Business system access method and device based on zero trust, computer equipment, readable storage medium and program product

Abstract

The invention relates to a service system access method and device based on zero trust, computer equipment, a readable storage medium and a program product. Identity authentication is performed based on attribute information and a digital signature of a terminal, an initial access permission level is determined based on the attribute information and a historical access success rate, traffic behavior detection is performed based on a traffic behavior anomaly detection model and network traffic data of the terminal, and the initial access permission level is adjusted based on a traffic behavior detection result. And indicating the terminal to access the power grid system based on the adjusted access permission level. Compared with a traditional method of accessing the power grid system through an identity label, the method determines the initial access authority level of the terminal accessing the power grid system through the attribute information of the terminal, the digital signature and the historical access success rate, and adjusts the initial access authority level based on the detection result of the traffic behavior anomaly detection model. The verification of the power grid access request of the terminal from multiple angles and multiple levels is realized, and the security of accessing the power grid system is improved.

Description

Technical Field

[0001] The present application relates to the field of power grid security technology, and in particular to a zero-trust-based business system access method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] In the power grid business, there are always massive terminal accesses. Since power grid data is particularly important, the security of its business access needs to be effectively guaranteed. In the existing business access methods, the access security verification method for the power grid business system is usually to determine whether to allow access to the power grid business system after verification based on identity identification. However, when the system access verification is performed through identity identification, once the identity identification is leaked, the power business system can be accessed through the leaked identity identification, resulting in the inability to guarantee the security of the business applications of the power business system, which reduces the access security of the power grid business system.

[0003] Therefore, the current access method to the power grid business system has the defect of low security. Summary of the invention

[0004] Based on this, it is necessary to provide a zero-trust-based business system access method, device, computer equipment, computer-readable storage medium and computer program product that can improve security in response to the above technical problems.

[0005] In a first aspect, the present application provides a business system access method based on zero trust, the method comprising:

[0006] When receiving an authentication request from a terminal for a power grid system to be accessed, obtaining historical access success rate and network traffic data corresponding to the terminal; the authentication request includes attribute information corresponding to the terminal;

[0007] When it is detected that there is preset attribute information in the preset attribute information database that matches the attribute information, obtaining a digital signature corresponding to the terminal and authenticating the digital signature;

[0008] If the digital signature authentication is passed, determining the initial access permission level corresponding to the terminal according to the attribute information and the historical access success rate;

[0009] Inputting the network traffic data into a trained traffic behavior anomaly detection model, and having the traffic behavior anomaly detection model output a corresponding traffic behavior detection result based on the network traffic data;

[0010] The initial access permission level is adjusted according to the flow behavior detection result to obtain an adjusted access permission level, and the terminal is instructed to access the power grid system according to the adjusted access permission level.

[0011] In one of the embodiments, before detecting that there is preset attribute information in the preset attribute information database that matches the attribute information, the method further includes:

[0012] Generate a random number according to the authentication request;

[0013] Encapsulating the random number according to the timestamp to obtain a server identification code, and obtaining corresponding ciphertext information according to the server identification code and the random number;

[0014] generating an authentication vector according to the ciphertext information and a preset message authentication code, and sending the authentication vector to the terminal; the terminal is used to decrypt the authentication vector to obtain a verification code to be verified, and return a comparison result corresponding to the verification code and the preset message authentication code;

[0015] If the comparison result is that the verification code is consistent with the preset message verification code, matching is performed according to the attribute information and each preset attribute information in a preset attribute information database.

[0016] In one embodiment, obtaining a digital signature corresponding to the terminal and authenticating the digital signature includes:

[0017] Sending random challenge information to the terminal; the terminal is used to sign the random challenge information according to the private key, perform hash calculation on the signed random challenge information to obtain a corresponding digital summary, encrypt the digital summary according to the private key, and return the digital signature to be verified;

[0018] Decrypting the digital signature to be verified according to the public key certificate to obtain a decrypted digital signature;

[0019] Obtaining a matching result between the decrypted digital signature and the random challenge information;

[0020] If the matching result is a match, it is determined that the digital signature authentication is successful.

[0021] In one embodiment, determining the initial access permission level corresponding to the terminal according to the attribute information and the historical access success rate includes:

[0022] Determining each historical attribute information corresponding to each historical authentication request according to the historical access success rate;

[0023] Generate a corresponding number of sliding windows according to each of the historical attribute information, and generate a time decay function according to the sliding windows;

[0024] Determine a corresponding weight according to the time of the historical attribute information where the sliding window in the time decay function is located;

[0025] Obtaining a matching result between the attribute information and a preset vulnerability database, and determining a risk value corresponding to the attribute information according to the matching result;

[0026] Determining an initial trust value corresponding to the attribute information according to the time decay function, the weight and the risk value;

[0027] An initial access authority level corresponding to the terminal is determined according to a weighted calculation result of the initial trust value and the historical access success rate.

[0028] In one embodiment, the inputting the network traffic data into a trained traffic behavior anomaly detection model, and the traffic behavior anomaly detection model outputting a corresponding traffic behavior detection result based on the network traffic data, includes:

[0029] Inputting the network traffic data into a trained traffic behavior anomaly detection model, the traffic behavior anomaly detection model performs traffic behavior detection on the network traffic data based on a bidirectional recurrent neural network and a gated recurrent unit to determine whether there is abnormal traffic behavior in the network traffic data;

[0030] According to the detection result of abnormal traffic behavior in the network traffic data, the corresponding traffic behavior detection result is output.

[0031] In one embodiment, adjusting the initial access permission level according to the traffic behavior detection result to obtain the adjusted access permission level includes:

[0032] Obtaining a feature vector corresponding to the traffic behavior detection result;

[0033] Determine the corresponding prior probability according to the feature vector through a Bayesian network;

[0034] Determine a corresponding posterior probability according to the traffic behavior detection result and the prior probability;

[0035] Determine a fuzzy evaluation function according to the posterior probability and the preset weight, input the matching result of the attribute information, the authentication result of the digital signature, the initial access permission level and the traffic behavior detection result into the fuzzy evaluation function, and obtain a security probability index output by the fuzzy evaluation function;

[0036] An adjusted access permission level is determined according to the security probability index and a preset access permission mapping table.

[0037] In a second aspect, the present application provides a business system access device based on zero trust, the device comprising:

[0038] A receiving module, configured to obtain the historical access success rate and network traffic data corresponding to the terminal upon receiving an authentication request from the terminal for the power grid system to be accessed; the authentication request includes attribute information corresponding to the terminal;

[0039] A detection module, configured to obtain a digital signature corresponding to the terminal and authenticate the digital signature when detecting that there is preset attribute information in a preset attribute information database that matches the attribute information;

[0040] a determination module, configured to determine, if the digital signature authentication is passed, an initial access permission level corresponding to the terminal according to the attribute information and the historical access success rate;

[0041] An input module, used for inputting the network traffic data into a trained traffic behavior anomaly detection model, and the traffic behavior anomaly detection model outputs a corresponding traffic behavior detection result based on the network traffic data;

[0042] The access module is used to adjust the initial access permission level according to the flow behavior detection result to obtain an adjusted access permission level, and instruct the terminal to access the power grid system according to the adjusted access permission level.

[0043] In a third aspect, the present application provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0044] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0045] In a fifth aspect, the present application provides a computer program product, including a computer program, which implements the steps of the above method when executed by a processor.

[0046] The above-mentioned zero-trust-based business system access method, device, computer equipment, computer-readable storage medium and computer program product perform identity authentication based on the terminal's attribute information and digital signature, determine the initial access permission level based on the attribute information and historical access success rate, perform traffic behavior detection based on the traffic behavior anomaly detection model and the terminal's network traffic data, adjust the initial access permission level based on the traffic behavior detection result, and instruct the terminal to access the power grid system based on the adjusted access permission level. Compared with the traditional access to the power grid system through identity identification, this solution determines the initial access permission level for the terminal to access the power grid system by using the terminal's attribute information, digital signature and historical access success rate, detects the terminal's network traffic using a trained traffic behavior anomaly detection model, and adjusts the initial access permission level based on the detection result, thereby verifying the terminal's power grid access request from multiple angles and multiple levels, and improving the security of access to the power grid system. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 An application environment diagram of a business system access method based on zero trust in one embodiment;

[0049] Figure 2 A flowchart of a method for accessing a business system based on zero trust in one embodiment;

[0050] Figure 3 A schematic diagram of a process flow of an identity authentication step in an embodiment;

[0051] Figure 4 It is a flowchart of a method for accessing a business system based on zero trust in another embodiment;

[0052] Figure 5 It is a structural block diagram of a business system access device based on zero trust in one embodiment;

[0053] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0055] The zero-trust-based business system access method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal communicates with the server through the network. The data storage system can store data that the server needs to process. The data storage system can be integrated on the server, or it can be placed on the cloud or other network servers. The terminal can send an authentication request for the power grid system to the server, and the server authenticates the terminal based on the authentication request of the terminal to determine whether it is allowed to access the power grid and the scope of the access, and returns the corresponding access permission level to the terminal based on the scope of the terminal's access to the power grid. Among them, the terminal can be but is not limited to various personal computers, laptops, smart phones and tablets. Server 104 can be an independent physical server, or it can be a server cluster or distributed system composed of multiple physical servers, or it can be a cloud server that provides cloud computing services.

[0056] In an exemplary embodiment, Figure 2 As shown, a business system access method based on zero trust is provided, and the method is applied to Figure 1 The server in the example is used to illustrate, including the following steps S202 to S210. Among them:

[0057] Step S202, when receiving an authentication request from a terminal for a power grid system to be accessed, obtaining historical access success rate and network traffic data corresponding to the terminal; the authentication request includes attribute information corresponding to the terminal.

[0058] Among them, the server can be a server that controls the access rights of the power grid system. When the terminal wants to access the business application in the power grid system, it needs to judge the access rights of the terminal through the server. Among them, when the terminal needs to access the power grid system, it can send an authentication request for the power grid system to be accessed to the server. After receiving the above authentication request, the server can obtain the historical access success rate and network traffic data corresponding to the terminal. Among them, the above authentication request can also include attribute information corresponding to the terminal. That is, the terminal can generate an authentication request based on its own attribute information and send it to the server.

[0059] Specifically, the server can read the terminal's attribute information, historical access success rate, and network traffic data through a preset program. The attribute information includes the terminal's hardware information, system configuration information, physical address information, account information, and network address information, etc. The network traffic data is the terminal's business access traffic data, the historical access success rate can be found from the database based on the terminal's identification, and the historical access success rate can be obtained based on the total number of times the terminal accesses the power system business application, the number of unauthorized access attempts, the number of successful accesses, and other access behavior information.

[0060] Step S204: when it is detected that there is preset attribute information in the preset attribute information database that matches the attribute information, a digital signature corresponding to the terminal is obtained and the digital signature is authenticated.

[0061] After receiving the above authentication request, the server can determine whether the terminal meets the access conditions and the access permission level when the terminal is allowed to access. A preset attribute information database can be pre-built in the server. The preset attribute information database stores multiple preset attribute information corresponding to multiple terminals allowed to access the power grid system. The server can match the attribute information of the above terminal with each preset attribute information in the preset attribute information database. If the server detects that there is preset attribute information in the preset attribute information database that matches the attribute information, the server determines that the attribute information authentication of the above terminal is passed.

[0062] After the server verifies the attribute information, it can further obtain the digital signature corresponding to the terminal and authenticate the digital signature. The digital signature can be obtained through random information generated by the server. The server can authenticate the digital signature based on the public key.

[0063] Step S206: If the digital signature authentication is passed, the initial access authority level corresponding to the terminal is determined according to the attribute information and the historical access success rate.

[0064] Among them, after the server authenticates the digital signature, it can determine that the terminal's authentication request has passed and it is a terminal allowed to access the power grid, but the server needs to further determine the scope of the terminal's operation to access the power grid system business. The server can obtain the attribute information and historical access success rate corresponding to the terminal, and determine the initial access permission level corresponding to the terminal based on the above attribute information and historical access success rate. Among them, the historical access success rate indicates the proportion of successful access times to the total number of access times during the terminal's historical access to the power grid system. The above initial access permission level indicates the scope of the terminal allowed to access the power grid system as preliminarily determined by the server. Different access permission levels correspond to different power grid system business access scopes, and the higher the access permission level, the larger the scope of business allowed to be accessed in the power grid system.

[0065] Step S208: input the network traffic data into the trained traffic behavior anomaly detection model, and the traffic behavior anomaly detection model outputs the corresponding traffic behavior detection result based on the network traffic data.

[0066] After the server determines the initial access permission level corresponding to the terminal, it is necessary to dynamically adjust the initial access permission of the terminal in combination with the network traffic data of the terminal to accurately determine the permissions of the terminal. The server can pre-train the traffic behavior anomaly detection model to be trained. The server can input the above network traffic data into the trained traffic behavior anomaly detection model, and the traffic behavior anomaly detection model can detect the traffic behavior of the terminal based on the network traffic data and output the corresponding traffic behavior detection result. The traffic behavior detection result represents the traffic behavior generated during the terminal's access to the power grid system.

[0067] Step S210, adjusting the initial access permission level according to the flow behavior detection result to obtain an adjusted access permission level, and instructing the terminal to access the power grid system according to the adjusted access permission level.

[0068] After the server determines the flow behavior detection result of the terminal based on the above flow behavior anomaly detection model, it can further determine the nature of the flow behavior of the terminal based on the flow behavior detection result, and then dynamically adjust the initial access permission level of the terminal to obtain the adjusted access permission level. Thus, the server can instruct the terminal to access the power grid system according to the adjusted access permission level. For example, the server sends the above access permission level to the terminal, and the terminal accesses the business application corresponding to the access permission level in the power grid system based on the above access permission level.

[0069] In the above-mentioned zero-trust-based business system access method, identity authentication is performed based on the terminal's attribute information and digital signature, the initial access permission level is determined based on the attribute information and historical access success rate, traffic behavior detection is performed based on the traffic behavior anomaly detection model and the terminal's network traffic data, the initial access permission level is adjusted based on the traffic behavior detection result, and the terminal is instructed to access the power grid system based on the adjusted access permission level. Compared with the traditional access to the power grid system through identity identification, this solution determines the initial access permission level for the terminal to access the power grid system by using the terminal's attribute information, digital signature and historical access success rate, detects the terminal's network traffic using the trained traffic behavior anomaly detection model, and adjusts the initial access permission level based on the detection result, thereby verifying the terminal's power grid access request from multiple angles and multiple levels, and improving the security of access to the power grid system.

[0070] In one embodiment, before detecting that there is a match between preset attribute information and attribute information in a preset attribute information database, it also includes: generating a random number according to an authentication request; encapsulating the random number according to a timestamp to obtain a server identification code, and obtaining corresponding ciphertext information according to the server identification code and the random number; generating an authentication vector according to the ciphertext information and a preset message verification code, and sending the authentication vector to a terminal; the terminal is used to decrypt the authentication vector to obtain a verification code to be verified, and return a comparison result corresponding to the verification code and the preset message verification code; if the comparison result is that the verification code is consistent with the preset message verification code, then matching is performed according to the attribute information with each preset attribute information in the preset attribute information database.

[0071] In this embodiment, after obtaining the authentication request of the terminal, the server can verify the authentication request itself. The server can generate a random number according to the above authentication request. The server can encapsulate the random number according to the timestamp to obtain the server identification code corresponding to the server. The server can obtain the corresponding ciphertext information according to the above identification code and the random number. The server can generate an authentication vector according to the above ciphertext information and the preset message verification code, and send the above authentication vector to the terminal. After receiving the above authentication vector, the terminal can decrypt the authentication vector to obtain the verification code to be verified. After the above authentication vector is decrypted, the preset message verification code can also be obtained. The terminal can compare the above verification code with the preset message verification code, and return the comparison result to the server.

[0072] Among them, for different comparison results, the server can adopt different processing methods. If the comparison result is that the verification code is consistent with the preset message verification code, the server can match the attribute information of the terminal, that is, the server can match the above attribute information with each preset attribute information in the preset attribute information database. If the server detects that the above comparison result is inconsistent, the server can determine that the authentication request has not been verified and reject the terminal's request to access the power grid system.

[0073] Specifically, the terminal sends an authentication request for the power system business application to the server based on the terminal's attribute information. The server can generate an authentication vector and send the authentication vector to the terminal. The terminal can decrypt the authentication vector to obtain the verification code to be verified, and compare the verification code with the preset message verification code, and return the comparison result to the server. If the server determines that the two are consistent, the terminal's request authentication is completed. The authentication vector includes ciphertext information and a preset message verification code. The server generates a random number and encapsulates it based on the timestamp to obtain a server identification code. The server can encrypt according to the server identification code and the first random number to obtain the first ciphertext. The terminal can then decrypt the first ciphertext to obtain the verification code. The preset message verification code is a message verification code generated by an algorithm defined in the security structure.

[0074] Through this embodiment, the server can authenticate the authentication request of the terminal based on the random number and the verification code, and then determine whether to continue matching the attribute information of the terminal, thereby improving the security of access to the power grid system.

[0075] In one embodiment, a digital signature corresponding to a terminal is obtained and the digital signature is authenticated, including: sending a random challenge message to the terminal; the terminal is used to sign the random challenge message according to a private key, perform a hash calculation on the signed random challenge message to obtain a corresponding digital summary, encrypt the digital summary according to the private key, and return the digital signature to be verified; the digital signature to be verified is decrypted according to a public key certificate to obtain a decrypted digital signature; a matching result between the decrypted digital signature and the random challenge message is obtained; if the matching result is a match, it is determined that the digital signature authentication is successful.

[0076] In this embodiment, the server can further perform digital signature authentication after successfully matching the attribute information of the terminal. If the server can obtain the digital signature corresponding to the terminal, the server can first send a random challenge message to the terminal. The random challenge message represents information randomly generated by the server based on the authentication request for this identity.

[0077] After receiving the above-mentioned random challenge information, the terminal can sign the random challenge information based on the private key of the terminal, and perform hash calculation on the signed random challenge information to obtain the corresponding digital summary, also known as a digital fingerprint. Thus, the terminal encrypts the digital summary according to the above-mentioned private key to obtain the digital signature to be verified, and the terminal returns the digital signature to be verified to the server. After receiving the digital signature to be verified, the server can decrypt the digital signature to be verified based on the public key certificate to obtain the decrypted digital signature. The server can match the decrypted digital signature with the random challenge information to obtain a corresponding matching result. Among them, for different matching results, the server can perform different processing. For example, if the matching result is not matched, the server can determine that the authentication request for the identity of the above-mentioned terminal is not authenticated, and re-perform the sending and processing process of the above-mentioned random challenge information until the preset number of times. If the match fails before the preset number of times, the server can suspend the authentication request. If the matching result is a match, that is, the digital signature matches the random challenge information, the server can determine that the above-mentioned digital signature authentication is passed.

[0078] Specifically, Figure 3 As shown, Figure 3The figure is a flowchart of an identity authentication step in an embodiment. After receiving the authentication request from the terminal, the server can authenticate the authentication request based on the authentication vector, and after the authentication request is authenticated, it initiates an identity authentication request carrying the terminal attribute message, and performs legal verification on the terminal attribute information. In the information management library, also called the preset attribute information database, it searches for preset attribute information that is the same as the terminal attribute information. The preset attribute information only exists in the information management library, and does not exist in the information management library if it does not belong to the preset attribute information. That is, it determines whether the terminal is in the list of allowed access. If it matches, it means that the terminal attribute information is legal information. When it is determined that the terminal attribute information is legal information, the server sends a random challenge message to the terminal. The random challenge message is information randomly generated by the authentication server based on this identity authentication request.

[0079] The terminal signs the random challenge information with a private key, performs hash calculation on the random challenge information, and obtains a digital summary of the random challenge information, where the digital summary is also called a digital fingerprint. The digital summary is to convert a message of any length into a short message of fixed length. It is similar to a function whose independent variable is the message, that is, a Hash function. The digital summary is asymmetrically encrypted with the private key to obtain the digital signature to be verified. After receiving the above digital signature, the server can obtain the public key certificate from the information management library, and verify the digital signature to be verified through the public key certificate, that is, decrypt the digital signature to be verified through the public key certificate to obtain the decrypted information, and match the decrypted information with the random challenge information. If the match is successful, the terminal's identity authentication is passed. If the match is unsuccessful, the server will re-perform the above process to the preset number of times. If the match fails before the preset number of times, the server will suspend the identity authentication process.

[0080] Through this embodiment, the server can further verify the digital signature of the terminal based on the random challenge information after the attribute information is verified, thereby improving the security of access to the power grid system.

[0081] In one embodiment, an initial access permission level corresponding to a terminal is determined based on attribute information and a historical access success rate, including: determining each historical attribute information corresponding to each historical authentication request based on the historical access success rate; generating a corresponding number of sliding windows based on each historical attribute information, and generating a time decay function based on the sliding windows; determining a corresponding weight based on the time of the historical attribute information where the sliding window is located in the time decay function; obtaining a matching result between the attribute information and a preset vulnerability database, and determining a risk value corresponding to the attribute information based on the matching result; determining an initial trust value corresponding to the attribute information based on the time decay function, the weight and the risk value; and determining an initial access permission level corresponding to the terminal based on a weighted calculation result of the initial trust value and the historical access success rate.

[0082] In this embodiment, the server can determine the initial access permission level corresponding to the terminal based on the attribute information and the historical access success rate. For example, the server can determine the various historical attribute information corresponding to each historical authentication request based on the above historical access success rate. That is, the above historical access success rate can be determined based on the various historical access times and the various historical access success times corresponding to the terminal. The historical attribute information represents the attribute information corresponding to the terminal with successful historical access. The server can generate a corresponding number of sliding windows based on each historical attribute information, and generate a time decay function based on the sliding windows. Among them, the number of sliding windows can correspond to the number of historical attribute information. The server can determine the corresponding weight based on the time of the historical attribute information where the sliding window is located in the above time decay function. Among them, the above weight is inversely proportional to the time where the historical sliding window is located. For example, the closer the time of the sliding window is to the time of the latest request, the greater the weight, and vice versa.

[0083] The server may obtain the matching result of the attribute information and the preset vulnerability database. The preset vulnerability database includes various pre-stored vulnerabilities. The server determines whether there is a vulnerability in the attribute information by matching the attribute information with the various vulnerabilities in the preset vulnerability database, so that the server may determine the risk value of the attribute information according to the matching result. The more vulnerabilities in the preset vulnerability database that match the attribute information, the greater the risk value of the attribute information.

[0084] The server may also determine an initial trust value corresponding to the attribute information based on the above-mentioned time decay function, weight and risk value, and determine an initial access permission level corresponding to the terminal according to a weighted calculation result of the initial trust value and the historical access success rate.

[0085] Specifically, after performing identity authentication based on the authentication request, the server can also determine the initial access permission level based on the attribute information and the access behavior information. The server can calculate the historical access success rate corresponding to the terminal based on the access behavior information. For example, the server divides the number of successful accesses to the power grid system in the access behavior information by the total number of accesses to obtain the historical access success rate. The server can also calculate the initial trust value using a sliding window mechanism based on the above attribute information. Within the sliding window, the weight of the data changes with the distance from the latest authentication request. For example, the closer to the latest authentication request, the greater the weight, and vice versa, until it leaves the window and loses its reference value. The server can also calculate the time decay function, and the calculation expression of the time decay function is: A(i)={(1-(i / (n+1)) k+1 ,k≥0;1-(i / (n+1)) -k+1+a,k<0)}. Wherein, A(i) is the time decay function, n is the number of windows of the sliding window, k is the decay coefficient, a is the decay factor, and i is the time period of the sliding window. The server can calculate the above weight value according to the time decay function, and the calculation expression of the weight value ω is: ω=(A(i)) / (∑_(i=1)^(n-1)(A(i))).

[0086] The server can also detect vulnerability information in the attribute information through the vulnerability information library. The server can pre-build the vulnerability information library, or it can be a preset vulnerability database. Specifically, the server can obtain digital asset information, which includes the communication link information of the terminal and the attribute information of the historical access. The server parses the digital asset information to obtain keyword information, and uses crawler technology to obtain vulnerability information based on the keyword information, so that the server can parse the obtained vulnerability information to obtain vulnerability parsing data. The server can add target tags to the vulnerability information based on the vulnerability parsing data and keyword information, and build a vulnerability information library based on the vulnerability information and the target tags.

[0087] After the server builds the preset vulnerability database, it can determine the scope of vulnerability scanning, and use the vulnerability information library to perform vulnerability scanning on the attribute information of the above-mentioned terminal according to the scope of vulnerability scanning, and obtain the vulnerability information in the attribute information. The vulnerability information library stores the vulnerability information set of the terminal that has been mined, and the vulnerability information set includes the vulnerability hazard level and vulnerability information. The server can assign corresponding weights to each vulnerability information according to the vulnerability hazard level, calculate the risk value corresponding to the attribute information through the vulnerability availability factor, the corresponding weight and the number of vulnerability information in the attribute information, and calculate the initial trust value through the risk value combined with the time decay function and the weight value. The initial trust value can be specifically expressed as: g=1 / (1+e ω×A(i)×s ). Wherein, g is the initial trust value and s is the risk value. The server can also calculate the trust attribute value by using the preset ratio of the historical access success rate and the initial trust value. Wherein, the preset ratio is pre-stored in the database, so that the server can match the corresponding permission level in the permission level database through the trust attribute value as the above-mentioned initial access permission level.

[0088] Through this embodiment, the server can use historical access success rate and attribute information to determine the initial access permission level of the terminal, and then the server can dynamically adjust based on the initial access permission level to obtain the corresponding access permission level, so that the terminal can access the power grid system based on the access permission level, thereby improving the security of access to the power grid system.

[0089] In one embodiment, network traffic data is input into a trained traffic behavior anomaly detection model, and the traffic behavior anomaly detection model outputs corresponding traffic behavior detection results based on the network traffic data, including: inputting network traffic data into a trained traffic behavior anomaly detection model, and the traffic behavior anomaly detection model performs traffic behavior detection on the network traffic data based on a bidirectional recurrent neural network and a gated recurrent unit to determine whether there is abnormal traffic behavior in the network traffic data; and outputting corresponding traffic behavior detection results based on the detection results of the abnormal traffic behavior in the network traffic data.

[0090] In this embodiment, the server may pre-iteratively train the traffic behavior anomaly detection model to be trained based on the network traffic data samples to obtain a trained traffic behavior anomaly detection model. Thus, the server may detect the network traffic data based on the traffic behavior anomaly detection model. Among them, the traffic behavior anomaly detection model may be composed of a bidirectional recurrent neural network and a gated recurrent unit. The server may input the network traffic data into the trained traffic behavior anomaly detection model, and the traffic behavior anomaly detection model may perform traffic behavior detection on the network traffic data based on the bidirectional recurrent neural network and the gated recurrent unit to determine whether there is abnormal traffic behavior in the network traffic data. Thus, the traffic behavior anomaly detection model may output the corresponding traffic behavior detection result based on the detection result of the abnormal traffic behavior in the network traffic data.

[0091] Specifically, the traffic behavior anomaly detection model is composed of a bidirectional recurrent neural network and a gated recurrent unit. The bidirectional recurrent neural network includes a forward sequence network and a backward sequence network. The forward sequence network includes an input layer, a forward hidden layer and an output layer. The forward hidden layer contains a number of forward hidden units. The forward hidden unit is used for the bidirectional recurrent neural network to process information or data from forward to backward. The backward sequence network includes an input layer, a backward hidden layer and an output layer. The backward hidden layer contains a number of reverse hidden units, which are used for the bidirectional recurrent neural network to process information or data from backward to forward. The bidirectional recurrent neural network uses forward and backward directions to process data features, and can obtain context information more comprehensively. The gated recurrent unit includes an input gate, a reset gate, an update gate and an output gate. The reset gate is used to filter out useless feature information, and the update gate is used to control the amount of information that can be retained by the input feature information. Linear self-update is directly performed through the reset gate and the update gate, that is, information iteration of the gated recurrent unit is performed: Among them, the reset gate: can be specifically expressed as r t =σ(W r ·[h t-1 ,x t ]). Where r t is the reset gate at time step t, W r is the weight matrix of the reset gate. h t-1is the hidden state of the previous time step and the input x of the current time step t σ usually refers to the logistic function Sigmoid, which compresses the input to between 0 and 1 and is used to indicate the degree of opening of the door.

[0092] The update gate can be specifically expressed as: t =σ(W z ·[h t-1 ,x t ]). Where z t represents the update gate at time step t, W z represents the weight matrix of the update gate. The hidden unit can be specifically expressed as: h t =tanh(W h ·[h t-1 ·r t ,x t ]). Where W h represents the weight matrix of the hidden unit, h t-1 t represents the element-by-element product of the hidden state of the previous time step and the reset gate, represents the state before reset, and tanh is the hyperbolic tangent function, which is usually used for nonlinear transformation.

[0093] The hidden state can be specifically expressed as: h t =(1-z t )·h t-1 +z t ·h t ' . where h t represents the final hidden state at time step t, 1-z t represents the complement of the update gate, which is used to control the transition from the previous state h t-1 How much information to keep. t ' Represents the state after the hidden unit is processed by the tanh function. The input gate can be specifically expressed as: i t =σ(w i [h t-1 ,x t ]+b i );c˜ t =tanh(w c [h t-1 ,x t ]+b c ). Among them, i t is the input gate at time step t, w c represents the weight matrix of the input gate, b c represents the bias term of the input gate, c˜ t represents the candidate cell at time step t, which is the candidate value of the cell state.

[0094] The server can preprocess the network traffic data, which includes traffic cleaning and traffic normalization. Traffic cleaning removes the characteristic lines in the header of the traffic file, converts the text into numerical values ​​and deletes useless data lines, retaining only the data required for access traffic detection. Traffic normalization normalizes the traffic characteristic data within the set range of characteristic values, and then generates the final traffic data and integrates it to form a traffic data set. The above-mentioned traffic behavior anomaly detection model can also include a multilayer perceptron, which is a feedforward neural network model. The multilayer perceptron includes multilayer linear classifiers, which are formed by stacking several layers of linear classifiers. Each layer of linear classifiers has a linear activation function, and each layer of linear classifiers is composed of a support vector machine model and a binary tree structure. The kernel function of the support vector machine model uses a radial basis function. The penalty parameter and kernel function of the support vector machine model are optimized using a cross-validation method. The model composed of a bidirectional gated recurrent unit network and a multilayer perceptron has a stronger feature extraction capability. The server can train the initial traffic behavior anomaly detection model composed of a bidirectional recurrent neural network and a gated recurrent unit to obtain a trained traffic behavior anomaly detection model, so that the server can input the traffic data set into the trained traffic behavior anomaly detection model. The traffic behavior anomaly detection model determines whether the terminal has an access traffic anomaly based on the network traffic data in the traffic data set. If there is an anomaly, the server obtains the traffic behavior detection result generated based on the anomaly threshold through the traffic behavior anomaly detection model.

[0095] Through this embodiment, the server can perform traffic behavior detection on the terminal's network traffic data based on the traffic behavior anomaly detection model to determine whether the terminal has abnormal traffic behavior, and then determine the terminal's access permission level based on the traffic behavior detection results, thereby improving the security of access to the power grid system.

[0096] In one embodiment, the initial access permission level is adjusted according to the traffic behavior detection result to obtain the adjusted access permission level, including: obtaining a feature vector corresponding to the traffic behavior detection result; determining the corresponding prior probability according to the feature vector through a Bayesian network; determining the corresponding posterior probability according to the traffic behavior detection result and the prior probability; determining a fuzzy evaluation function according to the posterior probability and a preset weight, inputting the matching result of the attribute information, the authentication result of the digital signature, the initial access permission level and the traffic behavior detection result into the fuzzy evaluation function, and obtaining a security probability index output by the fuzzy evaluation function; and determining the adjusted access permission level according to the security probability index and a preset access permission mapping table.

[0097] In this embodiment, the server can dynamically adjust the initial access permission level of the terminal based on the traffic behavior detection result to determine the final access permission level. The server can extract the feature vector corresponding to the above traffic behavior detection result. The server pre-constructs a Bayesian network, and determines the corresponding prior probability by using the feature vector through the Bayesian network, so that the server can adjust the prior probability according to the traffic behavior detection result and the prior probability to obtain the corresponding posterior probability. The server can determine the fuzzy evaluation function according to the posterior probability and the preset weight, and input the matching result of the attribute information, the authentication result of the digital signature, the initial access permission level and the traffic behavior detection result into the fuzzy evaluation function, obtain the security probability index output by the fuzzy evaluation function, and determine the adjusted access permission level according to the security probability index and the preset access permission mapping table. The preset access permission mapping table pre-stores the mapping relationship between each security probability index and each access permission level. The higher the security probability index, the higher the corresponding access permission level.

[0098] Specifically, the server can perform security assessment based on the Bayesian network using the identity authentication results, permission levels, and traffic behavior detection results, dynamically adjust and update the initial access permission level according to the security assessment results, and control the access of the terminal to the power business system based on the dynamically adjusted and updated access permission level. Among them, the server can build a Bayesian network in the Bayesian controller to unify the format of the target data. The target data is the domain knowledge in the access behavior management. The server obtains nodes with labeled attribute values ​​according to the target data after the format is unified, sorts the nodes according to the domain knowledge, and obtains a logical sequence. Therefore, the server can build a blog model through dependent statements and numerical statements in the database. Among them, the blog model defines the probability distribution of the model structure of a specific type of first-order logic language, which is a probability model used to describe unknown objects.

[0099] The server uses the highest ranked node in the logical sequence as the root node, and the types and functors in the blog model as parent nodes to verify the independence of the nodes in the logical sequence. The independence verification can use the chi-square verification method, extract nodes without child nodes as leaf nodes based on the independence test results, and construct a Bayesian network based on the root node, parent node and leaf node, which can be specifically expressed as: P(A|B)=(P(B|A)P(A)) / P(B).

[0100] Therefore, the server can obtain the prior probability according to the access behavior information based on the Bayesian network. Given two events A and B, the probability of each category occurring after prior knowledge is usually expressed as P(A|B). The server can extract the feature vector according to the access behavior information in the traffic behavior detection result, obtain the prior probability according to the parameters of the Bayesian network and the feature vector, and correct the prior probability according to the access behavior information to obtain the posterior probability, which can be specifically expressed as: P(A|B)=(P(B|A)P(A)) / P(B).

[0101] The server can construct a fuzzy evaluation function based on the posterior probability combined with the determined comprehensive weight. The comprehensive weight, also known as the preset weight, can be obtained in the database. The server inputs the identity authentication result, the initial access permission level and the traffic behavior detection result into the fuzzy evaluation function to obtain the corresponding security probability index, so that the server can determine the dynamically adjusted and updated access permission level based on the mapping relationship between the security probability index and the access permission level. The server can perform access control on the terminal access to the power business system or business application based on the corresponding access permission level, and then determine the allowed and unallowed operation behaviors after the terminal device accesses the power business system or business application.

[0102] There may be multiple terminals requesting access to the power grid system. The server may set a different identifier for each terminal, and then after request authentication and access permission level determination for each terminal, the following information may be obtained:

[0103]

[0104] Among them, the higher the final access permission level, the wider the scope of business applications that the terminal can access in the power grid system.

[0105] Through this embodiment, the server can adjust the initial access permission level of the terminal based on the prior probability and posterior probability of the Bayesian network and the traffic behavior detection results, and then the terminal accesses the power grid system based on the adjusted access permission level, thereby improving the security of access to the power grid system.

[0106] In an exemplary embodiment, Figure 4 As shown, Figure 4 The figure is a flowchart of a method for accessing a business system based on zero trust in another embodiment. In this embodiment, the server can obtain the attribute information, network traffic data and access behavior information corresponding to the terminal, and first authenticate the authentication request through the authentication vector, and then perform identity authentication based on the attribute information of the terminal using a random challenge authentication strategy, which provides double protection for identity authentication and improves the reliability of identity authentication.

[0107] When identity authentication is passed, the server can also calculate the historical access success rate based on the access behavior information, detect attribute information through the vulnerability information library and then calculate the risk value, determine the initial access permission level through the risk value and the historical access success rate, ensure the accuracy and reliability of the determined initial access permission level, and avoid the need to significantly adjust the initial permission level later. The server can use network traffic data to detect behavioral anomalies in the traffic through a traffic behavior anomaly detection model composed of a bidirectional recurrent neural network and a gated recurrent unit, so that the server also considers the network traffic data in the trust evaluation of the terminal, further improving the reliability of the trust evaluation of the terminal.

[0108] Finally, the server can dynamically adjust and update the permission level based on the security assessment results generated by the Bayesian network using the identity authentication results, permission level and traffic behavior detection results, so that the final permission level is more accurate and reliable. For example, after the server builds the Bayesian network, it calculates the prior probability, and obtains the posterior probability through correction, builds a fuzzy evaluation function, and dynamically adjusts the initial access permission level based on the security probability index output by the fuzzy evaluation function. In this way, the server can better control the access of terminals to the business system according to the access permission level, improve the security of the access system, and avoid threats to the system.

[0109] Through the above embodiments, the server determines the initial access permission level of the terminal to access the power grid system by using the terminal's attribute information, digital signature and historical access success rate, detects the terminal's network traffic using the trained traffic behavior anomaly detection model, and adjusts the initial access permission level based on the detection results, thereby verifying the terminal's power grid access request from multiple angles and multiple levels, thereby improving the security of access to the power grid system. It also solves the current problem of low reliability and security of identity authentication using only identity identifiers, and also solves the problem of incomplete security assessment of terminal access to the system, resulting in unreliable permission levels.

[0110] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0111] Based on the same inventive concept, the embodiment of the present application also provides a zero-trust-based business system access device for implementing the zero-trust-based business system access method involved above. The implementation solution provided by the device to solve the problem is similar to the implementation solution recorded in the above method, so the specific limitations in one or more zero-trust-based business system access device embodiments provided below can refer to the limitations of the zero-trust-based business system access method above, and will not be repeated here.

[0112] In an exemplary embodiment, Figure 5 As shown, a business system access device based on zero trust is provided, including: a receiving module 500, a detection module 502, a determination module 504, an input module 506 and an access module 508, wherein:

[0113] The receiving module 500 is used to obtain the historical access success rate and network flow data corresponding to the terminal when receiving the authentication request of the terminal for the power grid system to be accessed; the authentication request includes the attribute information corresponding to the terminal.

[0114] The detection module 502 is used to obtain a digital signature corresponding to the terminal and authenticate the digital signature when it is detected that the preset attribute information in the preset attribute information database matches the attribute information.

[0115] The determination module 504 is used to determine the initial access authority level corresponding to the terminal according to the attribute information and the historical access success rate if the digital signature authentication is passed.

[0116] The input module 506 is used to input the network traffic data into the trained traffic behavior anomaly detection model, and the traffic behavior anomaly detection model outputs the corresponding traffic behavior detection result based on the network traffic data.

[0117] The access module 508 is used to adjust the initial access permission level according to the flow behavior detection result, obtain the adjusted access permission level, and instruct the terminal to access the power grid system according to the adjusted access permission level.

[0118] In one embodiment, the above-mentioned device also includes an authentication module, which is used to generate a random number according to an authentication request; encapsulate the random number according to the timestamp to obtain a server identification code, and obtain the corresponding ciphertext information according to the server identification code and the random number; generate an authentication vector according to the ciphertext information and a preset message verification code, and send the authentication vector to the terminal; the terminal is used to decrypt the authentication vector to obtain a verification code to be verified, and return a comparison result corresponding to the verification code and the preset message verification code; if the comparison result is that the verification code is consistent with the preset message verification code, match it with each preset attribute information in the preset attribute information database according to the attribute information.

[0119] In one embodiment, the detection module 502 is used to send random challenge information to the terminal; the terminal is used to sign the random challenge information according to the private key, perform hash calculation on the signed random challenge information to obtain the corresponding digital summary, encrypt the digital summary according to the private key, and return the digital signature to be verified; decrypt the digital signature to be verified according to the public key certificate to obtain the decrypted digital signature; obtain the matching result between the decrypted digital signature and the random challenge information; if the matching result is a match, it is determined that the digital signature authentication is passed.

[0120] In one embodiment, the above-mentioned determination module 504 is used to determine each historical attribute information corresponding to each historical authentication request according to the historical access success rate; generate a corresponding number of sliding windows according to each historical attribute information, and generate a time decay function according to the sliding window; determine the corresponding weight according to the time of the historical attribute information where the sliding window is located in the time decay function; obtain the matching result of the attribute information and the preset vulnerability database, and determine the risk value corresponding to the attribute information according to the matching result; determine the initial trust value corresponding to the attribute information according to the time decay function, the weight and the risk value; determine the initial access permission level corresponding to the terminal according to the weighted calculation result of the initial trust value and the historical access success rate.

[0121] In one embodiment, the above-mentioned input module 506 is used to input the network traffic data into a trained traffic behavior anomaly detection model, and the traffic behavior anomaly detection model performs traffic behavior detection on the network traffic data based on a bidirectional recurrent neural network and a gated recurrent unit to determine whether there is abnormal traffic behavior in the network traffic data; based on the detection result of the abnormal traffic behavior in the network traffic data, the corresponding traffic behavior detection result is output.

[0122] In one embodiment, the access module 508 is used to obtain a feature vector corresponding to a traffic behavior detection result; determine a corresponding prior probability according to the feature vector through a Bayesian network; determine a corresponding posterior probability according to the traffic behavior detection result and the prior probability; determine a fuzzy evaluation function according to the posterior probability and a preset weight, input the matching result of the attribute information, the authentication result of the digital signature, the initial access permission level and the traffic behavior detection result into the fuzzy evaluation function, and obtain a security probability index output by the fuzzy evaluation function; determine the adjusted access permission level according to the security probability index and the preset access permission mapping table.

[0123] Each module in the above-mentioned zero-trust-based business system access device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0124] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 6 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store the attribute data of the terminal. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a business system access method based on zero trust is implemented.

[0125] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0126] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the above-mentioned zero-trust-based business system access method when executing the computer program.

[0127] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned zero-trust-based business system access method is implemented.

[0128] In one embodiment, a computer program product is provided, including a computer program, which implements the above-mentioned zero-trust-based business system access method when executed by a processor.

[0129] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0130] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0131] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0132] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A business system access method based on zero trust, characterized in that: The method comprises: When receiving an authentication request from a terminal for a power grid system to be accessed, obtaining historical access success rate and network traffic data corresponding to the terminal; the authentication request includes attribute information corresponding to the terminal; When it is detected that there is preset attribute information in the preset attribute information database that matches the attribute information, obtaining a digital signature corresponding to the terminal and authenticating the digital signature; If the digital signature authentication is passed, determining the initial access permission level corresponding to the terminal according to the attribute information and the historical access success rate; Inputting the network traffic data into a trained traffic behavior anomaly detection model, and having the traffic behavior anomaly detection model output a corresponding traffic behavior detection result based on the network traffic data; The initial access permission level is adjusted according to the flow behavior detection result to obtain an adjusted access permission level, and the terminal is instructed to access the power grid system according to the adjusted access permission level.

2. The method according to claim 1, characterized in that Before detecting that preset attribute information in the preset attribute information database matches the attribute information, the method further includes: Generate a random number according to the authentication request; Encapsulating the random number according to the timestamp to obtain a server identification code, and obtaining corresponding ciphertext information according to the server identification code and the random number; generating an authentication vector according to the ciphertext information and a preset message authentication code, and sending the authentication vector to the terminal; the terminal is used to decrypt the authentication vector to obtain a verification code to be verified, and return a comparison result corresponding to the verification code and the preset message authentication code; If the comparison result is that the verification code is consistent with the preset message verification code, matching is performed based on the attribute information and each preset attribute information in a preset attribute information database.

3. The method according to claim 1, characterized in that The obtaining of the digital signature corresponding to the terminal and authenticating the digital signature includes: Sending random challenge information to the terminal; the terminal is used to sign the random challenge information according to the private key, perform hash calculation on the signed random challenge information to obtain a corresponding digital summary, encrypt the digital summary according to the private key, and return the digital signature to be verified; Decrypting the digital signature to be verified according to the public key certificate to obtain a decrypted digital signature; Obtaining a matching result between the decrypted digital signature and the random challenge information; If the matching result is a match, it is determined that the digital signature authentication is successful.

4. The method according to claim 1, characterized in that: The determining, according to the attribute information and the historical access success rate, an initial access permission level corresponding to the terminal includes: Determining each historical attribute information corresponding to each historical authentication request according to the historical access success rate; Generate a corresponding number of sliding windows according to each of the historical attribute information, and generate a time decay function according to the sliding windows; Determine a corresponding weight according to the time of the historical attribute information where the sliding window in the time decay function is located; Obtaining a matching result between the attribute information and a preset vulnerability database, and determining a risk value corresponding to the attribute information according to the matching result; Determining an initial trust value corresponding to the attribute information according to the time decay function, the weight and the risk value; An initial access authority level corresponding to the terminal is determined according to a weighted calculation result of the initial trust value and the historical access success rate.

5. The method according to claim 1, characterized in that The step of inputting the network traffic data into a trained traffic behavior anomaly detection model, and having the traffic behavior anomaly detection model output a corresponding traffic behavior detection result based on the network traffic data, comprises: Inputting the network traffic data into a trained traffic behavior anomaly detection model, the traffic behavior anomaly detection model performs traffic behavior detection on the network traffic data based on a bidirectional recurrent neural network and a gated recurrent unit to determine whether there is abnormal traffic behavior in the network traffic data; According to the detection result of abnormal traffic behavior in the network traffic data, the corresponding traffic behavior detection result is output.

6. The method according to any one of claims 1 to 5, characterized in that: The step of adjusting the initial access permission level according to the traffic behavior detection result to obtain an adjusted access permission level includes: Obtaining a feature vector corresponding to the traffic behavior detection result; Determine the corresponding prior probability according to the feature vector through a Bayesian network; Determine a corresponding posterior probability according to the traffic behavior detection result and the prior probability; Determine a fuzzy evaluation function according to the posterior probability and the preset weight, input the matching result of the attribute information, the authentication result of the digital signature, the initial access permission level and the traffic behavior detection result into the fuzzy evaluation function, and obtain a security probability index output by the fuzzy evaluation function; An adjusted access permission level is determined according to the security probability index and a preset access permission mapping table.

7. A business system access device based on zero trust, characterized in that: The device comprises: A receiving module, configured to obtain the historical access success rate and network traffic data corresponding to the terminal upon receiving an authentication request from the terminal for the power grid system to be accessed; the authentication request includes attribute information corresponding to the terminal; A detection module, configured to obtain a digital signature corresponding to the terminal and authenticate the digital signature when detecting that there is preset attribute information in a preset attribute information database that matches the attribute information; a determination module, configured to determine, if the digital signature authentication is passed, an initial access permission level corresponding to the terminal according to the attribute information and the historical access success rate; An input module, used for inputting the network traffic data into a trained traffic behavior anomaly detection model, and the traffic behavior anomaly detection model outputs a corresponding traffic behavior detection result based on the network traffic data; The access module is used to adjust the initial access permission level according to the flow behavior detection result to obtain an adjusted access permission level, and instruct the terminal to access the power grid system according to the adjusted access permission level.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images