A buffer data access control method and system based on trusted access

Abstract

The present invention discloses a buffer data access control method and system based on trusted access, and relates to the field of data security technology. The method determines the priority of the untrusted object by responding to the access instruction sent by the untrusted object to the power system, and if the priority reaches the preset level, the power system calls the part of the content of the untrusted object that interacts with the power system in advance as the target content, and interacts with the untrusted object to determine whether there is a security risk in the interaction process with the untrusted object, and then connects the untrusted object to the power system only when it is determined that there is no security risk. Thereby solving the problem that the new power system has weak security protection when facing the access of a large number of external untrusted objects, by making the untrusted object interact with the buffer first, it is possible to judge whether there is an attack behavior of the untrusted object in the buffer, thereby ensuring the security of the untrusted object accessing the power system.

Description

Technical Field

[0001] The present invention relates to the technical field of data security, and more specifically to a buffer data access control method and system based on trusted access. Background Art

[0002] Under the background of the new power system, the open and integrated business and data architecture has brought new risks to the security protection system. The number of security defense checkpoints has increased and the security boundary has been greatly expanded. A large number of external non-trusted businesses and terminal businesses have been connected to the company's core network through wired, wireless private networks, mobile phones, etc., resulting in a significant increase in the exposure of power system attacks, exponential growth in boundary security risks, and threats to the core networks of prefecture-level companies. At the same time, since the new power system currently uses more intelligent, digital and Internet technologies, the information interaction and data transmission of the power system have become more frequent and complex, which has also brought serious security risks, such as hacker attacks and data leaks.

[0003] Therefore, developing a trusted open access method can effectively protect the safe and stable operation of the power system and prevent malicious attacks and illegal access. Summary of the invention

[0004] The purpose of the present invention is to provide a buffer data access control method and system based on trusted access, so as to solve the problem that the new power system has weak security protection when facing the access of a large number of external non-trusted objects. By allowing the non-trusted objects to interact with the buffer first, it is possible to judge whether there is any attack behavior against the non-trusted objects in the buffer, thereby ensuring the security of the non-trusted objects accessing the power system.

[0005] In a first aspect, the present invention provides a buffer data access control method based on trusted access, comprising:

[0006] Obtaining an access instruction, where the access instruction is an access application sent by an untrusted object to the power system;

[0007] In response to the access instruction, determining a priority of the untrusted object;

[0008] If the priority of the untrusted object reaches a preset level, the power system calls the target content to interact with the untrusted object, where the target content is a preset part of all the contents that the untrusted object interacts with the power system.

[0009] Determining whether there is a security risk in the interaction process with the untrusted object;

[0010] If it is determined that the security risk does not exist, the untrusted object is connected to the power system.

[0011] In a preferred solution, after determining the priority of the untrusted object in response to the access instruction, the method further includes:

[0012] If the priority of the untrusted object does not reach the preset level, interacting with the untrusted object based on preset content adapted to the untrusted object; wherein the preset content is content summarized based on historical interaction data of untrusted objects of the same type as the untrusted object;

[0013] Determining whether there is a security risk in the interaction process with the untrusted object;

[0014] If it is determined that the security risk does not exist, the untrusted object is connected to the power system and the interaction process is restarted.

[0015] In a preferred solution, the interacting with the untrusted object includes:

[0016] Extracting features of the access instruction to obtain input content of the untrusted object;

[0017] Copying the input content into multiple copies;

[0018] distributing a plurality of said input contents to a corresponding number of randomly preselected isomers for processing;

[0019] Obtaining the processing results of each of the isomers;

[0020] The voting device votes on each of the processing results to determine a unique processing result as a response corresponding to the input content.

[0021] In a preferred solution, the voting device is used to vote on each of the processing results to determine a unique processing result, including:

[0022] Voting on the processing results of each of the isomers based on a low-level voter, wherein the level of the voter is determined based on the performance indicators, historical processing capabilities, and credibility of the voter;

[0023] Sending the voting results of the lower-level voter to the upper-level voter of the lower-level voter, so that the upper-level voter votes on the processing results of each of the isomers in combination with the voting results of the lower-level voter;

[0024] Repeat the step of sending the voting result of the voter at the previous level to the voter at the next level above the voter at the previous level, so that the voter at the next level above votes on the processing result of each of the isomers in combination with the voting result of the voter at the previous level, until the voting result is sent to the voter at the highest level;

[0025] The voting result of the highest-level voter is used as the only processing result.

[0026] In a preferred solution, the determining whether there is a security risk in the interaction process with the untrusted object includes:

[0027] Extracting network traffic or behavior during the interaction;

[0028] Matching the network traffic or behavior with a preset rule, wherein the preset rule is a pre-stored knowledge rule of a network attack event;

[0029] If the network traffic or behavior does not match the preset rule, determining that the interaction process with the untrusted object has the security risk; and

[0030] Determining whether there are features and / or signatures of known attacks in the interaction process, wherein the known attacks are obtained by summarizing features and / or signatures of historical attacks;

[0031] If the features and / or signatures of the known attacks exist in the interaction process, it is determined that the interaction process with the untrusted object has the security risk.

[0032] In a preferred solution, when it is determined that the security risk does not exist, after connecting the untrusted object to the power system, the method further includes:

[0033] Record each event of interaction between the untrusted object and the power system after being connected as a basic node;

[0034] Determine whether the basic node is a leaf node of a preset threat tree, wherein the preset threat tree has a tree structure consisting of a node of an event with the security risk as an end point and a node of each event experienced by the corresponding untrusted object after the interaction process with the power system is started, which is reversed from the event with the security risk as a leaf node;

[0035] If it is determined that the basic node is the leaf node, the determined leaf node is used as the starting node, and the subsequent n events of the interaction between the untrusted object and the power system are continuously determined, whether they are leaf nodes connected to the starting node along the direction from the leaf node to the end point on the preset threat tree, where n is a preset integer greater than 0;

[0036] If it is determined that the n events are all the leaf nodes, it is determined that the interaction process with the untrusted object has the security risk.

[0037] In a preferred solution, the buffer data access control method based on trusted access further includes:

[0038] If it is determined that the security risk exists, triggering the firewall to block attacks on the untrusted object in transparent mode;

[0039] Performing behavioral feature analysis on the attack behavior of the untrusted object;

[0040] If it is determined that the attack behavior of the untrusted object threatens the power system to a preset degree, the untrusted object is included in the blacklist and broadcasted.

[0041] In a second aspect, the present invention provides a buffer data access control system based on trusted access, comprising:

[0042] A collection unit, used to obtain an access instruction, where the access instruction is an access application sent by an untrusted object to the power system;

[0043] A first determination unit, configured to determine a priority of the untrusted object in response to the access instruction;

[0044] A first execution unit, configured to, when the priority of the untrusted object reaches a preset level, cause the power system to call a target content and interact with the untrusted object, wherein the target content is a preset portion of all contents that the untrusted object preliminarily interacts with the power system;

[0045] A second judgment unit is used to determine whether there is a security risk in the interaction process with the untrusted object;

[0046] The second execution unit is configured to directly connect the untrusted object to the power system when it is determined that the security risk does not exist.

[0047] In a third aspect, the present invention provides an electric power system, comprising an electric power system body and a buffer data access control system based on trusted access as provided in the second aspect of the present invention.

[0048] In a fourth aspect, the present invention provides an electronic device, the electronic device comprising:

[0049] processor;

[0050] a memory for storing instructions executable by the processor;

[0051] The processor is used to execute the buffer data access control method based on trusted access provided by the first aspect of the present invention.

[0052] In order to achieve the above-mentioned purpose, the present invention provides a buffer data access control method and system based on trusted access, which, after obtaining the access instruction representing the access application sent by the untrusted object to the power system, responds to the access instruction, first determines the priority of the untrusted object, and when the priority of the untrusted object reaches the preset level, the power system calls the preset part of the entire content of the untrusted object's pre-interaction with the power system as the target content, and interacts with the untrusted object, so that the untrusted object can interact with the power system before connecting with the power system, and whether there is a security risk can be determined through the interaction process with the untrusted object, and only when it is determined that there is no security risk, the untrusted object is connected to the power system. Thus, on the one hand, it avoids the network attacks that the power system is prone to when directly connected to the untrusted object, and on the other hand, the untrusted object with a higher priority starts the interaction process with the power system before directly connecting with the power system, thereby improving the interaction efficiency between the untrusted object and the power system and improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 A flowchart of a buffer data access control method based on trusted access is provided in an embodiment of the present invention.

[0054] Figure 2 A structural diagram of a buffer data access control system based on trusted access provided by an embodiment of the present invention.

[0055] Figure 3 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0056] The present invention is further described in detail below through the accompanying drawings and specific embodiments.

[0057] It is understandable that the current power system is mainly facing the following four situations:

[0058] 1. The power industry has a large amount of grid operation data, business data, intranet office data, etc., and also needs to connect to external communication suppliers, financial data, government data and other related equipment and software. The external connection process may cause the external network to penetrate the power system intranet by tampering or implanting malicious code, illegal access, etc., thereby destroying the integrity of equipment, data and network.

[0059] 2. Smart substations generally use remote monitoring systems, which enable operators to remotely access and operate through the network. However, this also increases the risk of being hacked and remotely intruded, which may lead to unauthorized access and operation of equipment and systems.

[0060] 3. The power industry involves a large amount of user data, energy usage information, and operational data. Data leakage may lead to user privacy leakage, violation of regulatory requirements, and allow attackers to steal sensitive information about power system operation.

[0061] 4. The access equipment of the distribution network, such as smart terminals and smart meters, can only be dealt with urgently after such accidents occur, resulting in equipment damage, large-scale power outages, and significant losses.

[0062] At the same time, the construction of new power systems requires the grid to accelerate digital development, and cyber attacks and threats are increasing. Threats such as hackers, malicious terminal software and viruses are becoming increasingly complex and hidden, and traditional security protection measures are no longer sufficient to protect the system from attacks. In addition, in the new power system, the open and integrated business and data architecture means the integration and interaction between different manufacturers and suppliers, which increases potential vulnerabilities and security risks in the system; a large number of external non-trusted businesses and terminal businesses are connected to the company's core network through wired, wireless private networks, mobile phones, etc., resulting in a significant increase in the exposure of power system attacks and an exponential increase in border security risks.

[0063] In order to solve the above problems, the present invention provides a buffer data access control method based on trusted access, which determines whether an untrusted object attacks the power system through the interaction process between the untrusted object pre-connected to the power system and the buffer. It can avoid the untrusted object from directly connecting and interacting with the power system, which may easily cause attacks and threats to the power system, thereby ensuring the safety of the power system.

[0064] The buffer data access control method based on trusted access provided by the present invention is executed on an electronic device, and the electronic device may be a processor, a server, etc. configured in a security buffer.

[0065] Specifically, the security buffer zone is located between the trusted network area and the untrusted network area. It serves as a buffer zone for the system or terminal in the untrusted network area to interact with the system in the trusted network area. The security buffer zone provides secure access services for untrusted objects such as non-centrally controlled power plants of municipal companies, videos, Internet of Things, third-party business terminals, etc.

[0066] like Figure 1 As shown, the buffer data access control method based on trusted access provided by an embodiment of the present invention mainly includes the following steps:

[0067] 110. Get access instructions.

[0068] The access instruction is an access request sent by an untrusted object to the power system.

[0069] It can be understood that trust means that for a specific target, the behavior of the entity is always consistent with expectations, then for this target, the entity is trustworthy. Accordingly, because it is not ruled out that there are objects that penetrate the power system intranet by tampering or implanting malicious code, illegal access and other behaviors that are inconsistent with expectations during the external connection process, the objects pre-connected to the power system are collectively referred to as untrustworthy objects.

[0070] Specifically, untrusted objects may include government and enterprises, UnionPay, new energy plants and stations, and sensors related to the intelligent auxiliary system of substations and distribution that need to be connected to the power system. When untrusted objects are pre-connected to the power system, they will first send an access application to the power system. For example, opening the login interface and entering the account and password is equivalent to sending an access application to the power system.

[0071] 120. In response to the access instruction, determine a priority of the untrusted object.

[0072] Specifically, taking the access application as inputting an account and password on a login interface as an example, if the account and password match, the identity information of the non-trusted object can be obtained through the account, and then its priority can be determined.

[0073] More specifically, the priority of the untrusted object can be divided according to different standards according to actual needs. It should be noted that in the embodiment of the present invention, it is determined based on the level of the priority of the untrusted object whether to interact with the untrusted object in the security buffer with the content of the untrusted object called by the power system to interact with the power system, that is, to determine whether to start the real interaction between the untrusted object and the power system in the security buffer. Therefore, the priority of the untrusted object is preferably divided according to the efficiency requirements for data interaction.

[0074] 130. If the priority of the untrusted object reaches a preset level, the power system calls the target content to interact with the untrusted object.

[0075] The target content is a preset part of the entire content of the untrusted object's interaction with the power system.

[0076] In this embodiment, when it is determined that the priority of the untrusted object reaches the preset level, it indicates that the untrusted object has a high requirement for interaction efficiency. By calling the preset part of the entire content of the untrusted object's interaction with the power system as the target content, the power system interacts with the untrusted object, thereby realizing the real interaction between the untrusted object and the power system in the security buffer, that is, ensuring the requirements of the untrusted object for interaction efficiency, thereby improving the user experience, and at the same time, avoiding the possibility of the untrusted object directly connecting to the power system and infiltrating the power system intranet, thereby improving the security of the power system.

[0077] 140. Determine whether there are security risks in the interaction process with untrusted objects.

[0078] Specifically, security risks mainly refer to network attacks on power systems by untrusted objects.

[0079] Furthermore, if an untrusted object launches a cyber attack on the power system, abnormalities in traffic or logs will occur during the interaction process. Therefore, by allowing the untrusted object to interact with data in the security buffer, it is possible to determine whether the untrusted object is conducting a cyber attack on the power system by detecting the interaction process.

[0080] 150. If it is determined that there is no security risk, the untrusted object is connected to the power system.

[0081] In this embodiment, when an access request sent by an untrusted object to the power system is obtained in the security buffer, in response to the access instruction corresponding to the access request, the priority of the untrusted object is first determined, and then when it is determined that the priority of the untrusted object is higher, the part of the content of the untrusted object called by the power system to interact with the power system in advance is used to interact with the untrusted object in the security buffer first, so that in the security buffer, it can be determined whether the untrusted object carries out a network attack on the power system based on the interaction process with the untrusted object, and finally, after the reliability of the untrusted object is determined, the untrusted object is connected to the power system. Thus, on the one hand, the interaction efficiency between the untrusted object and the power system is guaranteed, and on the other hand, the security of the power system is improved, that is, the reliability of the untrusted object connected to the power system is guaranteed, the anti-attack capability of the power system is enhanced, the risk of hacker intrusion and destruction is reduced, and sensitive power information is protected.

[0082] In this embodiment, the internal network and external network of the power system are effectively isolated through data access control in the security buffer, and malicious traffic and attacks from the outside are restricted and filtered. This can reduce the possibility of successful attacks and improve the security of the communication network. From a social perspective, it can not only ensure the normal operation and data security of the power system, but also avoid serious consequences such as power system instability, power outages, and data leakage caused by network attacks or other security incidents, thereby ensuring national security and social stability. At the same time, improving the network security protection capabilities of the power system can also enhance the confidence and ability of the power system in the application of digital technology, promote the transformation and upgrading of the power system to digitalization, intelligence, greening, and low carbonization, thereby promoting social and economic development and energy transformation.

[0083] In this embodiment, the buffer data access control method based on trusted access provided by the embodiment of the present invention can provide a more powerful network protection mechanism for key intranet infrastructure such as firewalls, isolation, switches, etc., to protect their normal operation and reliability.

[0084] In this embodiment, through the buffer data access control method based on trusted access provided by the embodiment of the present invention, a secure information exchange and interoperability mechanism can be established, secure communication between devices can be achieved, and the rational use and sharing of data can be promoted, thereby further tapping the value of power data.

[0085] In this embodiment, the buffer data access control method based on trusted access provided by the embodiment of the present invention can formulate corresponding standards and specifications for the industry to guide product design and implementation processes. This can ensure that different manufacturers and organizations take consistent security measures in the open access system and improve the overall digital security level of the entire power industry.

[0086] Further, based on the content of the above embodiment, after determining the priority of the untrusted object in response to the access instruction, the method further includes:

[0087] If the priority of the untrusted object does not reach the preset level, interact with the untrusted object based on preset content adapted to the untrusted object; wherein the preset content is content summarized based on historical interaction data of untrusted objects of the same type as the untrusted object;

[0088] Determine whether there are security risks in the interaction process with untrusted objects;

[0089] If it is determined that there is no security risk, the untrusted object is connected to the power system and the interaction process is restarted.

[0090] In the present embodiment, when it is determined that the priority of the untrusted object has not reached the preset level, that is, when the untrusted object has a low requirement for the interaction efficiency, the untrusted object is interacted with through preset content summarized based on historical interaction data of untrusted objects of the same type as the untrusted object, and through a technology similar to a honeypot, the interaction process between the untrusted object and the power system is obtained without actually interacting with the power system. This makes it convenient to use the interaction process to determine whether the untrusted object is reliable, and on the other hand, avoids the untrusted object from obtaining real data of the power system, thereby further ensuring the security of the power system.

[0091] Based on the content of the above embodiment, interacting with an untrusted object includes:

[0092] Extract features of access instructions to obtain input content of untrusted objects;

[0093] Make multiple copies of the input content;

[0094] Distribute multiple copies of input content to a corresponding number of randomly pre-selected isomers for processing;

[0095] Obtaining processing results of each isomer;

[0096] The voting device votes on each processing result to determine a unique processing result as a response corresponding to the input content.

[0097] In this embodiment, by extracting features from access instructions, the input content of the untrusted object is copied into multiple copies, which are then distributed to a corresponding number of randomly pre-selected heterogeneous bodies for processing. Finally, the initial and final results are determined based on the voter, so that multiple heterogeneous redundant bodies process the same task. When the untrusted object attacks the power system in real time, it increases the difficulty for the attacker to crack the data and access it. Compared with the traditional access authentication system, the defense capability against known vulnerabilities is greatly improved, and the security of the data is effectively protected.

[0098] Furthermore, by randomly selecting mutually independent isomers, the ability of attackers to determine the real target is effectively reduced, thereby reducing the risk of system attacks, increasing the attacker's attack cost, and effectively protecting the confidentiality and integrity of external access.

[0099] It is understandable that the types of devices in the heterogeneous should be as many as possible to ensure heterogeneity in various properties or characteristics and avoid the simultaneous appearance of the same vulnerabilities. The more levels of heterogeneity, that is, the more heterogeneous properties of the heterogeneous, the more vulnerabilities that can be defended, and the higher the difficulty of attack.

[0100] In some optional embodiments, heterogeneity can be achieved based on diversity. The heterogeneity of devices, the diversity of applications, the diversity of operating systems, the diversity of programming languages, etc. can all bring about certain heterogeneity.

[0101] Specifically, in terms of implementation methods, heterogeneous implementation methods can be divided into coding heterogeneity, software heterogeneity, hardware heterogeneity, software-hardware collaborative heterogeneity, and hybrid heterogeneity. Coding heterogeneity method, heterogeneity is achieved by using different data encodings. For example: the mimetic storage can split the file into blocks, and use a variety of erasure codes to achieve heterogeneity of storage encoding. Software heterogeneity and hardware heterogeneity methods, software heterogeneity and hardware heterogeneity are achieved through various means. For example: the mimetic honeypot achieves heterogeneity at the software level by setting heterogeneity at the two software levels of Web middleware and operating system. The mimetic Web threat perception model can introduce script mimetic transformation technology on the basis of Web application firewall (WAF) to achieve heterogeneity of application scripts. In addition, M-DNS uses different DNS software to achieve heterogeneity of DNS server. Software-hardware collaborative heterogeneity method, heterogeneity is achieved by combining different software and hardware components. For example: the mimetic switch uses heterogeneous {CPU+OS} hardware modules, and generates heterogeneous protocol stacks and management software families through diversified compilation, thereby achieving heterogeneity of software-hardware collaboration. The hybrid heterogeneous approach achieves multi-dimensional hybrid heterogeneity by using heterogeneous network components and heterogeneous network switching. For example, the mimetic cloud data center not only deploys mimetic components, but also introduces strategies such as mimetic storage, mimetic cloud management, and heterogeneous network switching to achieve multi-dimensional hybrid heterogeneity.

[0102] Furthermore, in this embodiment, the random preselection of isomers can be realized by a dynamic selection algorithm, that is, the dynamic selection algorithm makes the dynamic heterogeneous redundant structure dynamic. As a gain of heterogeneity in the time dimension, dynamicity can remedy the problem of insufficient heterogeneity caused by "homology". At the same time, the existence of dynamicity makes the security buffer show different characteristics in different time periods, presenting uncertainty to attackers, further increasing the difficulty of attack.

[0103] Furthermore, if the current isomer is breached by an attack, the dynamic selection algorithm can regenerate and replace the current isomer after receiving feedback, thereby changing the environment on which the attack depends, making it difficult to maintain or reproduce the same attack.

[0104] In this embodiment, by making multiple isomers process the same input content, and then using the voting device to vote on the processing results of each isomer, the processing results of different isomers can be compared, so that relatively correct responses can be returned to the user. That is, through the cooperation of redundancy and heterogeneity, the single environment that the attack relies on is changed, the attack difficulty is increased, and the security of the system is improved.

[0105] It should be noted that, in the specific implementation, the number of heterogeneous bodies that execute the same input content should be at least two in order to maintain the characteristics of heterogeneous redundancy. However, when the processing results of the two executors are inconsistent, it is impossible to determine a relatively correct result. 3-module redundancy is the minimum number of executors required by the majority voting algorithm and is also a common redundancy method. As the number of executors increases, the voting strategy also needs to be adaptively changed to obtain a unique and relatively correct result. The number of heterogeneous executors is not positively correlated with the correctness of the voting results. On the contrary, when the number of voting executors is large, the attacked executor may dominate. At the same time, the increase in the number of executors in the cluster will lead to an increase in cost and an increase in the complexity of the voting algorithm, so 3-module redundancy is more practical.

[0106] It is understandable that the reference of isomers makes the system representation of the security buffer uncertain, which ensures the security of the system. However, although the use of multiple isomers improves the security of the system, it also increases the redundancy of the system, consumes a certain amount of system performance, and reduces the stability of the system. Therefore, compared with random pre-selection of isomers, the use of appropriate scheduling strategies is easier to reduce the redundancy of the system and improve the system performance.

[0107] Based on this, in some optional embodiments, a heterogeneous scheduling method based on system benefits and output differences is provided, wherein the system benefits represent the security gain and performance overhead of the system. The method takes into account the system's quality of service and switching overhead, models the two, defines them as a dual-objective optimization problem, and then uses a particle swarm algorithm to solve them, obtains the optimal value of the optimization problem, and obtains the final heterogeneous scheduling strategy.

[0108] Specifically, when selecting the execution scheduling strategy, the system efficiency needs to be as high as possible. From the definition, it can be seen that the system efficiency is proportional to the service quality Q and the switching cost C switch So the objective function after modeling the quality of service and switching overhead is:

[0109]

[0110] Among them, Benefits is the system benefit. γ and δ are coefficients, which are adjusted by historical experience. Among them, γ can reflect the sensitivity of the system. The smaller its value, the higher the frequency of the system switching scheduling scheme, the higher the system security, but the lower the stability. δ can reflect the maximum turbulence of a single adjustment. The larger its value, the fewer isomers the system switches in a short period of time, and the higher the system stability.

[0111] After obtaining the objective function, the particle swarm (PSO) algorithm is used to determine the feasible solution space of the problem for rapid search, find the optimal value of the dual-objective optimization problem, and obtain the final scheduling strategy. According to the basic PSO algorithm formula, we can get:

[0112]

[0113] Among them, V i is the velocity of particle i, X i is the position of particle i, c1, c2 are acceleration numbers, constant and equal to 2, r1, r2 are pseudo-random numbers, r1, r2∈[0,1], P best,i is the most suitable position for particle i in history, P global,i is the optimal position of all particles, ω is the inertia weight, generally set to [0,1], which balances the search ability of particles globally or locally. Setting a higher ω will promote global search, and a lower ω will promote fast local search.

[0114] By uniformly scheduling heterogeneous entities based on the above scheduling strategy, the input content can be dynamically assigned to the best heterogeneous entity for processing according to the actual resource usage. Then, by coordinating with the joint voting mechanism of multiple servers, several heterogeneous entities can be dynamically selected for joint decision making, which effectively reduces the misjudgment rate. While pursuing the maximization of the overall security of the system, the service quality of the system is also improved as much as possible, that is, the security and resource utilization of the system are improved at the same time.

[0115] Based on the content of the above embodiment, voting is performed on each processing result based on a voting device to determine a unique processing result, including:

[0116] Based on the low-level voter, the processing results of each isomer are voted. The level of the voter is determined based on the performance indicators, historical processing capabilities and credibility of the voter;

[0117] The voting results of the lower-level voting machines are sent to the upper-level voting machines of the lower-level voting machines, so that the upper-level voting machines can vote on the processing results of each isomer in combination with the voting results of the lower-level voting machines;

[0118] Repeat the steps of sending the voting results of the upper-level voting machine to the upper-level voting machine of the upper-level voting machine, so that the upper-level voting machine combines the voting results of the upper-level voting machine to vote on the processing results of each isomer, until the voting results are sent to the highest-level voting machine;

[0119] The voting result of the highest-level voter is used as the only processing result.

[0120] In this embodiment, the voters are divided into different levels according to performance indicators, historical processing capabilities, and credibility, and then the voters at the lower level vote on the processing results of each isomer, and then send the voting results to the voters at the upper level, that is, the voting results of each level are passed to the voters at the next level for further voting or merging. Finally, the final joint voting results are obtained by the voters at the highest level, thereby improving the accuracy of the determined processing results.

[0121] Specifically, by using a voting hierarchy, the speed of decision-making can be accelerated and unnecessary communication overhead can be reduced. However, the voting process may introduce a certain voting delay. Since it involves communication and coordination between multiple voting servers, voting delay is unavoidable. Therefore, when designing a voting strategy, it is necessary to weigh the relationship between voting delay and decision accuracy. That is, strive to reduce voting delay and ensure that the final decision result is obtained within a given time limit.

[0122] In some possible embodiments, in order to reduce voting delay, an asynchronous voting mechanism can be used, that is, different voting servers are allowed to vote at different times and communicate with each other as needed to reach a consensus. In addition, communication overhead and transmission delay can be reduced by optimizing network communication and message transmission mechanisms.

[0123] Based on the content of the above embodiment, determining whether there is a security risk in the interaction process with the untrusted object includes:

[0124] Extract network traffic or behavior during interaction;

[0125] Match network traffic or behavior with preset rules, which are pre-stored knowledge rules of network attack events;

[0126] If the network traffic or behavior does not match the preset rules, it is determined that the interaction process with the untrusted object has a security risk; and

[0127] Determine whether there are features and / or signatures of known attacks during the interaction, where the known attacks are obtained by summarizing features and / or signatures of historical attacks;

[0128] If there are features and / or signatures of known attacks in the interaction process, it is determined that there is a security risk in the interaction process with the untrusted object.

[0129] Specifically, by extracting network traffic or behavior during the interaction process and then matching the network traffic or behavior with preset rules, potential malicious traffic, such as network attacks, malware, or abnormal behavior, can be identified. In other words, it is determined whether there is a security risk in the interaction process with untrusted objects. This method is simple and easy to implement, and as the knowledge rules of pre-stored network attack events are continuously enriched, the reliability of detection can be continuously improved.

[0130] In some possible embodiments, in view of the high dimensionality of traffic features, large data volume, and small sample data, a bidirectional adversarial generative network (BIGAN) model can be used to monitor and identify abnormal behaviors by analyzing network traffic features and patterns. The BIGAN model combines generative and discriminative models and uses an encoder network to learn the potential representation of traffic data. By comparing the differences between real-time traffic and normal behavior models, abnormal activities in the network can be discovered efficiently and accurately, providing effective network security protection for large data sets and real-time applications.

[0131] In some possible embodiments, a clustering algorithm is used to distinguish normal behavior from abnormal behavior in massive log data. Then, an association rule mining algorithm is used to mine the normal behavior data for frequent sets and establish a normal behavior rule library. In the detection phase, the behavior pattern of the data to be tested is compared and matched with the known models in the normal behavior rule library to determine whether the currently detected data is a normal pattern or an unknown pattern. If the match is successful within a certain error range, it is determined to be normal behavior; otherwise, it is an unknown pattern and can be directly determined to be abnormal.

[0132] By determining whether there are features and / or signatures of known attacks in the interaction process, and then determining that there are security risks in the interaction process with untrusted objects when there are features and / or signatures of known attacks in the interaction process, this is also simple and easy to implement, and as the features and / or signatures of known attacks are continuously enriched, the reliability of detection can also be continuously improved.

[0133] It is understandable that the above two detection methods cannot identify unknown attacks, and therefore cannot deal with new attack variants. However, taking the advanced persistent threat attacks with long-term spatial and temporal discrete distribution as an example, such attacks usually use customized attack methods and avoid using known features, so they are difficult to identify. This leads to a low detection probability based on the network abnormal behavior analysis method, and attackers can lurk in the network for a long time without being detected. Moreover, these attacks are usually multi-step and may span multiple systems or network areas. When focusing only on a single event or a single point of anomaly, it is difficult to identify the full picture of the attack chain, so it is impossible to effectively identify and defend against such attacks.

[0134] Based on this, in an optional embodiment, if it is determined that there is no security risk, after the untrusted object is connected to the power system, the method further includes:

[0135] Each event of interaction between an untrusted object and the power system after being connected is recorded as a basic node;

[0136] Determine whether the basic node is a leaf node of a preset threat tree. The preset threat tree has a tree structure with the node of the event with security risk as the end point and the node of each event experienced by the corresponding untrusted object since the interaction process with the power system started, which is reversed from the event with security risk as the leaf node;

[0137] If the basic node is determined to be a leaf node, the determined leaf node is used as the starting node, and the subsequent n events of the interaction between the untrusted object and the power system are continuously determined to determine whether they are leaf nodes connected to the starting node along the direction from the leaf node to the end point on the preset threat tree, where n is a preset integer greater than 0;

[0138] If it is determined that all n events are leaf nodes, it is determined that there is a security risk in the interaction process with the untrusted object.

[0139] In this embodiment, by taking the node of the event with security risk as the end point, and inferring the node of each event experienced by the corresponding untrusted object since the start of the interaction process with the power system from the event with security risk as the leaf node, a preset threat tree is constructed, so that the preset threat tree can aggregate the attack behaviors that adopt multi-steps such as long-time and space discrete events into a complete multi-level tree structure, so as to represent the interdependence between threat behaviors and steps through the tree structure. Afterwards, by recording each event that the trusted object interacts with the power system after being directly connected as a basic node, it is determined whether the basic node is a leaf node of the preset threat tree, and when the basic node is determined to be a leaf node, the determined leaf node is used as the starting node, and the subsequent n events of the interaction between the untrusted object and the power system are continuously determined. Whether it is a leaf node connected to the starting node in the direction from the leaf node to the end point on the preset threat tree, thereby achieving the effect of determining that the interaction process with the untrusted object has a security risk when it is determined that n events are all leaf nodes, that is, the effective detection of the attack behaviors that adopt multi-steps such as long-time and space discrete events is realized, thereby further improving the security of the power system.

[0140] It should be noted that the value of n can be determined through experiments, experience, etc. and is not limited here.

[0141] Based on the content of the above embodiment, the buffer data access control method based on trusted access also includes:

[0142] If it is determined that there is a security risk, the firewall will be triggered in transparent mode to block attacks on untrusted objects;

[0143] Conduct behavioral feature analysis on attack behaviors of untrusted objects;

[0144] If it is determined that the attack behavior of the untrusted object threatens the power system to a preset level, the untrusted object will be included in the blacklist and broadcast.

[0145] Specifically, a firewall protects a network from external attacks by blocking unauthorized access through specific software and hardware.

[0146] In this embodiment, when it is determined that there is a security risk, the firewall is triggered in transparent mode to block attacks on untrusted objects, thereby achieving effective blocking between the internal trusted network and the external untrusted network. By analyzing the behavioral characteristics of the attack behavior of untrusted objects, the knowledge rules, characteristics and signatures for known attacks can be continuously enriched. When the threat of the attack behavior of untrusted objects to the power system reaches a preset level, the untrusted objects are included in the blacklist and broadcast, so that the power system can shield the untrusted objects, thereby suppressing the spread of attack events sent by the untrusted objects, and further improving the security of the power system.

[0147] The following is an introduction to the buffer data access control system based on trusted access provided in an embodiment of the present invention. The buffer data access control system based on trusted access described below can be considered as a module architecture for implementing the buffer data access control method based on trusted access provided in an embodiment of the present invention; the content described below can be cross-referenced with the above.

[0148] Optional, see Figure 2 , Figure 2 : is a structural block diagram of a buffer data access control system based on trusted access provided by an embodiment of the present invention, the system may include:

[0149] A collection unit 10 is used to obtain an access instruction, where the access instruction is an access application sent by an untrusted object to the power system;

[0150] A first determination unit 20, configured to determine a priority of an untrusted object in response to an access instruction;

[0151] A first execution unit 30 is configured to, when the priority of the untrusted object reaches a preset level, cause the power system to call a target content and interact with the untrusted object, wherein the target content is a preset portion of all contents that the untrusted object preliminarily interacts with the power system;

[0152] A second judgment unit 40 is used to determine whether there is a security risk in the interaction process with the untrusted object;

[0153] The second execution unit 50 is configured to connect the untrusted object to the power system when it is determined that there is no security risk.

[0154] Optionally, the first execution unit 30 is further configured to:

[0155] If the priority of the untrusted object does not reach the preset level, interact with the untrusted object based on preset content adapted to the untrusted object; wherein the preset content is content summarized based on historical interaction data of untrusted objects of the same type as the untrusted object;

[0156] Determine whether there are security risks in the interaction process with untrusted objects;

[0157] If it is determined that there is no security risk, the untrusted object is connected to the power system and the interaction process is restarted.

[0158] Optionally, the first execution unit 30 is specifically configured to:

[0159] Extract features of access instructions to obtain input content of untrusted objects;

[0160] Make multiple copies of the input content;

[0161] Distribute multiple copies of input content to a corresponding number of randomly pre-selected isomers for processing;

[0162] Obtaining processing results of each isomer;

[0163] The voting device votes on each processing result to determine a unique processing result as a response corresponding to the input content.

[0164] Optionally, the first execution unit 30 is more specifically configured to:

[0165] Based on the low-level voter, the processing results of each isomer are voted. The level of the voter is determined based on the performance indicators, historical processing capabilities and credibility of the voter;

[0166] The voting results of the lower-level voting machines are sent to the upper-level voting machines of the lower-level voting machines, so that the upper-level voting machines can vote on the processing results of each isomer in combination with the voting results of the lower-level voting machines;

[0167] Repeat the steps of sending the voting results of the upper-level voting machine to the upper-level voting machine of the upper-level voting machine, so that the upper-level voting machine combines the voting results of the upper-level voting machine to vote on the processing results of each isomer, until the voting results are sent to the highest-level voting machine;

[0168] The voting result of the highest-level voter is used as the only processing result.

[0169] Optionally, the second judgment unit 40 is specifically configured to:

[0170] Extract network traffic or behavior during interaction;

[0171] Match network traffic or behavior with preset rules, which are pre-stored knowledge rules of network attack events;

[0172] If the network traffic or behavior does not match the preset rules, it is determined that the interaction process with the untrusted object has a security risk; and

[0173] Determine whether there are features and / or signatures of known attacks during the interaction, where the known attacks are obtained by summarizing features and / or signatures of historical attacks;

[0174] If there are features and / or signatures of known attacks in the interaction process, it is determined that there is a security risk in the interaction process with the untrusted object.

[0175] Optionally, the second execution unit 50 is further configured to:

[0176] Each event of interaction between an untrusted object and the power system after being connected is recorded as a basic node;

[0177] Determine whether the basic node is a leaf node of a preset threat tree. The preset threat tree has a tree structure with the node of the event with security risk as the end point and the node of each event experienced by the corresponding untrusted object since the interaction process with the power system started, which is reversed from the event with security risk as the leaf node;

[0178] If the basic node is determined to be a leaf node, the determined leaf node is used as the starting node, and the subsequent n events of the interaction between the untrusted object and the power system are continuously determined to determine whether they are leaf nodes connected to the starting node along the direction from the leaf node to the end point on the preset threat tree, where n is a preset integer greater than 0;

[0179] If it is determined that all n events are leaf nodes, it is determined that there is a security risk in the interaction process with the untrusted object.

[0180] Optionally, the second execution unit 50 is further configured to:

[0181] If it is determined that there is a security risk, the firewall will be triggered in transparent mode to block attacks on untrusted objects;

[0182] Conduct behavioral feature analysis on attack behaviors of untrusted objects;

[0183] If it is determined that the attack behavior of the untrusted object threatens the power system to a preset level, the untrusted object will be included in the blacklist and broadcast.

[0184] Optionally, an embodiment of the present invention further provides a power system, including a power system body and a buffer data access control system based on trusted access as provided in any of the above embodiments.

[0185] Below, reference Figure 3 To describe the electronic device provided by the embodiment of the present application, the electronic device provided by the embodiment may include: at least one processor 100, at least one communication interface 200, at least one memory 300 and at least one communication bus 400;

[0186] In the embodiment of the present invention, the number of the processor 100, the communication interface 200, the memory 300, and the communication bus 400 is at least one, and the processor 100, the communication interface 200, and the memory 300 communicate with each other through the communication bus 400; obviously, Figure 3 The communication connections shown for the processor 100, the communication interface 200, the memory 300, and the communication bus 400 are merely optional;

[0187] Optionally, the communication interface 200 may be an interface of a communication module, such as an interface of a GSM module; the processor 100 may be a central processing unit CPU, or an application specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present invention.

[0188] The memory 300 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0189] The processor 100 is specifically used to execute the application program in the memory to implement the steps of the above-mentioned crane hoisting wire rope installation control method.

[0190] The above embodiments are merely examples for the purpose of clear explanation, and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived therefrom are still within the scope of protection of the invention.

Claims

1. A buffer data access control method based on trusted access, characterized in that: include: Obtaining an access instruction, where the access instruction is an access application sent by an untrusted object to the power system; In response to the access instruction, determining a priority of the untrusted object; If the priority of the untrusted object reaches a preset level, the power system calls the target content to interact with the untrusted object, where the target content is a preset part of all the contents that the untrusted object interacts with the power system. Determining whether there is a security risk in the interaction process with the untrusted object; If it is determined that the security risk does not exist, connecting the untrusted object to the power system; Record each event of interaction between the untrusted object and the power system after being connected as a basic node; Determine whether the basic node is a leaf node of a preset threat tree, wherein the preset threat tree has a tree structure consisting of a node of an event with the security risk as an end point and a node of each event experienced by the corresponding untrusted object after the interaction process with the power system is started, which is reversed from the event with the security risk as a leaf node; If it is determined that the basic node is the leaf node, the determined leaf node is used as the starting node, and the subsequent n events of the interaction between the untrusted object and the power system are continuously determined, whether they are leaf nodes connected to the starting node along the direction from the leaf node to the end point on the preset threat tree, where n is a preset integer greater than 0; If it is determined that the n events are all the leaf nodes, it is determined that the interaction process with the untrusted object has the security risk; Wherein, interacting with the untrusted object includes: Extracting features of the access instruction to obtain input content of the untrusted object; Copying the input content into multiple copies; distributing a plurality of said input contents to a corresponding number of randomly preselected isomers for processing; Obtaining the processing results of each of the isomers; Voting on the processing results of each of the isomers based on a low-level voter, wherein the level of the voter is determined based on performance indicators, historical processing capabilities, and credibility of the voter; Sending the voting results of the lower-level voter to the upper-level voter of the lower-level voter, so that the upper-level voter votes on the processing results of each of the isomers in combination with the voting results of the lower-level voter; Repeat the step of sending the voting result of the voter at the previous level to the voter at the next level above the voter at the previous level, so that the voter at the next level above votes on the processing result of each of the isomers in combination with the voting result of the voter at the previous level, until the voting result is sent to the voter at the highest level; The voting result of the highest-level voter is used as a response corresponding to the input content.

2. The buffer data access control method based on trusted access according to claim 1, characterized in that: After determining the priority of the untrusted object in response to the access instruction, the method further includes: If the priority of the untrusted object does not reach the preset level, interacting with the untrusted object based on preset content adapted to the untrusted object; wherein the preset content is content summarized based on historical interaction data of untrusted objects of the same type as the untrusted object; Determining whether there is a security risk in the interaction process with the untrusted object; If it is determined that the security risk does not exist, the untrusted object is connected to the power system and the interaction process is restarted.

3. The buffer data access control method based on trusted access according to claim 1 or 2, characterized in that: The determining whether there is a security risk in the interaction process with the untrusted object includes: Extracting network traffic or behavior during the interaction; Matching the network traffic or behavior with a preset rule, wherein the preset rule is a pre-stored knowledge rule of a network attack event; If the network traffic or behavior does not match the preset rule, determining that the interaction process with the untrusted object has the security risk; and Determining whether there are features and / or signatures of known attacks in the interaction process, wherein the known attacks are obtained by summarizing features and / or signatures of historical attacks; If the features and / or signatures of the known attacks exist in the interaction process, it is determined that the interaction process with the untrusted object has the security risk.

4. The buffer data access control method based on trusted access according to claim 1 or 2, characterized in that: Also includes: If it is determined that the security risk exists, triggering the firewall to block attacks on the untrusted object in transparent mode; Performing behavioral feature analysis on the attack behavior of the untrusted object; If it is determined that the attack behavior of the untrusted object threatens the power system to a preset degree, the untrusted object is included in the blacklist and broadcasted.

5. A buffer data access control system based on trusted access, characterized in that: include: A collection unit, used to obtain an access instruction, where the access instruction is an access application sent by an untrusted object to the power system; A first determination unit, configured to determine a priority of the untrusted object in response to the access instruction; A first execution unit, configured to, when the priority of the untrusted object reaches a preset level, cause the power system to call a target content and interact with the untrusted object, wherein the target content is a preset portion of all contents that the untrusted object preliminarily interacts with the power system; A second judgment unit, used to determine whether there is a security risk in the interaction process with the untrusted object; A second execution unit, configured to directly connect the untrusted object to the power system when it is determined that the security risk does not exist; Record each event of interaction between the untrusted object and the power system after being connected as a basic node; Determine whether the basic node is a leaf node of a preset threat tree, wherein the preset threat tree is a tree structure consisting of a node of an event with the security risk as an end point, and nodes of each event experienced by the corresponding untrusted object since the start of the interaction process with the power system are reversed from the event with the security risk as leaf nodes; if the basic node is determined to be the leaf node, then use the determined leaf node as the starting node to continue to determine whether the subsequent n events of the interaction between the untrusted object and the power system are leaf nodes connected to the starting node along the direction from the leaf node to the end point on the preset threat tree, where n is a preset integer greater than 0; if it is determined that the n events are all leaf nodes, then it is determined that the interaction process with the untrusted object has the security risk; Wherein, interacting with the untrusted object includes: Extracting features of the access instruction to obtain input content of the untrusted object; Copying the input content into multiple copies; distributing a plurality of said input contents to a corresponding number of randomly preselected isomers for processing; Obtaining the processing results of each of the isomers; Voting on the processing results of each of the isomers based on a low-level voter, wherein the level of the voter is determined based on performance indicators, historical processing capabilities, and credibility of the voter; Sending the voting results of the lower-level voter to the upper-level voter of the lower-level voter, so that the upper-level voter votes on the processing results of each of the isomers in combination with the voting results of the lower-level voter; Repeat the step of sending the voting result of the voter at the previous level to the voter at the next level above the voter at the previous level, so that the voter at the next level above votes on the processing result of each of the isomers in combination with the voting result of the voter at the previous level, until the voting result is sent to the voter at the highest level; The voting result of the highest-level voter is used as a response corresponding to the input content.

6. A power system, characterized in that: It comprises a power system body and a buffer data access control system based on trusted access as claimed in claim 5.

7. An electronic device, characterized in that: The electronic device comprises: processor; a memory for storing instructions executable by the processor; The processor is used to execute the buffer data access control method based on trusted access as described in any one of claims 1 to 4 above.

Images