Access control method of distributed new energy grid-connected system based on grid architecture

Abstract

The invention relates to the technical field of access control, in particular to an access control method of a distributed new energy grid-connected system based on a grid architecture. By deploying the zero-trust generic terminal security gateway, the identity information of all new energy terminals in the grid is comprehensively mastered, dynamic authorization and access control are realized, and the problem that a static authorization mechanism cannot adapt to a dynamic network environment is solved; by performing continuous trust evaluation and dynamic permission adjustment on the target terminal, the limitation that a traditional method depends on a predefined rule and a fixed trust boundary is overcome; meanwhile, the terminal behavior is continuously monitored, and the session can be immediately terminated and re-authenticated once an exception is found, so that the defect that the prior art lacks real-time evaluation and response capability is effectively overcome; therefore, the access control method provided by the invention can effectively cope with complex and changeable threats and attacks in the smart power grid, and the security of the distributed new energy grid-connected system is remarkably improved.

Description

Technical Field

[0001] The present application relates to the technical field of access control, and in particular to an access control method for a distributed new energy grid-connected system based on a grid architecture. Background Art

[0002] With the development of smart grids, distributed renewable energy grid-connected systems are becoming increasingly complex. Terminal access methods are diverse, such as mobile terminals, Windows terminals, Linux terminals, and virtual cloud terminals. At the same time, a large number of terminal sensing devices are exposed to outdoor environments, facing greater security risks. Therefore, it is particularly important to effectively authorize access and access control to sensing terminals in the power grid.

[0003] The existing access control model usually consists of three parts: subject, target and rule. Asset discovery technology is mainly divided into two categories: active scanning and passive monitoring. Active scanning technology can be further divided into agent-based and agentless. Agentless active scanning technology is more feasible in smart grids. Common agentless active scanning technology scans network devices based on network protocols such as ARP, ICMP and SNMP.

[0004] Existing access control methods usually use static authorization mechanisms, which cannot adapt to the dynamically changing network environment and security requirements in smart grids. Traditional methods often rely on predefined rules and fixed trust boundaries, which are difficult to deal with complex and changing threats and attacks. In addition, existing technologies lack the ability to continuously monitor and evaluate terminal devices in real time, and cannot promptly detect and respond to potential security risks. This situation needs to be further improved. Summary of the invention

[0005] In order to solve the problem that the existing static authorization mechanism cannot adapt to the dynamic network environment, the present application provides an access control method for a distributed new energy grid-connected system based on a grid architecture, which adopts the following technical solutions: In a first aspect, the present application provides an access control method for a distributed new energy grid-connected system based on a grid architecture, comprising the following steps: Deploy a zero-trust pan-endpoint security gateway to perform dynamic authorization and access control; Active scanning and passive traffic analysis are performed through the security gateway to determine the identity information of all new energy terminals in the grid; Based on the collected identity information, identity authentication is performed on a target terminal requesting grid connection, the target terminal being any one of all the new energy terminals; If the identity authentication is passed, a continuous trust evaluation is performed on the target terminal, and based on the trust evaluation result, the access rights of the target terminal are dynamically adjusted; Perform identity-based dynamic authorization to allow or block access of the target terminal; The behavior of the target terminal is continuously monitored. If abnormal behavior is found, the current session is immediately terminated and identity authentication and trust evaluation are performed again.

[0006] By adopting the above technical solution, this application deploys a zero-trust pan-terminal security gateway to fully grasp the identity information of all new energy terminals in the grid, realize dynamic authorization and access control, and solve the problem that the static authorization mechanism cannot adapt to the dynamic network environment; by performing continuous trust evaluation and dynamic permission adjustment on the target terminal, it overcomes the limitations of traditional methods that rely on predefined rules and fixed trust boundaries; at the same time, this application continuously monitors terminal behavior, and once an abnormality is found, the session can be terminated and re-authenticated immediately, which effectively makes up for the lack of real-time evaluation and response capabilities of the existing technology; therefore, the access control method provided by this application can effectively respond to complex and changeable threats and attacks in smart grids, and significantly improve the security of distributed new energy grid-connected systems.

[0007] Optionally, the identity information includes IP address, MAC address, open ports, operating system type, running services and characteristic messages.

[0008] By adopting the above technical solution, the present application builds a more complete and reliable terminal identity portrait through multi-dimensional information collection. First, the network identity of the device is determined by the IP address and MAC address, and then the open ports are scanned to understand possible services and applications. Then, the operating system type is identified to grasp the basic environment of the device, and then the functional characteristics of the device are analyzed by running services. Finally, the communication mode of the device is captured through characteristic messages. This not only improves the accuracy of device identification, but also provides a basis for subsequent access control and security management, thereby enhancing the security and reliability of the entire system.

[0009] Optionally, the trust assessment includes real-time assessment of multi-dimensional risk parameters, where the multi-dimensional risk parameters include terminal identity or type, access time, network location, and device security status.

[0010] By adopting the above technical solution, the present application first determines the basic trust level according to the terminal identity or type, then judges the potential abnormal behavior in combination with the access time, then evaluates the possible geographical risks through the network location, and finally evaluates the overall security of the terminal according to the device security status. It can not only comprehensively reflect the current security status of the terminal, but also timely capture possible risk changes, thereby providing accurate decision-making basis for dynamic authorization and access control.

[0011] Optionally, the abnormal behavior includes a MAC address change, a feature packet change, or a service port change.

[0012] By adopting the above technical solution, the present application first monitors the changes of MAC addresses to detect possible device impersonation or identity deception; secondly, analyzes the changes of feature packets to identify potential abnormal communication patterns or malware activities; finally, monitors the changes of service ports to detect unauthorized service startup or backdoor programs.

[0013] Optionally, the method further comprises the following steps: Determining a dynamic trust score of the target terminal based on historical behavior, current state, and environmental factors of the target terminal; Based on the dynamic trust score, an access authority level of the target terminal is determined.

[0014] By adopting the above technical solution, this application first analyzes the historical behavior of the target terminal; secondly, it evaluates the current state, and then considers environmental factors to comprehensively calculate a dynamic trust score, and determines the access permission level of the terminal based on the dynamic trust score, thereby realizing fine-grained permission control from highly restricted to fully trusted.

[0015] Optionally, the method further comprises the following steps: Obtain a pre-established distributed new energy terminal energy flow model, and based on the energy flow model, track and analyze the energy generation, transmission, storage and consumption of the target terminal in real time; Calculate and allocate dynamic energy credits for the target terminal based on the real-time tracking and analysis results; Using the energy credit of the target terminal as an additional trust evaluation parameter to dynamically adjust the access rights of the target terminal; The current energy flow of the target terminal is compared with the model expectation. When an abnormal energy flow pattern is detected, a deep security check of the target terminal is triggered, and the access rights of the target terminal are adjusted accordingly.

[0016] By adopting the above-mentioned technical solution, the present application first establishes an energy flow model of distributed new energy terminals for real-time tracking and analysis of the energy generation, transmission, storage and consumption of the terminals; then, based on the analysis results, a dynamic energy credit is calculated and allocated for each terminal as an additional trust assessment parameter for dynamically adjusting the access rights of the terminal; at the same time, the system continuously compares the current energy flow of the terminal with the model expectations. Once an abnormal energy flow pattern is detected, a deep security check is triggered and the access rights are adjusted accordingly, thereby being able to more comprehensively assess the credibility of the terminal and effectively prevent attacks based on energy manipulation.

[0017] Optionally, the deep security check includes: Performing time series analysis on the historical energy data of the target terminal to identify long-term abnormal patterns; Compare the energy behavior of the target terminal with other terminals of the same type to discover potential group anomalies; Analyzing the correlation between the energy behavior of the target terminal and external environmental factors to identify unreasonable energy patterns; Based on the deep security check results, a personalized permission recovery plan is formulated for the target terminal, and the permission recovery plan includes an observation period, restriction release conditions and progressive permission recovery steps.

[0018] By adopting the above technical solution, the present application first performs a time series analysis on the historical energy data of the target terminal to identify possible long-term abnormal patterns; secondly, compares the energy behavior of the target terminal with that of terminals of the same type to discover potential group anomalies; then, analyzes the correlation between the energy behavior of the target terminal and external environmental factors to identify unreasonable energy patterns; based on the results of the deep security check, formulates a personalized permission recovery plan for the target terminal, including setting an observation period, clarifying the conditions for lifting restrictions, and designing progressive permission recovery steps. Targeted recovery strategies can be formulated according to specific circumstances, which not only ensures the security of the system, but also provides a flexible permission management mechanism.

[0019] Optionally, the method further comprises the following steps: Constructing a terminal-anomaly type matrix, an anomaly type-recovery strategy matrix, and an environmental factor-energy mode matrix including the target terminal; Based on the in-depth security check result of the target terminal and the execution effect of the permission recovery solution, regularly update the matrix elements related to the target terminal; Calculating the optimal recovery strategy combination of the target terminal by using matrix operations; Based on the time dimension, analyzing the abnormal behavior of the target terminal and the time evolution of the recovery process; Based on the analysis results, the deep security inspection process and permission recovery solution for the target terminal are dynamically optimized.

[0020] By adopting the above-mentioned technical scheme, the present application first constructs a terminal-anomaly type matrix, an anomaly type-recovery strategy matrix and an environmental factor-energy mode matrix, and then regularly updates these matrices based on the deep security check results and the execution effect of the permission recovery scheme, and uses matrix operations to quickly calculate the optimal recovery strategy combination for the target terminal; at the same time, through the time evolution analysis of the terminal abnormal behavior and the recovery process, the deep security check process and the permission recovery scheme are dynamically optimized; thereby, complex security scenarios can be automatically processed to achieve accurate matching and dynamic adjustment of strategies.

[0021] In a second aspect, the present application provides an access control system for a distributed new energy grid-connected system based on a grid architecture, comprising: Security gateway deployment module, used to deploy zero-trust pan-endpoint security gateways to perform dynamic authorization and access control; An identity information determination module, used to perform active scanning and passive traffic analysis through the security gateway to determine the identity information of all new energy terminals in the grid; An identity authentication module, used to perform identity authentication on a target terminal requesting grid connection based on the collected identity information, wherein the target terminal is any one of all the new energy terminals; An access rights adjustment module, configured to perform a continuous trust evaluation on the target terminal if the identity authentication is passed, and dynamically adjust the access rights of the target terminal based on the trust evaluation result; A dynamic authorization module, used to perform identity-based dynamic authorization to allow or block access of the target terminal; The behavior monitoring module is used to continuously monitor the behavior of the target terminal. If abnormal behavior is found, the current session is immediately terminated and identity authentication and trust evaluation are re-performed.

[0022] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the access control method for the distributed new energy grid-connected system based on the grid architecture are implemented.

[0023] In summary, the present application includes at least one of the following beneficial technical effects: 1. This application deploys a zero-trust pan-terminal security gateway to fully grasp the identity information of all new energy terminals in the grid, realize dynamic authorization and access control, and solve the problem that the static authorization mechanism cannot adapt to the dynamic network environment; by continuously evaluating the trust and dynamically adjusting the permissions of the target terminal, it overcomes the limitations of the traditional method that relies on predefined rules and fixed trust boundaries; at the same time, this application continuously monitors the terminal behavior, and once an abnormality is found, the session can be terminated and re-authenticated immediately, which effectively makes up for the lack of real-time evaluation and response capabilities of the existing technology; therefore, the access control method provided by this application can effectively respond to complex and changeable threats and attacks in smart grids, and significantly improve the security of distributed new energy grid-connected systems; 2. This application first establishes an energy flow model for distributed new energy terminals to track and analyze the energy generation, transmission, storage and consumption of terminals in real time; then, based on the analysis results, a dynamic energy credit is calculated and allocated to each terminal as an additional trust evaluation parameter for dynamically adjusting the access rights of the terminal; at the same time, the system continuously compares the current energy flow of the terminal with the model expectations. Once an abnormal energy flow pattern is detected, a deep security check is triggered and the access rights are adjusted accordingly, so that the credibility of the terminal can be more comprehensively evaluated and attacks based on energy manipulation can be effectively prevented; 3. This application first constructs a terminal-anomaly type matrix, an anomaly type-recovery strategy matrix and an environmental factor-energy mode matrix, and then regularly updates these matrices based on the deep security inspection results and the execution effect of the permission recovery plan, and uses matrix operations to quickly calculate the optimal recovery strategy combination for the target terminal; at the same time, through the time evolution analysis of the terminal's abnormal behavior and recovery process, the deep security inspection process and the permission recovery plan are dynamically optimized; thereby, complex security scenarios can be automatically processed and accurate matching and dynamic adjustment of policies can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 It is a flow chart of an access control method of a distributed new energy grid-connected system based on a grid architecture according to an embodiment of the present application; Figure 2 It is a schematic diagram of a process of determining a dynamic trust score in an access control method for a distributed new energy grid-connected system based on a grid architecture according to an embodiment of the present application; Figure 3 It is a schematic diagram of a process of allocating energy credits in an access control method for a distributed new energy grid-connected system based on a grid architecture according to an embodiment of the present application; Figure 4 It is a flow chart of formulating a permission recovery scheme in an access control method for a distributed new energy grid-connected system based on a grid architecture according to an embodiment of the present application; Figure 5 It is a flowchart of matrix operations in an access control method for a distributed new energy grid-connected system based on a grid architecture according to an embodiment of the present application; Figure 6 It is a module schematic diagram of an access control system of a distributed new energy grid-connected system based on a grid architecture according to an embodiment of the present application; Figure 7 It is a diagram of the internal structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0025] The terms used in the following embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to be used as limitations to the present application. As used in the specification and appended claims of the present application, the singular expressions "one", "a kind of", "said", "above", "the" and "this" are intended to also include plural expressions, unless there is a clear indication to the contrary in the context. It should also be understood that the term "and / or" used in the present application refers to any or all possible combinations comprising one or more listed items.

[0026] In the following, the terms "first" and "second" are used for descriptive purposes only and are not to be understood as suggesting or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features, and in the description of the embodiments of the present application, unless otherwise specified, "plurality" means two or more.

[0027] The embodiments of the present application are further described in detail below in conjunction with the drawings in the specification.

[0028] In the first aspect, the present application provides an access control method for a distributed new energy grid-connected system based on a grid architecture, referring to Figure 1 , including the following steps: S110. Deploy a zero-trust pan-endpoint security gateway to perform dynamic authorization and access control.

[0029] In this embodiment, the zero-trust pan-terminal security gateway is a network security device based on the zero-trust security model, which can manage various types of new energy terminal devices, including, for example, smart meters, charging piles, power plant terminals, microgrid systems, Internet of Vehicles charging systems, charging modules of shared bikes, etc. The gateway is deployed at the network boundary of the distributed new energy grid-connected system to intercept and control all traffic in and out of the network.

[0030] Specifically, the zero-trust pan-terminal security gateway can be deployed in the form of hardware devices or software. For example, you can choose a next-generation firewall that supports zero-trust architecture as a hardware gateway, or deploy dedicated zero-trust gateway software on a server. Gateway configuration includes enabling functions such as identity authentication, access control, and encrypted communication, and setting up a policy engine to support dynamic authorization decisions.

[0031] S120. Perform active scanning and passive traffic analysis through a security gateway to determine the identity information of all new energy terminals in the grid.

[0032] In this embodiment, active scanning refers to the gateway actively detecting devices in the network and collecting their information. Passive traffic analysis refers to analyzing the network traffic passing through the gateway and extracting information about the devices therefrom.

[0033] Specifically, active scanning technology actively detects and discovers devices within the address range of the management configuration, collects fingerprint information of IoT terminal devices, such as IP address, MAC address, port open status, protocol version, etc., and thus identifies the terminals existing in the network. Existing active scanning technologies are mainly divided into host scanning technology, port scanning technology and vulnerability scanning technology. Active scanning technology can be further divided into active scanning technology with agents and active scanning technology without agents. The difference between the two is whether there is a corresponding agent on the scanned terminal side to respond to the authorized active scanning. However, in smart grids, due to the limitations of terminal devices in computing power, storage space, etc., agentless active scanning technology is more feasible. Most mainstream agentless active scanning technologies are based on network protocols such as ARP, ICMP and SNMP to scan network devices. Some common scanning tools include Nmap, X-Scan, Advanced Port Scanner, Zmap, etc. Passive traffic analysis refers to the security gateway analyzing the traffic data from the core router mirror to observe the characteristic message status of the terminal.

[0034] S130. Based on the collected identity information, identity authentication is performed on the target terminal requesting to be connected to the grid, where the target terminal is any one of all the new energy terminals.

[0035] The identity information includes IP address, MAC address, open ports, operating system type, running services and characteristic messages.

[0036] Specifically, when a new energy terminal requests to access the network, the security gateway first intercepts the request. The gateway requires the terminal to provide identity credentials, such as digital certificates, device IDs, etc. The gateway then compares the provided credentials with the previously collected identity information. The comparison process includes verifying the consistency of the IP address and MAC address, analyzing the terminal's network behavior and response characteristics, determining whether its operating system type is consistent with the record, checking whether the open ports and running services are as expected, and analyzing whether the characteristic messages match. If the credentials match and are valid, the authentication is passed; otherwise, the access request is rejected.

[0037] S140: If the identity authentication is passed, a continuous trust evaluation is performed on the target terminal, and the access rights of the target terminal are dynamically adjusted based on the trust evaluation result.

[0038] In this embodiment, trust evaluation is a process of continuously evaluating the credibility of a terminal, which is achieved by evaluating multi-dimensional risk parameters in real time, including terminal identity or type, access time, network location, and device security status.

[0039] Specifically, the system sets up a trust scoring mechanism to assign different weights to the risk parameters of each dimension. For example, different basic scores are assigned according to the terminal type (such as critical power generation equipment or ordinary monitoring equipment), and then points are added or subtracted based on factors such as access time (whether it is within normal working hours), network location (whether it is from the expected network segment), and device security status (such as patch updates, antivirus software status). The final trust score determines the range of resources that the terminal can access and the type of operations performed. This scoring process is continuous, and the system will continuously update the trust score based on the real-time status of the terminal and adjust access rights accordingly.

[0040] S150: Perform identity-based dynamic authorization to allow or block access of the target terminal.

[0041] Specifically, the system predefines a series of access policy templates, each corresponding to a different identity type and trust level. When a terminal requests access to a resource, the authorization system will comprehensively consider its identity characteristics (such as device type, functional role, etc.) and the current trust score, and select the most suitable policy template. For example, for a critical power generation equipment with a high trust score, it is granted a higher access right and allowed to perform key operations; while for an ordinary monitoring device with a low trust score, it is only allowed to perform basic data reading operations.

[0042] S160. Continuously monitor the behavior of the target terminal. If abnormal behavior is found, immediately terminate the current session and re-perform identity authentication and trust assessment.

[0043] Among them, abnormal behavior includes changes in MAC address, feature package or service port.

[0044] Specifically, the security gateway continuously monitors the target terminals that have been connected to the network and analyzes their network behavior and communication patterns in real time. It then periodically checks the MAC address of the target terminal. If it is found to be inconsistent with the MAC address recorded during the initial authentication, it is considered an abnormality. It continuously analyzes the data packets sent by the target terminal. If a characteristic packet change that is inconsistent with the normal pattern is observed, it is marked as an abnormality. It monitors the service ports opened by the target terminal. If an unauthorized port is detected to be opened or closed, it is determined to be an abnormality. Once any of the above abnormal behaviors is detected, the security gateway immediately triggers the response mechanism. First, the security gateway immediately terminates the current network session of the target terminal and cuts off its connection to the network. At the same time, the abnormal event is recorded in the security log for subsequent analysis and auditing. After terminating the session, the security gateway requires the target terminal to re-authenticate. This authentication process may be more stringent than the initial authentication and may require additional verification steps or manual intervention.

[0045] In one embodiment, referring to Figure 2 , the method further comprises the following steps: S210: Determine a dynamic trust score of the target terminal based on historical behaviors, current status, and environmental factors of the target terminal.

[0046] Among them, historical behavior includes the terminal's past access patterns, abnormal event records and compliance performance; the current status includes the terminal's real-time network activity, resource usage and security patch status; environmental factors take into account the overall network security situation, time sensitivity and geographic location.

[0047] Specifically, the system uses a multi-dimensional scoring model to calculate the dynamic trust score. First, historical behaviors are weighted and scored, and terminals with good long-term performance receive higher basic scores. Then, the basic score is adjusted according to the current status. For example, the score will be lowered if abnormal network activity is detected. Finally, environmental factors are used as correction factors to reduce the overall trust score in specific time periods or high-risk areas.

[0048] S220: Determine the access permission level of the target terminal based on the dynamic trust score.

[0049] The system predefines multiple access rights levels, each corresponding to a different range of trust scores. As the dynamic trust score changes, the terminal's access rights level will also be adjusted accordingly, achieving trust-based adaptive access control.

[0050] Specifically, the system sets the following access rights levels: high trust (allowing full access), medium trust (allowing limited access), low trust (allowing only minimal necessary access), and untrust (denying all access). When the dynamic trust score of a terminal changes, the system re-evaluates its permission level.

[0051] In one embodiment, referring to Figure 3 , the method further comprises the following steps: S310: Obtain a pre-established distributed new energy terminal energy flow model, and based on the energy flow model, track and analyze the energy generation, transmission, storage and consumption of the target terminal in real time.

[0052] Among them, the energy flow model of distributed new energy terminals describes the energy flow law of new energy terminals under different times and environmental conditions.

[0053] Specifically, the system collects energy-related data in real time, including power generation, energy storage, power consumption, etc., through energy monitoring devices deployed on the terminal. These data are input into the pre-established energy flow model, and the model calculates the theoretical energy flow based on the current environmental parameters (such as sunshine intensity, temperature, etc.). The system compares the actual observed energy flow with the theoretical value predicted by the model to derive the energy efficiency and degree of abnormality of the terminal. For example, if the power generation of a solar terminal on a sunny day is much lower than the model expects, the system will mark this situation as a potential abnormality, which may be a sign of equipment failure or malicious interference.

[0054] S320: Calculate and allocate dynamic energy credits for target terminals based on real-time tracking and analysis results.

[0055] Among them, energy credit is a comprehensive indicator that reflects the efficiency and reliability of terminal energy use. Efficient and stable terminals will obtain higher energy credits.

[0056] Specifically, this embodiment uses a points-based method to calculate energy credits. When the terminal is operating normally, points will be gradually accumulated, and points will be deducted if abnormal behavior occurs. The speed of increase or decrease of points will be dynamically adjusted according to the nature and duration of the behavior.

[0057] S330: Using the energy credit of the target terminal as an additional trust evaluation parameter to dynamically adjust the access rights of the target terminal.

[0058] Specifically, this embodiment converts the energy credit into a standardized trust factor, which together with other security parameters such as identity authentication strength, historical behavior records, etc., jointly determines the access permission level of the terminal. For example, the system sets a threshold, and when the energy credit exceeds this threshold, the overall trust score of the terminal is improved, so that a higher level of access permission may be obtained.

[0059] S340, comparing the current energy flow of the target terminal with the model expectation, when an abnormal energy flow pattern is detected, triggering a deep security check of the target terminal, and adjusting the access rights of the target terminal accordingly.

[0060] Among them, abnormal energy flow patterns may be early indicators of equipment failure, environmental changes or security threats.

[0061] Specifically, the system continuously compares the actual energy flow data of the terminal with the expected value of the model. When significant deviations are detected, a series of in-depth safety inspection procedures will be triggered.

[0062] In one embodiment, referring to Figure 4 In step S340, the deep security check includes: S341. Perform time series analysis on the historical energy data of the target terminal to identify long-term abnormal patterns.

[0063] Among them, by performing time series analysis on the historical energy data of the target terminal, long-term abnormal behaviors that are not easily discovered by real-time monitoring can be identified.

[0064] In this embodiment, the sliding window method is used to analyze the historical energy data of the terminal, and the prediction model is applied to model the processed data to predict the future energy behavior trend. If there is a significant and continuous deviation between the actual observed value and the predicted value, the system will mark it as a long-term abnormal pattern.

[0065] S342. Compare the energy behavior of the target terminal with that of other terminals of the same type to discover potential group anomalies.

[0066] Among them, terminals of the same type and close geographical location should show similar energy behavior patterns. This embodiment identifies individual terminals with abnormal performance through horizontal comparison, and discovers possible systemic problems or regional anomalies. For example, in a group consisting of multiple wind power generation terminals, if most terminals report normal power generation, but the power generation of the target terminal is abnormally low, the system will regard it as an example of group anomaly, and may require targeted safety inspections.

[0067] S343. Analyze the correlation between the energy behavior of the target terminal and external environmental factors, and identify unreasonable energy patterns.

[0068] Specifically, the energy behavior of the terminal is used as the dependent variable, and the relevant external environmental factors such as sunshine intensity, wind speed, temperature, grid load, etc. are used as independent variables. The system continuously collects these environmental data and predicts the ideal energy behavior of the terminal under the current conditions through the model. If there is a significant difference between the actual observed value and the model predicted value, it will be marked as an unreasonable energy mode.

[0069] S344. Based on the results of the deep security check, a personalized permission recovery plan is formulated for the target terminal. The permission recovery plan includes an observation period, restriction lifting conditions, and progressive permission recovery steps.

[0070] Specifically, the system first sets an observation period for the terminal based on the results of the deep security check. The length of the observation period depends on the severity of the anomaly and may range from a few hours to a few weeks. During the observation period, the terminal's access rights will be restricted to the minimum necessary level. At the same time, the system will formulate a series of conditions for lifting restrictions, which may include continuous normal operation time, energy efficiency improvement, and passing of security audits. When the terminal meets these conditions, the system will initiate a progressive permission recovery step. For example, for a photovoltaic terminal whose permissions are restricted due to energy anomalies, its permission recovery plan may include: a 7-day observation period, during which the energy behavior is required to be more than 95% consistent with the model expectations, and then increase the permission level every 3 days until it is fully restored.

[0071] In one embodiment, referring to Figure 5 , the method further comprises the following steps: S510: Construct a terminal-abnormal type matrix including the target terminal, an abnormal type-recovery strategy matrix, and an environmental factor-energy mode matrix.

[0072] Specifically, the system first collects historical data, including abnormal records of terminals, recovery strategies adopted and their effects, and the correspondence between environmental factors and energy patterns. Then, three matrices are initialized using these data. For example, in the terminal-anomaly type matrix, each element represents the frequency of a specific type of abnormality occurring at a certain terminal; in the anomaly type-recovery strategy matrix, the element value indicates the effectiveness of a certain recovery strategy for a specific anomaly type; in the environmental factor-energy pattern matrix, the elements reflect the expected energy pattern under certain environmental conditions.

[0073] S520: Based on the in-depth security check result of the target terminal and the execution effect of the permission recovery solution, regularly update the matrix elements related to the target terminal.

[0074] Specifically, the system sets a regular update cycle, such as weekly. During each update cycle, the system collects the results of the deep security check of the target terminal and the execution effect of the permission recovery plan during that period. The system then uses this new data to adjust the relevant matrix elements. For example, if it is found that the frequency of a certain type of anomaly on the target terminal increases, the system will increase the corresponding value in the terminal-anomaly type matrix accordingly.

[0075] S530: Calculate the optimal recovery strategy combination of the target terminal by using matrix operations.

[0076] In this embodiment, the system first multiplies the terminal-anomaly type matrix with the anomaly type-recovery strategy matrix to obtain a terminal-recovery strategy matrix, in which each element represents the potential effectiveness of a recovery strategy for a specific terminal. Then, relevant information is extracted from the environmental factor-energy mode matrix and applied to the terminal-recovery strategy matrix as a weight factor.

[0077] S540: Analyze the abnormal behavior of the target terminal and the time evolution of the recovery process based on the time dimension.

[0078] Among them, the analysis of the time dimension can reveal the dynamic characteristics of abnormal terminal behavior and recovery process. By tracking the changes of these characteristics over time, the system can identify potential periodic patterns, long-term trends or sudden events.

[0079] S550. Based on the analysis results, dynamically optimize the deep security inspection process and permission recovery solution for the target terminal.

[0080] Specifically, the system uses the analysis results of the previous steps, including the optimal strategy combination obtained by matrix operations and the patterns revealed by time dimension analysis, to adjust the deep security inspection process and permission recovery plan. For example, if the time analysis shows that a certain type of anomaly is more frequent in a specific period of time, the system will increase the frequency or intensity of inspections during these periods.

[0081] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0082] On the second aspect, the present application provides an access control system for a distributed new energy grid-connected system based on a grid architecture. The access control system for a distributed new energy grid-connected system based on a grid architecture of the present application is described below in combination with the access control method for the distributed new energy grid-connected system based on a grid architecture mentioned above.

[0083] Reference Figure 6 , an access control system for a distributed new energy grid-connected system based on a grid architecture, comprising: Security gateway deployment module, used to deploy zero-trust pan-endpoint security gateways to perform dynamic authorization and access control; An identity information determination module is used to perform active scanning and passive traffic analysis through a security gateway to determine the identity information of all new energy terminals in the grid; An identity authentication module, used to authenticate the target terminal requesting grid connection based on the collected identity information, where the target terminal is any one of all new energy terminals; The access permission adjustment module is used to continuously evaluate the trust of the target terminal if the identity authentication is passed, and dynamically adjust the access permission of the target terminal based on the trust evaluation result; Dynamic authorization module, used to perform identity-based dynamic authorization to allow or block access to the target terminal; The behavior monitoring module is used to continuously monitor the behavior of the target terminal. If abnormal behavior is found, the current session will be terminated immediately and identity authentication and trust assessment will be re-performed.

[0084] In one embodiment, the present application provides an electronic device, which may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The electronic device includes a processor, a memory and a network interface connected via a system bus. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the electronic device is used to store data. The network interface of the electronic device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, an access control method for a distributed new energy grid-connected system based on a grid architecture is implemented.

[0085] Those skilled in the art will understand that Figure 7 The structure shown in the figure is merely a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the electronic device to which the scheme of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0086] In one embodiment, an electronic device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0087] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the above-mentioned computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0088] The above are all preferred embodiments of the present application, and the protection scope of the present application is not limited thereto. Therefore, any equivalent changes made according to the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. An access control method for a distributed new energy grid-connected system based on a grid architecture, characterized in that: The steps include: Deploy a zero-trust pan-endpoint security gateway to perform dynamic authorization and access control; Active scanning and passive traffic analysis are performed through the security gateway to determine the identity information of all new energy terminals in the grid; Based on the collected identity information, identity authentication is performed on a target terminal requesting grid connection, the target terminal being any one of all the new energy terminals; If the identity authentication is passed, a continuous trust evaluation is performed on the target terminal, and based on the trust evaluation result, the access rights of the target terminal are dynamically adjusted; Perform identity-based dynamic authorization to allow or block access of the target terminal; The behavior of the target terminal is continuously monitored. If abnormal behavior is found, the current session is immediately terminated and identity authentication and trust evaluation are performed again.

2. The access control method for a distributed new energy grid-connected system based on a grid architecture according to claim 1, characterized in that: The identity information includes IP address, MAC address, open ports, operating system type, running services and characteristic messages.

3. The access control method for a distributed new energy grid-connected system based on a grid architecture according to claim 2 is characterized in that: The trust assessment includes real-time assessment of multi-dimensional risk parameters including terminal identity or type, access time, network location, and device security status.

4. The access control method for a distributed new energy grid-connected system based on a grid architecture according to claim 2, characterized in that: The abnormal behavior includes a change in a MAC address, a change in a feature package, or a change in a service port.

5. The access control method for a distributed new energy grid-connected system based on a grid architecture according to claim 1, characterized in that: The method further comprises the steps of: Determining a dynamic trust score of the target terminal based on historical behavior, current state, and environmental factors of the target terminal; Based on the dynamic trust score, an access authority level of the target terminal is determined.

6. The access control method for a distributed new energy grid-connected system based on a grid architecture according to claim 1, characterized in that: The method further comprises the steps of: Obtain a pre-established distributed new energy terminal energy flow model, and based on the energy flow model, track and analyze the energy generation, transmission, storage and consumption of the target terminal in real time; Calculate and allocate dynamic energy credits for the target terminal based on the real-time tracking and analysis results; Using the energy credit of the target terminal as an additional trust evaluation parameter to dynamically adjust the access rights of the target terminal; The current energy flow of the target terminal is compared with the model expectation. When an abnormal energy flow pattern is detected, a deep security check of the target terminal is triggered, and the access rights of the target terminal are adjusted accordingly.

7. The access control method for a distributed new energy grid-connected system based on a grid architecture according to claim 6, characterized in that: The in-depth security check includes: Performing time series analysis on the historical energy data of the target terminal to identify long-term abnormal patterns; Compare the energy behavior of the target terminal with other terminals of the same type to discover potential group anomalies; Analyzing the correlation between the energy behavior of the target terminal and external environmental factors to identify unreasonable energy patterns; Based on the deep security check results, a personalized permission recovery plan is formulated for the target terminal, and the permission recovery plan includes an observation period, restriction release conditions and progressive permission recovery steps.

8. The access control method for a distributed new energy grid-connected system based on a grid architecture according to claim 7, characterized in that: The method further comprises the steps of: Constructing a terminal-anomaly type matrix, an anomaly type-recovery strategy matrix, and an environmental factor-energy mode matrix including the target terminal; Based on the in-depth security check result of the target terminal and the execution effect of the permission recovery solution, regularly update the matrix elements related to the target terminal; Calculating the optimal recovery strategy combination of the target terminal by using matrix operations; Based on the time dimension, analyzing the abnormal behavior of the target terminal and the time evolution of the recovery process; Based on the analysis results, the deep security inspection process and permission recovery solution for the target terminal are dynamically optimized.

9. An access control system for a distributed new energy grid-connected system based on a grid architecture, characterized in that: include: Security gateway deployment module, used to deploy zero-trust pan-endpoint security gateways to perform dynamic authorization and access control; An identity information determination module, used to perform active scanning and passive traffic analysis through the security gateway to determine the identity information of all new energy terminals in the grid; An identity authentication module, used to perform identity authentication on a target terminal requesting grid connection based on the collected identity information, wherein the target terminal is any one of all the new energy terminals; An access rights adjustment module, configured to perform a continuous trust evaluation on the target terminal if the identity authentication is passed, and dynamically adjust the access rights of the target terminal based on the trust evaluation result; A dynamic authorization module, used to perform identity-based dynamic authorization to allow or block access of the target terminal; The behavior monitoring module is used to continuously monitor the behavior of the target terminal. If abnormal behavior is found, the current session is immediately terminated and identity authentication and trust evaluation are re-performed.

10. An electronic device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the access control method for a distributed new energy grid-connected system based on a grid architecture described in any one of claims 1 to 8 are implemented.

Images