauthorized access and potential improper operations and improving the security and stability of the entire communication network.
[0160] Embodiment 2
[0161] Fig.10 This is a flow chart of a smart grid security access control method shown in the second embodiment of the present invention. The embodiment of the present invention can be applied to a substation, a power station or a distribution station for security access. The method is executed by a smart grid security access control system provided by the embodiment of the present invention. The system includes: key equipment and at least one access network device. This embodiment specifically includes the following steps:
[0162] An access request sent by an access network device to a key device;
[0163] The key device responds to the access request and calculates the trust values corresponding to the performance index, network traffic and access behavior of the access network device according to the performance index data and network traffic data of the key device during the access process and all access behaviors of the access network device;
[0164] The key device determines the performance indicator authorization level, network flow authorization level and access behavior authorization level based on the trust values corresponding to the performance indicators, network flow and access behavior of the access network device and their corresponding thresholds;
[0165] The key device respectively selects the lowest level among the performance indicator authorization level, the network traffic authorization level and the access behavior authorization level, and uses it as the final authorization level of the access network device to determine the access scope.
[0166] In some embodiments, if the key device determines that at least one of the trust values corresponding to the performance indicators, network traffic, and access behavior of the access network device is lower than the corresponding threshold, the access is terminated.
[0167] By continuously analyzing communication behaviors and integrating continuous behavior analysis with the concept of zero-trust security, the present invention can timely discover and effectively respond to the evolution of security threats, thereby ensuring the security and reliability of the smart grid communication process.
[0168] Embodiment 3
[0169] Fig.11 : is a structural diagram of a smart grid security access control system shown in Embodiment 3 of the present invention. The system is configured in key equipment. The key equipment can be applied to a substation, a power station or a distribution station. The system includes:
[0170] A request receiving module, used for receiving an access request sent by an access network device;
[0171] A response module, used to respond to the access request, and calculate the trust values corresponding to the performance indicators, network traffic and access behaviors of the access network devices according to the performance indicator data and network traffic data of the key devices in the access process and all access behaviors of the access network devices;
[0172] A processing module, for determining a performance indicator authorization level, a network flow authorization level, and an access behavior authorization level based on comparison of the trust values corresponding to the performance indicators, network flow, and access behavior of the access network device with their respective corresponding thresholds;
[0173] The access module is used to filter out the lowest level among the performance indicator authorization level, network traffic authorization level and access behavior authorization level, and use it as the final authorization level of the access network device to determine the access scope.
[0174] In some embodiments, the request receiving module is further used to: as a requester (access network device), initiate an access request to a key device. The key device evaluates the access network device request according to the preset security policy and access control list (ACL), and decides to grant the corresponding access level. This process not only involves authorizing the access network device, but also includes accurately specifying the access permission level to ensure that the access network device can only access its authorized resource range.
[0175] The present invention follows the principle of least privilege, considers the importance of access rights and data sensitivity, and divides the resources in key devices into four different security levels: highest level, high level, medium level and low level. Each level is given specific resource access rights, thus ensuring that data exchange between devices is both orderly and secure.
[0176] In some embodiments, the data acquisition module is used to: regularly collect key equipment performance indicator data and update it in the database. In the process of power grid communication, a network traffic monitoring and analysis mechanism is adopted. The network traffic data of key equipment in the access process is captured in real time. At the same time, the present invention designs and starts a continuous monitoring process, aiming to track and analyze all access behaviors of network access devices in real time.
[0177] In some embodiments, the processing module is further used to: perform in-depth analysis based on the key device performance indicator data during the access process using a random forest classifier algorithm to accurately calculate the access network device In order to adapt to the dynamically changing network environment, the present invention introduces a dynamic threshold update strategy to automatically adjust to ensure the accuracy and timeliness of behavioral analysis.
[0178] In addition, the present invention follows the principle of least privilege and utilizes To dynamically determine the access network device The trust value-based authorization mechanism not only enhances the security of power grid communications, but also improves the flexibility and adaptability of the system, enabling it to effectively cope with changing network environments, providing an innovative solution for the field of network security.
[0179] In one or more embodiments, the processing module is also used to: during the power grid communication process, use a network traffic monitoring and analysis mechanism, based on the network traffic data of key devices during the access process, use a machine learning-based random forest classifier algorithm to perform in-depth analysis to detect any abnormal behavior in the communication environment of key devices during the access initiated by the access network device, effectively identify abnormal patterns from regular traffic patterns, and thus evaluate the credibility of the access network device.
[0180] Based on this analysis, calculate the access network equipment , combined with dynamic updates , and conduct security assessment on the network traffic of the access network device. The assessment result becomes the core basis for judging whether the access network device should be granted further communication permissions, and provides a dynamic access control method based on traffic trust value for network communication security.
[0181] In one or more embodiments, the processing module is further used to: after the access network device obtains the initial authorization level, calculate the access network device based on all access behaviors to the access network device. . Using percentile algorithm Dynamic adjustment, after adjustment It becomes a key indicator for evaluating whether the authorization level of the access network device needs to be changed. This process not only ensures the dynamic and adaptable nature of behavior analysis, but also improves the accuracy and reliability of the decision-making process, thereby providing a dynamic access control mechanism based on behavior trust value for network communications.
[0182] In some embodiments, the access module is further used to: during the comprehensive analysis and security authorization process of the access network device, a corresponding authorization level will be assigned to each aspect based on the detailed analysis results of the performance indicators of key devices, network traffic, and access behavior of the access network device. When the various analysis information is integrated, the lowest level of the three will be used as the final authorization level of the access network device to ensure that even if the access network device shows a high degree of trust in one dimension, the risk points in other dimensions will not be ignored.
[0183] The present invention adopts an authorization mechanism based on the principle of minimum trust, which significantly improves the security of the entire network communication system and the ability to resist unknown threats. This method provides an efficient and reliable solution for network communication through careful analysis and dynamic authorization management.
[0184] In some embodiments, the access network device performance indicator trust value is calculated using the following formula:
[0185]
[0186] in, Indicates the trust value of the access network equipment performance indicator. In normal mode, Slowly increase; in abnormal mode, Rapid descent; Represents the parameter controlling the rate of change of the trust value; When it is abnormal, it is -1, and when it is normal, it is 1; Indicates that the performance indicator value is collected; Indicates the weight corresponding to each performance indicator value.
[0187] In some embodiments, the network traffic trust value of the access network device is calculated using the following formula:
[0188]
[0189] in, represents the network traffic trust value of the access network device, N represents the total number of decision trees, Indicates The number of times a decision tree predicts anomalies.
[0190] In some embodiments, the access network device access behavior trust value is calculated using the following formula:
[0191]
[0192]
[0193]
[0194] in, It represents the access behavior trust value of the network device at the current time t. represents the access behavior trust value of the network device at time (t-1), Indicates the specified operation level; Indicates the actual operation level; Represents a specified resource; Indicates actual access to resources; Indicates the specified operation type; Indicates the actual operation type; Indicates the compliance between actual access and preset rules; Indicates that the adjustment compliance Influencing parameters, Indicates whether the current access behavior is within the authorized scope. If yes, it is equal to 1, otherwise, it is equal to -1.
[0195] The present invention enhances the communication security between key devices and access network devices in the smart grid. By continuously monitoring the behavior patterns of access network devices, potential threats can be identified and responded to in real time to ensure the security and reliability of power grid communications in a dynamic network environment and effectively defend against complex network attacks.
[0196] Embodiment 4
[0197] Fig.12 This is a structural diagram of a terminal device shown in Example 4 of the present invention. The terminal device includes a memory, a processor, and a computer program stored in the memory and capable of running on the processor. When the processor executes the program, it implements the smart grid security access control method as described in Example 1 or Example 2.
[0198] It is worth noting that in the embodiment of the above-mentioned device, the modules included are only divided according to functional logic, but are not limited to the above-mentioned division, as long as the corresponding functions can be realized; in addition, the specific names of the functional modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of the present invention.
[0199] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.
Claims
1. A smart grid security access control method, characterized in that: Applied to key equipment, the key equipment includes a transformer substation, a power station, and a distribution station, the method includes: Receiving an access request sent by an access network device; In response to the access request, according to the performance indicator data and network flow data of the key devices in the access process and all access behaviors of the access network devices, respectively calculate the trust values corresponding to the performance indicators, network flow and access behaviors of the access network devices; Based on the comparison of the trust values corresponding to the performance indicators, network traffic and access behaviors of the access network device with their respective corresponding thresholds, the performance indicator authorization level, network traffic authorization level and access behavior authorization level are determined; The lowest level among the performance indicator authorization level, network traffic authorization level and access behavior authorization level is selected and used as the final authorization level of the access network device to determine the access scope; After receiving the access request sent by the access network device, the method further includes: evaluating the access network device request according to a preset security policy and access control list, and determining a preliminary access level to be granted to the access network device, so that the access network device can only access the authorized resource range; The trust values corresponding to the performance indicators, network traffic and access behaviors of the access network device are: the access network device performance indicator trust value, the access network device network traffic trust value and the access network device access behavior trust value; if at least one of the access network device performance indicator trust value, the access network device network traffic trust value or the access network device access behavior trust value is lower than the respective corresponding thresholds, the access is terminated; The key equipment performance indicator data include: CPU usage, memory usage, disk usage, network usage and equipment connection number indicators; the key equipment network traffic data include: duration, number of packets, packet length, traffic bytes per second, number of packets per second and average inter-flow arrival time; all access behaviors of the access network devices include: resource access requests and execution operations on key equipment, and are recorded in the security log in a standardized format; According to the real-time analysis results and performance changes, the percentile dynamic threshold update mechanism is used to dynamically adjust the trust value threshold of the access network device performance indicator; according to the changes in network traffic, the percentile algorithm is used to dynamically adjust the trust value threshold of the access network device network traffic; according to the changes in the access network device behavior pattern and communication environment, the percentile algorithm is used to dynamically adjust the access network device access behavior trust value threshold; The respective corresponding thresholds include: an access network device performance indicator trust value threshold, an access network device network traffic trust value threshold, and an access network device access behavior trust value threshold.
2. The smart grid security access control method according to claim 1, characterized in that: The trust value of the access network device performance indicator is obtained by multiplying the control trust value change rate parameter in different modes by the weighted sum of all performance indicators.
3. The smart grid security access control method according to claim 1, characterized in that: The network traffic trust value of the access network device is obtained by the difference between 1 and the ratio of the number of abnormalities predicted by the decision tree to the total number of all decision trees.
4. The smart grid security access control method according to claim 2 or 3, characterized in that: According to the performance indicator data and network flow data of the key equipment in the access process, the trust values corresponding to the performance indicator and network flow of the access network equipment are calculated respectively; the method includes: Based on the key equipment performance indicator data, the machine learning-based random forest classifier algorithm is used to analyze and determine the classification results of normal behavior patterns and abnormal behavior patterns; based on the classification results, the trust value of the access network equipment performance indicator is calculated; Based on the network traffic data of key devices, a random forest classifier model based on machine learning is used to output whether there are any abnormalities in the network traffic; based on the output results, the trust value of the network traffic of the access network device is calculated.
5. The smart grid security access control method according to claim 1, characterized in that: The access network device access behavior trust value is obtained by multiplying the access network device access behavior trust value at the previous moment by a correlation coefficient of whether the current access behavior is within the authorized scope.
6. The smart grid security access control method according to claim 1, characterized in that: After the access network device initiates an access request to the key device, the key device divides the resources in the key device into four different levels: highest level, high level, medium level and low level based on the principle of least privilege and taking into account the importance of the access network device's access rights and data sensitivity, and grants the highest level access right, high level access right, medium level access right and low level access right accordingly.
7. A smart grid security access control method, characterized in that: Applied to a smart grid security access control system, the smart grid security access control system includes key equipment and at least one access network device, the key equipment includes a transformer substation, a power station, and a distribution station, the method includes: An access request sent by an access network device to a key device; The key device responds to the access request and calculates the trust values corresponding to the performance index, network traffic and access behavior of the access network device according to the performance index data and network traffic data of the key device during the access process and all access behaviors of the access network device; The key device determines the performance indicator authorization level, network flow authorization level and access behavior authorization level based on the trust values corresponding to the performance indicators, network flow and access behavior of the access network device and their corresponding thresholds; The key device respectively selects the lowest level among the performance indicator authorization level, the network traffic authorization level and the access behavior authorization level, and uses it as the final authorization level of the access network device to determine the access scope; After the critical device responds to the access request, the key device further comprises: evaluating the access network device request according to a preset security policy and access control list, and determining a preliminary access level to be granted to the access network device, so that the access network device can only access the authorized resource range; The trust values corresponding to the performance indicators, network traffic and access behaviors of the access network device are: the access network device performance indicator trust value, the access network device network traffic trust value and the access network device access behavior trust value; if at least one of the access network device performance indicator trust value, the access network device network traffic trust value or the access network device access behavior trust value is lower than the respective corresponding thresholds, the access is terminated; The key equipment performance indicator data include: CPU usage, memory usage, disk usage, network usage and equipment connection number indicators; the key equipment network traffic data include: duration, number of packets, packet length, traffic bytes per second, number of packets per second and average inter-flow arrival time; all access behaviors of the access network devices include: resource access requests and execution operations on key equipment, and are recorded in the security log in a standardized format; According to the real-time analysis results and performance changes, the percentile dynamic threshold update mechanism is used to dynamically adjust the trust value threshold of the access network device performance indicator; according to the changes in network traffic, the percentile algorithm is used to dynamically adjust the trust value threshold of the access network device network traffic; according to the changes in the access network device behavior pattern and communication environment, the percentile algorithm is used to dynamically adjust the access network device access behavior trust value threshold; The respective corresponding thresholds include: an access network device performance indicator trust value threshold, an access network device network traffic trust value threshold, and an access network device access behavior trust value threshold.
8. A smart grid security access control system, characterized in that: Configured in key equipment, the key equipment includes substations, power stations, and distribution stations. The system includes: A request receiving module, used for receiving an access request sent by an access network device; A response module, used to respond to the access request, and calculate the trust values corresponding to the performance indicators, network traffic and access behaviors of the access network devices according to the performance indicator data and network traffic data of the key devices in the access process and all access behaviors of the access network devices; A processing module, for determining a performance indicator authorization level, a network flow authorization level, and an access behavior authorization level based on comparison of the trust values corresponding to the performance indicators, network flow, and access behavior of the access network device with their respective corresponding thresholds; The access module is used to filter out the lowest level among the performance indicator authorization level, network traffic authorization level and access behavior authorization level, and use it as the final authorization level of the access network device to determine the access scope; After receiving the access request sent by the access network device, the key device is further used to evaluate the access network device request according to the preset security policy and access control list, and determine the preliminary access level granted to the access network device, so that the access network device can only access the authorized resource range; The trust values corresponding to the performance indicators, network traffic and access behaviors of the access network device are: the access network device performance indicator trust value, the access network device network traffic trust value and the access network device access behavior trust value; the access module is also used to terminate the access when it is determined that at least one of the trust values corresponding to the performance indicators, network traffic and access behaviors of the access network device is lower than the corresponding threshold value; The key equipment performance indicator data include: CPU usage, memory usage, disk usage, network usage and equipment connection number indicators; the key equipment network traffic data include: duration, number of packets, packet length, traffic bytes per second, number of packets per second and average inter-flow arrival time; all access behaviors of the access network devices include: resource access requests and execution operations on key equipment, and are recorded in the security log in a standardized format; The processing module is further used to: dynamically adjust the access network device performance index trust value threshold using a percentile dynamic threshold update mechanism according to real-time analysis results and performance changes; dynamically adjust the access network device network traffic trust value threshold using a percentile algorithm according to changes in network traffic; dynamically adjust the access network device access behavior trust value threshold using a percentile algorithm according to changes in access network device behavior patterns and communication environment; The respective corresponding thresholds include: an access network device performance indicator trust value threshold, an access network device network traffic trust value threshold, and an access network device access behavior trust value threshold.
9. The smart grid security access control system according to claim 8, characterized in that: The processing module is further used for: evaluating the performance indicator according to the access network device performance indicator trust value and the access network device performance indicator trust value threshold to grant a performance indicator authorization level according to the performance indicator; Analyze network traffic data and determine the network traffic authorization level based on the network traffic trust value of the access network device and the network traffic trust value threshold of the access network device; Based on the access behavior trust value of the access network device and the access behavior trust value threshold of the access network device, monitor and analyze the access behavior, evaluate the access behavior's compliance with resource access mode and operation, and calculate the access behavior authorization level.
10. A terminal device, characterized in that: It includes a memory, a processor, and a computer program stored in the memory and capable of running on the processor. When the processor executes the program, it implements the smart grid security access control method as described in claim 1-6 or 7.