Construction and protection method and system of risk optimization model of power terminal

Abstract

The invention provides a construction and protection method and system for a risk optimization model of a power terminal. The construction and protection method comprises the following steps: constructing a target function by taking the minimum risk loss during risk attack as a target; setting constraint conditions for the objective function; wherein the constraint conditions comprise a time cost constraint for coping with the attack risk, a resource cost constraint for coping with the attack consumption and a risk attack success probability constraint. According to the risk optimization model provided by the invention, the time cost constraint for coping with the attack risk, the resource cost constraint for coping with the attack consumption and the risk attack success probability constraint are combined, the attack vulnerabilities can be effectively reduced, the loss of the operation and maintenance of the power terminal caused by the attack risk is reduced, and a basis is provided for establishing an active defense mechanism. The invention further provides a terminal operation and maintenance safety protection method, the method is combined with the risk optimization model, a safety operation and maintenance protection strategy of the power terminal is designed, and terminal operation and maintenance communication safety protection reinforcement and hostile attack resistance are achieved.

Description

Technical Field

[0001] The present invention relates to the field of information security protection technology, and in particular to the construction of a risk optimization model for a power terminal, a protection method and a system. Background Art

[0002] The power industrial control system mainly realizes the measurement, regulation, control and protection of electric energy in the process of production and consumption. The network security protection of this system is generally based on the basic principles of "security partitioning, network dedicated, horizontal isolation, and vertical authentication", and is protected from the aspects of boundary protection and vertical interaction security. In recent years, the power Internet of Things has developed rapidly, further integrating communication infrastructure resources and power system infrastructure resources efficiently, improving the digital level of the power system, and promoting the open interconnection of the power system.

[0003] With the rapid development of the power Internet of Things, the security protection of a large number of intelligent terminal devices faces challenges, especially the lack of effective security protection measures during operation and maintenance and debugging. There are risks such as illegal access to massive devices, hijacking of communications, and interception and eavesdropping of data.

[0004] The existing security protection for power terminal equipment generally ensures the safe access of the terminal in operation through technical measures such as security chips, but lacks security protection in the operation and maintenance debugging state of the terminal. Taking the operation and maintenance of smart terminals as an example, the operation and maintenance handheld device can exchange data with the terminal through short-range wireless communication (such as Bluetooth). The existing security risks include illegal access to terminal equipment, eavesdropping on terminal status, terminal data, configuration parameters, management data, and operation and inspection business data, etc., which brings great security risks to the normalized operation and maintenance of large-scale and wide-ranging power terminals. It is urgent to realize information security risk analysis and dynamic protection for the safe operation and maintenance of power terminals. Summary of the invention

[0005] In order to solve the problem that the prior art lacks security in the operation and maintenance debugging state of the terminal, the present invention proposes a method for constructing a risk optimization model of a power terminal, including:

[0006] Construct an objective function with the goal of minimizing risk loss during risk attacks;

[0007] Setting constraints for the objective function;

[0008] The constraints include: time cost constraints for coping with attack risks, resource cost constraints for coping with attack consumption, and probability constraints for success of risk attacks.

[0009] Optionally, constructing an objective function with the goal of minimizing risk loss during risk attacks includes:

[0010] Obtain the success probability of the nth attack path of the mth risk and the resulting impact;

[0011] The probability cost of the nth attack path of the mth risk is obtained by multiplying the success probability of the nth attack path of the mth risk by the impact caused;

[0012] Sum up the probability costs of all attack paths of the m-th risk to obtain the total probability cost of the m-th risk;

[0013] The objective function is to minimize the sum of the total probabilistic costs of all types of risks.

[0014] Optionally, the objective function is as shown below:

[0015]

[0016] Where Z is the target value of risk assessment; is the success probability of the nth attack path of the mth risk, is the impact caused by the nth attack path of the mth risk; M is the total number of risk types, m is the risk type number; N is the total number of attack paths of the mth risk; n is the risk path number.

[0017] Optionally, the time cost constraint for coping with attack risk is as follows:

[0018]

[0019] In the formula, is the system’s response time to the risk after the risk m invades; is the processing time or response time of the system after the risk m invades; T is the limit value of the time variable; m is the risk type number.

[0020] Optionally, the resource cost constraint for coping with the attack is as follows:

[0021]

[0022] In the formula, The cost of prevention to deal with risk m; is the cost of handling risk m after it occurs; CI m is the comprehensive cost constraint of risk m; m is the risk type number.

[0023] Optionally, the risk attack success probability constraint is as follows:

[0024]

[0025] In the formula, P(π m ) is the probability of success of the mth risk attack; is the limit of the success probability of risk m attack; m is the risk type number.

[0026] On the other hand, the present invention also provides a system for constructing a risk optimization model of a power terminal, comprising:

[0027] Function construction module, used to construct the objective function with the goal of minimizing the risk loss during risk attacks;

[0028] A constraint setting module, used for setting constraint conditions for the objective function;

[0029] The constraints include: time cost constraints for coping with attack risks, resource cost constraints for coping with attack consumption, and probability constraints for success of risk attacks.

[0030] Function building blocks are specifically used to:

[0031] Obtain the success probability of the nth attack path of the mth risk and the resulting impact;

[0032] The probability cost of the nth attack path of the mth risk is obtained by multiplying the success probability of the nth attack path of the mth risk by the impact caused;

[0033] Sum up the probability costs of all attack paths of the m-th risk to obtain the total probability cost of the m-th risk;

[0034] The objective function is to minimize the sum of the total probabilistic costs of all types of risks.

[0035] Optionally, the objective function is as shown below:

[0036]

[0037] Where Z is the target value of risk assessment; is the success probability of the nth attack path of the mth risk, is the impact caused by the nth attack path of the mth risk; M is the total number of risk types, m is the risk type number; N is the total number of attack paths of the mth risk; n is the risk path number.

[0038] Optionally, the constraint setting module is specifically used to: set a time cost constraint for coping with attack risks, a resource cost constraint for coping with attack consumption, and a risk attack success probability constraint.

[0039] Optionally, the time cost constraint for coping with attack risk is as follows:

[0040]

[0041] In the formula, is the system’s response time to the risk after the risk m invades; is the processing time or response time of the system after the risk m invades; T is the limit value of the time variable; m is the risk type number.

[0042] Optionally, the resource cost constraint for coping with the attack is as follows:

[0043]

[0044] In the formula, The cost of prevention to deal with risk m; is the cost of handling risk m after it occurs; CI m is the comprehensive cost constraint of risk m; m is the risk type number.

[0045] Optionally, the risk attack success probability constraint is as follows:

[0046]

[0047] In the formula, P(π m ) is the probability of success of the mth risk attack; is the limit of the success probability of risk m attack; m is the risk type number.

[0048] On the other hand, the present invention also provides a power terminal operation and maintenance safety protection method, comprising:

[0049] A hash algorithm is used to combine the parameters of each power terminal device to form an encryption key for online access authentication;

[0050] Perform perception analysis based on the collected information attributes and physical characteristics, and determine risk points and attack paths based on the perception analysis results combined with pre-set intrusion detection devices and pre-built risk optimization models;

[0051] Through operation record and log retention technology, the identity and behavior of operation and maintenance personnel are supervised;

[0052] Wherein, the risk optimization model is constructed using the risk defense optimization model construction method as described above.

[0053] Optionally, the method of using a hash algorithm in combination with parameters of each power terminal device to form an encryption key for online access authentication includes:

[0054] A hash algorithm is used to transform the physical ID and other parameters of each power terminal device into a hash value of fixed length;

[0055] Using the hash value as an encryption key;

[0056] The parameters of each terminal device include the physical ID and other parameters of the power terminal device;

[0057] The other parameters include one or more of the following: main frequency, memory, battery capacity and production date.

[0058] Optionally, the method of using a hash algorithm in combination with parameters of each power terminal device to form an encryption key for online access authentication further includes:

[0059] The other parameters are transformed at set intervals, and the physical ID of the power terminal device and the transformed other parameters are transformed using a hash algorithm to form a dynamic key.

[0060] Optionally, the performing perception analysis based on the collected information attributes and physical characteristics includes:

[0061] Determine whether the information attribute and / or the physical feature has changed. If so, the power terminal corresponding to the changed information attribute or physical feature may be attacked or destroyed. Otherwise, the power terminal operates normally.

[0062] The information attributes include one or more of the following: IP, flow, voltage and current;

[0063] The physical characteristics include one or more of the following: power flow information, terminal steady state / transient state, and physical path.

[0064] Optionally, the determining of risk points and attack paths based on the perception analysis results in combination with a pre-set intrusion detection device and a pre-built risk optimization model includes:

[0065] When the perception analysis results indicate that there is a possibility of attack or destruction, a risk optimization model is used to confirm the risk points, judge the risk paths, and limit the resources for responding to the attack; at the same time, an intrusion detection device is used to further sniff out the attack and intercept it.

[0066] Optionally, the identity and behavior of the operation and maintenance personnel are supervised by operation record and log retention technology, including:

[0067] Determine the correlation between operation and maintenance instructions and operations based on operation records and log records;

[0068] When the operation and maintenance operation is performed on the power terminal, it is recorded and judged whether the operation and maintenance operation satisfies the association relationship between the operation and maintenance instruction issued by the master station. If so, the operation and maintenance operation runs normally. Otherwise, an alarm message is issued and a backtracking record is provided.

[0069] On the other hand, the present invention also provides a power terminal operation and maintenance safety protection system, comprising:

[0070] Access authentication module, used to use hash algorithm combined with parameters of each power terminal device to form encryption key for online access authentication;

[0071] The risk determination module is used to perform perception analysis based on the collected information attributes and physical characteristics, and determine the risk points and attack paths based on the perception analysis results combined with the pre-set intrusion detection device and the pre-built risk optimization model;

[0072] The record supervision module is used to supervise the identity and behavior of operation and maintenance personnel through operation records and log retention technology;

[0073] Wherein, the risk optimization model is constructed by adopting the method for constructing a risk optimization model of a power terminal as described above.

[0074] Optionally, the access authentication module includes:

[0075] A parameter conversion submodule, used to convert the physical ID and other parameters of each power terminal device into a hash value of fixed length by using a hash algorithm;

[0076] A key determination submodule, used for using the hash value as an encryption key;

[0077] The parameters of each terminal device include the physical ID and other parameters of the power terminal device;

[0078] The other parameters include one or more of the following: main frequency, memory, battery capacity and production date.

[0079] Optionally, the parameter transformation submodule is specifically used to:

[0080] The other parameters are transformed at set intervals, and the physical ID of the power terminal device and the transformed other parameters are transformed using a hash algorithm to form a dynamic key.

[0081] Optional risk determination modules include:

[0082] A perception analysis submodule is used to determine whether the information attribute and / or the physical feature has changed. If so, the power terminal corresponding to the changed information attribute or physical feature may be attacked or destroyed. Otherwise, the power terminal operates normally.

[0083] The risk location submodule is specifically used to:

[0084] When the perception analysis results indicate that there is a possibility of attack or destruction, a risk optimization model is used to confirm the risk point, determine the risk path, and limit the resources to respond to the attack; at the same time, an intrusion detection device is used to further sniff out the attack and intercept it;

[0085] The information attributes include one or more of the following: IP, flow, voltage and current;

[0086] The physical characteristics include one or more of the following: power flow information, terminal steady state / transient state, and physical path.

[0087] Optionally, the record supervision module is specifically used to:

[0088] Determine the correlation between operation and maintenance instructions and operations based on operation records and log records;

[0089] When the operation and maintenance operation is performed on the power terminal, it is recorded and judged whether the operation and maintenance operation satisfies the association relationship between the operation and maintenance instruction issued by the master station. If so, the operation and maintenance operation runs normally. Otherwise, an alarm message is issued and a backtracking record is provided.

[0090] In another aspect, the present application further provides a computing device, comprising: one or more processors;

[0091] a processor for executing one or more programs;

[0092] When the one or more programs are executed by the one or more processors, a method for constructing a risk optimization model for a power terminal or a method for protecting the operation and maintenance safety of a power terminal as described above is implemented.

[0093] On the other hand, the present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed, it implements a method for constructing a risk optimization model for a power terminal as described above, or a method for protecting the operation and maintenance of a power terminal.

[0094] Compared with the prior art, the present invention has the following beneficial effects:

[0095] (1) The present invention provides a method for constructing a risk optimization model for a power terminal, including constructing an objective function with the goal of minimizing risk losses during risk attacks; setting constraints for the objective function; wherein the constraints include: time cost constraints for responding to attack risks, resource cost constraints for responding to attack consumption, and risk attack success probability constraints. The risk optimization model provided by the present invention combines the time cost constraints for responding to attack risks, the resource cost constraints for responding to attack consumption, and the risk attack success probability constraints, which can effectively reduce attack vulnerabilities, reduce the losses caused by attack risks to the operation and maintenance of power terminals, and provide a basis for establishing an active defense mechanism.

[0096] (2) The present invention provides a method for the safe operation and maintenance of power terminals, including: using a hash algorithm combined with the parameters of each device to form an encryption key for online authentication; performing anomaly analysis based on the collected information attributes and physical characteristics, and when anomalies exist, judging risk points and attack paths based on the information attributes, physical characteristics and a pre-built risk optimization model; supervising the identity and behavior of operation and maintenance and management personnel through operation records and log retention technology; wherein the risk optimization model is constructed using a method for constructing a risk defense optimization model as described above. The present invention designs a safe operation and maintenance protection strategy for power terminals in combination with the risk optimization model, which includes an active defense monitoring mechanism for access, authentication, operation, monitoring and other links under the terminal operation and maintenance state, thereby realizing the security protection reinforcement of terminal operation and maintenance communications and resisting malicious attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0097] Figure 1 A flow chart of a method for constructing a risk optimization model for a power terminal of the present invention;

[0098] Figure 2 It is a schematic diagram of the attack path and risk probability of the present invention;

[0099] Figure 3 A schematic diagram of a power terminal operation and maintenance safety protection method of the present invention;

[0100] Figure 4 It is a schematic diagram of the power terminal operation and maintenance safety defense solution of the present invention;

[0101] Figure 5 A schematic diagram of an attack on a power terminal according to the present invention;

[0102] Figure 6 This is a diagram of the power terminal access and authentication security protection strategy of the present invention;

[0103] Figure 7 A safety protection strategy diagram for power terminal operation monitoring. DETAILED DESCRIPTION

[0104] In the scenario of digital distribution network with cloud-edge-end collaboration, a large number of power terminals are easily breached by attackers by exploiting vulnerabilities during operation and maintenance, and the attack evolution paths are divided into edge-cloud attack, edge-edge attack, edge-end attack, etc. Due to the diverse changes in attack evolution paths, different degrees of risk are brought to the distribution network. The present invention proposes a construction, protection method and system for a risk optimization model of power terminals to strengthen the information security protection level of smart terminals. The present invention establishes a risk optimization model for the attack path of the terminal and the losses caused by risk transfer, analyzes the propagation and transfer mode of the power terminal in the cloud-edge after being attacked during the operation and maintenance process, conducts risk assessment, and establishes a risk optimization model.

[0105] Embodiment 1:

[0106] A method for constructing a risk optimization model for power terminals, such as Figure 1 As shown, including:

[0107] Step 1: Construct an objective function with the goal of minimizing risk loss during risk attacks;

[0108] Step 2: Setting constraints for the objective function;

[0109] The constraints include: time cost constraints for coping with attack risks, resource cost constraints for coping with attack consumption, and probability constraints for success of risk attacks.

[0110] The following is a detailed introduction to a method for constructing a risk optimization model for a power terminal of the present invention:

[0111] The objective function in step 1 is constructed with the goal of minimizing the risk loss during risk attacks, including:

[0112] Obtain the success probability of the nth attack path of the mth risk and the resulting impact;

[0113] The probability cost of the nth attack path of the mth risk is obtained by multiplying the success probability of the nth attack path of the mth risk by the impact caused;

[0114] Sum up the probability costs of all attack paths of the m-th risk to obtain the total probability cost of the m-th risk;

[0115] The objective function is to minimize the sum of the total probabilistic costs of all types of risks.

[0116] The goal of the risk optimization model is to minimize the risk loss. The constraints include the time cost of dealing with the attack risk, the resource cost of dealing with the attack, and the probability of success of the risk attack. The probability of success of attacks of different risks is different, denoted as P(π m ), where m represents the type of risk or attack method, and the consequence or economic loss caused by risk m in the system is recorded as R(π m ).

[0117] In engineering practice, to quantify the probability P, one implementation method can be to infer the attack evidence E provided by the intrusion detection device: E = {H(π1),...,H(π m )}, where H(π m ) describes whether the risk m has been blocked by the intrusion detection device. If the blocking is successful, it is 0, and if the blocking fails, it is 1. The objective function of the model is as follows:

[0118]

[0119] Where z is the objective function of the model; P(π m ) is the probability of success of the mth risk attack; R(π m ) represents the management cost and equipment loss cost of the system to deal with risk m; M is the total number of risk types that the model needs to consider, and m is the risk type number.

[0120] Since some attack risks will choose paths according to the system deployment, if the loss impact of different attack paths is taken into account, the model can be further refined. Different risks invade through different paths during the terminal operation and maintenance process, and their success probability is recorded as The target loss caused is recorded as Where n represents the attack path. Figure 2 As shown in the figure, the purpose of risk 1 is to steal the terminal user data and directly invade the terminal device through attack path 1. The success probability can be recorded as The attack loss is recorded as The attack target of risk m is the main station, which is invaded from the operation and maintenance handheld. The risk involves end-edge-cloud and can be transferred to different paths. The success probability of the nth attack path of the mth risk is recorded as The impact caused is recorded as According to this rule, the following risk optimization model for terminal operation and maintenance is summarized as follows:

[0121]

[0122] Where Z is the target value of risk assessment; is the success probability of the nth attack path of the mth risk, is the impact caused by the nth attack path of the mth risk; M is the total number of risk types that the model needs to consider; m is the risk type number; n is the risk path number; N is the total number of attack paths for the mth risk.

[0123]

[0124] in, The cost of prevention to deal with risk m; is the cost of handling risk m after it occurs; CI m is the comprehensive cost constraint of risk m; is the system’s response time to the risk after the risk m invades; is the processing time or response time of the system after the risk m invades; P(π m ) is the probability of success of the mth risk attack; T is the time limit for the risk optimization model to respond to and handle risk attacks; is the limit of the success probability of risk m attack; n is the risk path number; N is the total number of attack paths for the mth risk.

[0125] A power terminal risk optimization model of the present invention combines constraints such as time cost and resource cost to model the attack path and loss of power terminal risks during the operation and maintenance process. It can effectively reduce attack vulnerabilities, reduce the losses caused by attack risks to power terminal operation and maintenance, and provide a basis for establishing an active defense mechanism.

[0126] Embodiment 2:

[0127] Based on the same inventive concept, the present invention also provides a system for constructing a risk optimization model of a power terminal, comprising:

[0128] Function construction module, used to construct the objective function with the goal of minimizing the risk loss during risk attacks;

[0129] A constraint setting module, used for setting constraint conditions for the objective function;

[0130] The constraints include: time cost constraints for coping with attack risks, resource cost constraints for coping with attack consumption, and probability constraints for success of risk attacks.

[0131] Function building blocks are specifically used to:

[0132] Obtain the success probability of the nth attack path of the mth risk and the resulting impact;

[0133] The probability cost of the nth attack path of the mth risk is obtained by multiplying the success probability of the nth attack path of the mth risk by the impact caused;

[0134] Sum up the probability costs of all attack paths of the m-th risk to obtain the total probability cost of the m-th risk;

[0135] The objective function is to minimize the sum of the total probabilistic costs of all types of risks.

[0136] Optionally, the objective function is as shown below:

[0137]

[0138] Where Z is the target value of risk assessment; is the success probability of the nth attack path of the mth risk, is the impact caused by the nth attack path of the mth risk; M is the total number of risk types, m is the risk type number; N is the total number of attack paths of the mth risk; n is the risk path number.

[0139] Optionally, the constraint setting module is specifically used to: set a time cost constraint for coping with attack risks, a resource cost constraint for coping with attack consumption, and a risk attack success probability constraint.

[0140] Optionally, the time cost constraint for coping with attack risk is as follows:

[0141]

[0142] In the formula, is the system’s response time to risk after risk m invades; is the processing time or response time of the system after the risk m invades; T is the limit value of the time variable; m is the risk type number.

[0143] Optionally, the resource cost constraint for coping with the attack is as follows:

[0144]

[0145] In the formula, The cost of prevention to deal with risk m; is the cost of handling risk m after it occurs; CI m is the comprehensive cost constraint of risk m; m is the risk type number.

[0146] Optionally, the risk attack success probability constraint is as follows:

[0147]

[0148] In the formula, P(π m ) is the probability of success of the mth risk attack; is the limit of the success probability of risk m attack; m is the risk type number.

[0149] Embodiment 3:

[0150] Based on the same inventive concept, the present invention also provides a power terminal operation and maintenance safety protection method, such as Figure 3 As shown, including:

[0151] S1. Use hash algorithm combined with the parameters of each power terminal device to form an encryption key for online access authentication;

[0152] S2. Perform perception analysis based on the collected information attributes and physical characteristics, and determine risk points and attack paths based on the perception analysis results combined with the pre-set intrusion detection device and the pre-built risk optimization model;

[0153] S3. Monitor the identity and behavior of operation and maintenance personnel through operation record and log retention technology;

[0154] Wherein, the risk optimization model is constructed by adopting the method for constructing a risk optimization model of a power terminal as described in Example 1.

[0155] After establishing the risk optimization model, the present invention proposes a power terminal operation and maintenance security protection method, which is mainly based on the active protection concept, integrates the in-depth defense mechanism and the active defense mechanism, constructs equipment trusted access, operation behavior security assessment, data encryption transmission, and secure real-time monitoring system, improves the immunity and global monitoring capabilities of the industrial control system, and provides security protection for power terminal operation and maintenance in the access, authentication, operation, monitoring and other links.

[0156] The present invention proposes a power terminal operation and maintenance safety protection method, such as Figure 4 As shown, it mainly involves terminal fixed access authentication, mobile access authentication, situational awareness and other links, respectively using physical ID authentication, encrypted registration, risk optimization status monitoring and other methods. Through the orderly combination of the above methods, the losses caused by the above risks can be further limited and the safety protection of power terminal operation and maintenance can be achieved. The specific implementation method is described in detail in the application example.

[0157] S1 uses a hash algorithm combined with the parameters of each power terminal device to form an encryption key for online access authentication, including:

[0158] A hash algorithm is used to transform the physical ID and other parameters of each power terminal device into a hash value of fixed length;

[0159] Using the hash value as an encryption key;

[0160] The parameters of each power terminal device include the physical ID and other parameters of the power terminal device;

[0161] The other parameters include one or more of the following: main frequency, memory and release date.

[0162] The detailed introduction of S1 is as follows:

[0163] The hash algorithm is combined with each device's unique physical ID and other parameters to form a unique encryption key K = Hash (P, UID, T0) to complete online authentication and prevent illegal devices from accessing. Among them, UID represents the user's unique physical ID, P is other variable parameters, and T0 is the time when the parameters change. These other variable parameters include one or more of the following: the device's production date, main frequency, battery capacity, and memory.

[0164] At the same time, in order to avoid the risks caused by long-term use of keys, the parameters of the encryption mechanism are changed at set intervals to form a dynamic key to encrypt the operation and maintenance information, ensuring the identity identification and data encryption of the operation and maintenance end. The so-called parameter change of the encryption mechanism here refers to changing other parameters. The hash algorithm is used to perform hash conversion on the unique physical ID of the device and the changed other parameters to obtain a new encryption key to achieve dynamic encryption. The change of other parameters here can be the change of other parameters or the change of a combination of other parameters. For example, other parameters can include the device parameters such as the factory date, main frequency, and memory of the device. At a certain moment, the combination of the factory date and memory can be used as the parameter P. After a certain moment, in order to prevent long-term use, P can be changed to a combination of other parameters, such as the factory date and main frequency.

[0165] S2 performs perception analysis based on the collected information attributes and physical characteristics, and determines risk points and attack paths based on the perception analysis results combined with the pre-set intrusion detection device and the pre-built risk optimization model, including:

[0166] Determine whether the information attribute and / or the physical feature has changed. If so, the power terminal corresponding to the changed information attribute or physical feature may be attacked or destroyed. Otherwise, the power terminal operates normally.

[0167] When the perception analysis results indicate that there is a possibility of attack or destruction, a risk optimization model is used to confirm the risk point, determine the risk path, and limit the resources to respond to the attack; at the same time, an intrusion detection device is used to further sniff out the attack and intercept it;

[0168] The information attributes include one or more of the following: IP, flow, voltage and current;

[0169] The physical characteristics include one or more of the following: power flow information, terminal steady state / transient state, and physical path.

[0170] The detailed introduction of S2 is as follows:

[0171] When the terminal is running, there will be a need for non-stop operation and maintenance such as collecting operation and maintenance information and modifying operation and maintenance parameters. Therefore, a monitoring module is deployed in the operation and monitoring link to monitor the access and operation and maintenance process of the terminal and operation and maintenance handheld device in real time.

[0172] The defense measures are mainly deployed on the main station system and the power terminal operating system, such as Figure 7As shown in the figure, the main function of the operation and monitoring link is to conduct abnormal analysis based on the information attributes and physical characteristics collected by the monitoring module, and to actively and dynamically monitor in real time under the operating state. Through the multi-level and multi-angle access and authentication of power terminals, and the operation and monitoring of the main station, the global, all-round, multi-level real-time system monitoring is realized to ensure that illegal attacks and risks can be warned, responded to and resolved in time.

[0173] Dynamic status monitoring:

[0174] During the terminal operation and maintenance process, the monitoring module maintains the monitoring state. Its risk detection function is mainly realized through intrusion detection devices and risk optimization models, and real-time monitoring instructions are issued to the master station and the terminal. General intrusion detection devices only monitor information-side signals, but this situation is no longer applicable to new power systems with blurred boundaries. Physical signals are also one of the important indicators for judging whether the equipment is operating normally. Its monitoring function is not only aimed at the information characteristics of the equipment such as IP and traffic, but also needs to collect dynamic physical signals of the equipment such as flow information, terminal steady state / transient state, physical path and other physical characteristics to determine whether the master station and power terminal are operating normally. If the monitoring signal is abnormal, it will immediately warn the platform and determine the risk points and attack paths through the risk optimization model, and simulate the solution through the background artificial intelligence library, notify the terminal equipment to self-check or wait for further confirmation by the operation and maintenance personnel to realize system risk monitoring and situation awareness.

[0175] S3 uses operation records and log retention technology to monitor the identity and behavior of operation and maintenance personnel, including:

[0176] Determine the correlation between operation and maintenance instructions and operations based on operation records and log records;

[0177] When the operation and maintenance operation is performed on the power terminal, it is recorded and judged whether the operation and maintenance operation satisfies the association relationship between the operation and maintenance instruction issued by the master station. If so, the operation and maintenance operation runs normally. Otherwise, an alarm message is issued and a backtracking record is provided.

[0178] The specific contents of S3 are as follows:

[0179] The existing attack risks include not only external network attacks, but also internal attack risks, such as abuse of privileges, misuse or denial of operations, social engineering attacks and other internal attacks that exploit human factors. In order to ensure data monitoring, anti-tampering and anti-forgery throughout the entire terminal operation and maintenance process, through complete operation records and log retention technology, the identity and behavior of operation and maintenance and management personnel are strictly supervised to prevent forgery and tampering.

[0180] The operation records include both the operations performed by the monitoring personnel on the system and the operations performed by the operation and maintenance personnel on the equipment when receiving operation and maintenance instructions. Corresponding log records will be retained. If the operation and maintenance instructions are inconsistent with the operations, a warning can be issued and uploaded to the platform, and a backtracking record can be provided to view the specific operations.

[0181] The present invention proposes a method for the safe operation and maintenance of electric power terminals. The method combines the risk optimization model to design a safe operation and maintenance protection strategy for electric power terminals, which includes an active defense monitoring mechanism for access, authentication, operation, monitoring and other links under the operation and maintenance state of the terminal, and realizes the security protection reinforcement of terminal operation and maintenance communications to resist malicious attacks.

[0182] The solution provided by the present invention adds a risk monitoring process, which can effectively reduce the risk of attacks, thereby reducing the operation and maintenance frequency of operation and maintenance personnel, while increasing the probability of operation and maintenance personnel accurately finding accident points, and ensuring the safety, reliability and efficiency of terminal operation and maintenance without reducing the operation and maintenance efficiency of terminal equipment.

[0183] Embodiment 4:

[0184] Take the operation and maintenance of power intelligent terminals as an example. Figure 5 As shown in the figure, when an attacker uses a terminal device to attack the main station, although there is a mechanism for vertical authentication protection, it is still possible for the main station system to lose control and become paralyzed when attacked. As shown in evolution path 1, the existing cloud system has a weak defense capability against supply chain attacks. When an attacker uses malicious code such as denial of service and ransomware attacks to invade the main station through the terminal, it may cause large-scale security incidents such as information leakage and system paralysis. At the same time, because the main station lacks preventive measures against certain unknown risks, some threats that have not yet been identified by the system may invade the system as gray identities and then steal sensitive and confidential information, but there is no better handling countermeasure yet.

[0185] On the device side, the access of a large number of IoT sensing devices with weak protection has further deepened the vulnerability of the system boundary. For example, in photovoltaic, charging piles and distributed power sources, many user-side devices are connected to the power grid under an open system, which can coordinate local power supply and consumption. However, the weakening of the security protection boundary of the power grid has caused security problems for self-managed user devices. This model increases the burden on edge-end defense capabilities, leading to further expansion of attack risks.

[0186] As for edge attacks, power smart terminals, as gateway devices that connect to the cloud and physical objects, play an important role in connecting the upper and lower levels. Power terminals with edge computing functions are widely used. When attacking a terminal through edge-to-edge collaborative interoperability, other edge devices connected to it will also be subject to certain interference risks.

[0187] Therefore, in order to reduce the above-mentioned risk losses, the present invention applies other protection schemes while monitoring risk losses through risk optimization models, and designs an active and dynamic power intelligent terminal operation and maintenance security risk analysis and protection strategy. This strategy takes into account the terminal risks caused by the access process of distributed resources under open boundaries, and reduces the probability of misjudgment and missed judgment of risks. The specific implementation method is as follows:

[0188] (1) Access authentication

[0189] The access and authentication process mainly includes the fixed connection of the power terminal to the main station and the mobile connection adopted by the terminal-handheld operation and maintenance. The two connection authentication methods constitute the operation and maintenance access authentication system of the power intelligent terminal, such as Figure 6 shown.

[0190] Smart terminals mostly use fixed connections to access the main station to transmit operation and maintenance data and instructions, authenticate and authorize through digital certificates issued by the authentication and authorization controller, and connect to encryption chips to ensure secure connections. In the mobile operation and maintenance authentication process, mobile operation and maintenance tools such as operation and maintenance handheld devices are used to access the power terminal via Bluetooth, and authentication is achieved through user password authentication. However, this process lacks management of illegal device access, and user passwords are easily stolen.

[0191] To reduce this risk, the present invention uses a hash algorithm combined with each device's unique physical ID and other parameters to form a unique encryption key K = Hash (P, UID, T0) to complete online authentication and prevent illegal device access. Among them, UID represents the user's unique physical ID, P is other variable parameters, and T0 is the time when the parameters change. The other variable parameters include one or more of the following: the device's production date, main frequency, battery capacity, and memory.

[0192] At the same time, in order to avoid the risks caused by long-term use of keys, the parameters of the encryption mechanism are changed at set intervals to form a dynamic key to encrypt the operation and maintenance information, ensuring the identity identification and data encryption of the operation and maintenance end. The so-called parameter change of the encryption mechanism here refers to changing other parameters. The hash algorithm is used to perform hash conversion on the unique physical ID of the device and the changed other parameters to obtain a new encryption key to achieve dynamic encryption. The change of other parameters here can be the change of other parameters or the change of a combination of other parameters. For example, other parameters can include the device parameters such as the factory date, main frequency, and memory of the device. At a certain moment, the combination of the factory date and memory can be used as the parameter P. After a certain moment, in order to prevent long-term use, P can be changed to a combination of other parameters, such as the factory date and main frequency.

[0193] (2) Operation and monitoring

[0194] When the power terminal is in operation, there will be a need for non-stop operation and maintenance such as collecting operation and maintenance information and modifying operation and maintenance parameters. Therefore, a monitoring module is deployed in the operation and monitoring links to monitor the access and operation and maintenance process of the terminal and operation and maintenance handheld device in real time.

[0195] Defense measures are mainly deployed on the main station system and terminal operating system, such as Figure 7 As shown in the figure, the main function of the operation and monitoring link is to conduct abnormal analysis based on the information attributes and physical characteristics collected by the monitoring module, and to actively and dynamically monitor in real time under the running state. By realizing global, all-round, multi-level real-time system monitoring from multiple levels and angles from terminal access and authentication to main station operation and monitoring, it ensures that illegal attacks and unknown risks can be warned, responded to and resolved in a timely manner.

[0196] 1) Dynamic status monitoring:

[0197] During the terminal operation and maintenance process, the monitoring module maintains the monitoring state. Its risk detection function is mainly realized through intrusion detection devices and risk optimization models, and real-time monitoring instructions are issued to the master station and power intelligent terminals. General intrusion detection devices only monitor information-side signals, but this situation is no longer applicable to new power systems with blurred boundaries. Physical signals are also one of the important indicators for judging whether the equipment is operating normally. Its monitoring function is not only aimed at the information characteristics of the equipment such as IP and traffic, but also needs to collect dynamic physical signals of the equipment such as flow information, terminal steady state / transient state, physical path and other physical characteristics to determine whether the master station system and terminal are operating normally. If the monitoring signal is abnormal, it will immediately warn the platform and determine the risk points and attack paths through the risk optimization model, and simulate the solution through the background artificial intelligence library, notify the terminal equipment to self-check or wait for further confirmation by the operation and maintenance personnel to realize system risk monitoring and situation awareness.

[0198] 2) Anti-counterfeiting and anti-tampering:

[0199] The existing attack risks include not only external network attacks, but also internal attack risks, such as abuse of privileges, misuse or denial of operations, social engineering attacks and other internal attacks caused by human factors. In order to ensure data monitoring, anti-tampering and anti-forgery throughout the terminal operation and maintenance process, the identity and behavior of operation and maintenance and management personnel are strictly supervised through complete operation records and log retention technology.

[0200] The operation records include both the operations performed by the monitoring personnel on the system and the operations performed by the operation and maintenance personnel on the equipment when receiving operation and maintenance instructions. Corresponding log records will be retained. If the operation and maintenance instructions are inconsistent with the operations, a warning can be issued and uploaded to the platform, and a backtracking record can be provided to view the specific operations.

[0201] Embodiment 5:

[0202] The present invention based on the same inventive concept also provides a power terminal operation and maintenance safety protection system, including:

[0203] Access authentication module, used to use hash algorithm combined with parameters of each power terminal device to form encryption key for online access authentication;

[0204] The risk determination module is used to perform perception analysis based on the collected information attributes and physical characteristics, and determine the risk points and attack paths based on the perception analysis results combined with the pre-set intrusion detection device and the pre-built risk optimization model;

[0205] The record supervision module is used to supervise the identity and behavior of operation and maintenance personnel through operation records and log retention technology;

[0206] Wherein, the risk optimization model is constructed by adopting the method for constructing a risk optimization model of a power terminal as described above.

[0207] Optionally, the access authentication module includes:

[0208] A parameter conversion submodule, used to convert the physical ID and other parameters of each power terminal device into a hash value of fixed length by using a hash algorithm;

[0209] A key determination submodule, used for using the hash value as an encryption key;

[0210] The parameters of each terminal device include the physical ID and other parameters of the power terminal device;

[0211] The other parameters include one or more of the following: main frequency, memory, battery capacity and production date.

[0212] Optionally, the parameter transformation submodule is specifically used to:

[0213] The other parameters are transformed at set intervals, and the physical ID of the power terminal device and the transformed other parameters are transformed using a hash algorithm to form a dynamic key.

[0214] Optional risk determination modules include:

[0215] A perception analysis submodule is used to determine whether the information attribute and / or the physical feature has changed. If so, the power terminal corresponding to the changed information attribute or physical feature may be attacked or destroyed. Otherwise, the power terminal operates normally.

[0216] The risk location submodule is specifically used to:

[0217] When the perception analysis result indicates that there is a possibility of attack or destruction, the risk optimization model is used to confirm the risk point, judge the risk path, and limit the resources to deal with the attack; at the same time, the intrusion detection device is used to further sniff the attack and intercept the attack;

[0218] The information attributes include one or more of the following: IP, flow, voltage and current;

[0219] The physical characteristics include one or more of the following: power flow information, terminal steady state / transient state, and physical path.

[0220] Optionally, the record supervision module is specifically used to:

[0221] Determine the correlation between operation and maintenance instructions and operations based on operation records and log records;

[0222] When the operation and maintenance operation is performed on the power terminal, it is recorded and judged whether the operation and maintenance operation satisfies the association relationship between the operation and maintenance instruction issued by the master station. If so, the operation and maintenance operation is performed normally. Otherwise, an alarm message is issued and a backtracking record is provided.

[0223] Embodiment 6:

[0224] Based on the same inventive concept, the present invention also provides a computer device, which includes a processor and a memory, the memory is used to store a computer program, the computer program includes program instructions, and the processor is used to execute the program instructions stored in the computer storage medium. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, and is specifically suitable for loading and executing one or more instructions in the computer storage medium to implement the corresponding method flow or corresponding function, so as to realize the risk optimization model construction method of a power terminal in the above embodiment, or the steps of a power terminal operation and maintenance safety protection method.

[0225] Embodiment 7:

[0226] Based on the same inventive concept, the present invention also provides a storage medium, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device for storing programs and data. It can be understood that the computer-readable storage medium here can include both built-in storage media in a computer device and, of course, extended storage media supported by the computer device. The computer-readable storage medium provides a storage space, which stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by a processor are also stored in the storage space, and these instructions can be one or more computer programs (including program codes). It should be noted that the computer-readable storage medium here can be a high-speed RAM memory or a non-volatile memory, such as at least one disk memory. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement a method for constructing a risk optimization model of a power terminal in the above embodiment, or a step of a power terminal operation and maintenance safety protection method.

[0227] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0228] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0229] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0230] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0231] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are included in the scope of the claims of the present invention to be approved.

Claims

1. A method for constructing a risk optimization model for a power terminal, characterized in that: include: Construct an objective function with the goal of minimizing risk loss during risk attacks; Setting constraints for the objective function; The constraints include: time cost constraints for coping with attack risks, resource cost constraints for coping with attack consumption, and probability constraints for success of risk attacks.

2. The method according to claim 1, characterized in that The objective function is constructed with the goal of minimizing the risk loss during a risk attack, including: Obtain the success probability of the nth attack path of the mth risk and the resulting impact; The probability cost of the nth attack path of the mth risk is obtained by multiplying the success probability of the nth attack path of the mth risk by the impact caused; Sum up the probability costs of all attack paths of the m-th risk to obtain the total probability cost of the m-th risk; The objective function is to minimize the sum of the total probabilistic costs of all types of risks.

3. The method according to claim 2, characterized in that The objective function is shown in the following formula: Where Z is the target value of risk assessment; is the success probability of the nth attack path of the mth risk, is the impact caused by the nth attack path of the mth risk; M is the total number of risk types, m is the risk type number; N is the total number of attack paths of the mth risk; n is the risk path number.

4. The method according to claim 1, characterized in that The time cost constraint for dealing with attack risks is as follows: In the formula, is the system’s response time to the risk after the risk m invades; is the processing time or response time of the system after the risk m invades; T is the limit value of the time variable; m is the risk type number.

5. The method according to claim 1, characterized in that The resource cost constraint for dealing with the attack is as follows: In the formula, The cost of prevention to deal with risk m; is the cost of handling risk m after it occurs; CI m is the comprehensive cost constraint of risk m; m is the risk type number.

6. The method according to claim 1, characterized in that The success probability constraint of the risk attack is as follows: In the formula, P(π m ) is the probability of success of the mth risk attack; is the limit of the success probability of risk m attack; m is the risk type number.

7. A system for constructing a risk optimization model for a power terminal, characterized in that: include: Function construction module, used to construct the objective function with the goal of minimizing the risk loss during risk attacks; A constraint setting module, used for setting constraint conditions for the objective function; The constraints include: time cost constraints for coping with attack risks, resource cost constraints for coping with attack consumption, and probability constraints for success of risk attacks.

8. A power terminal operation and maintenance safety protection method, characterized in that: include: A hash algorithm is used to combine the parameters of each power terminal device to form an encryption key for online access authentication; Perform perception analysis based on the collected information attributes and physical characteristics, and determine risk points and attack paths based on the perception analysis results combined with pre-set intrusion detection devices and pre-built risk optimization models; Through operation record and log retention technology, the identity and behavior of operation and maintenance personnel are supervised; Wherein, the risk optimization model is constructed by adopting a method for constructing a risk defense optimization model as described in any one of claims 1 to 6.

9. The method according to claim 8, characterized in that The method of using a hash algorithm in combination with the parameters of each power terminal device to form an encryption key for online access authentication includes: A hash algorithm is used to transform the physical ID and other parameters of each power terminal device into a hash value of fixed length; Using the hash value as an encryption key; The parameters of each terminal device include the physical ID and other parameters of the power terminal device; The other parameters include one or more of the following: main frequency, memory, battery capacity and production date.

10. The method according to claim 9, characterized in that The method of using a hash algorithm in combination with the parameters of each power terminal device to form an encryption key for online access authentication also includes: The other parameters are transformed at set intervals, and the physical ID of the power terminal device and the transformed other parameters are transformed using a hash algorithm to form a dynamic key.

11. The method according to claim 8, characterized in that The perception analysis based on the collected information attributes and physical characteristics includes: Determine whether the information attribute and / or the physical feature has changed. If so, the power terminal corresponding to the changed information attribute or physical feature may be attacked or destroyed. Otherwise, the power terminal operates normally. The information attributes include one or more of the following: IP, flow, voltage and current; The physical characteristics include one or more of the following: power flow information, terminal steady state / transient state, and physical path.

12. The method according to claim 8, characterized in that The method of judging risk points and attack paths based on the perception analysis results in combination with a pre-set intrusion detection device and a pre-built risk optimization model includes: When the perception analysis results indicate that there is a possibility of attack or destruction, a risk optimization model is used to confirm the risk points, judge the risk paths, and limit the resources for responding to the attack; at the same time, an intrusion detection device is used to further sniff out the attack and intercept it.

13. The method according to claim 8, characterized in that The identity and behavior of operation and maintenance personnel are supervised through operation records and log retention technology, including: Determine the correlation between operation and maintenance instructions and operations based on operation records and log records; When the operation and maintenance operation is performed on the power terminal, it is recorded and judged whether the operation and maintenance operation satisfies the association relationship between the operation and maintenance instruction issued by the master station. If so, the operation and maintenance operation runs normally. Otherwise, an alarm message is issued and a backtracking record is provided.

14. A power terminal operation and maintenance safety protection system, characterized in that: include: Access authentication module, used to use hash algorithm combined with parameters of each power terminal device to form encryption key for online access authentication; The risk determination module is used to perform perception analysis based on the collected information attributes and physical characteristics, and determine the risk points and attack paths based on the perception analysis results combined with the pre-set intrusion detection device and the pre-built risk optimization model; The record supervision module is used to supervise the identity and behavior of operation and maintenance personnel through operation records and log retention technology; Wherein, the risk optimization model is constructed by adopting a method for constructing a risk defense optimization model as described in any one of claims 1 to 6.

15. A computer device, characterized in that: include: one or more processors; The processor is used to store one or more programs; When the one or more programs are executed by the one or more processors, a method for constructing a risk optimization model for a power terminal as described in any one of claims 1 to 6, or a method for protecting the operation and maintenance safety of a power terminal as described in any one of claims 8 to 13 is implemented.

16. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed, it implements a method for constructing a risk optimization model for a power terminal as described in any one of claims 1 to 6, or a method for protecting the operation and maintenance safety of a power terminal as described in any one of claims 8 to 13.

Images