Access control method for grid architecture-based distributed new energy grid-connected system

Abstract

The application relates to the technical field of access control, in particular to an access control method of a grid architecture-based distributed new energy grid-connected system. The application comprehensively masters the identity information of all new energy terminals in the grid by deploying a zero-trust general terminal security gateway, realizes dynamic authorization and access control, and solves the problem that a static authorization mechanism cannot adapt to a dynamic network environment; through continuous trust evaluation and dynamic permission adjustment on the target terminal, the limitation of traditional methods relying on predefined rules and fixed trust boundaries is overcome; meanwhile, the application continuously monitors the terminal behavior, and once an anomaly is found, the session can be terminated and re-authenticated immediately, effectively making up for the deficiency of the prior art in lacking real-time evaluation and response capability; therefore, the access control method provided by the application can effectively cope with complex and changeable threats and attacks in the smart grid, and significantly improves the security of the distributed new energy grid-connected system.

Description

Technical Field

[0001] The present application relates to the technical field of access control, and in particular to an access control method for a distributed new energy grid-connected system based on a grid architecture. Background Art

[0002] With the development of smart grids, distributed renewable energy grid-connected systems are becoming increasingly complex. Terminal access methods are diverse, including mobile terminals, Windows terminals, Linux terminals, and virtual cloud terminals. Furthermore, a large number of terminal sensing devices are exposed to outdoor environments, posing significant security risks. Therefore, effective authorization and access control for sensing terminals in the power grid are crucial.

[0003] Existing access control models typically consist of three components: subjects, targets, and rules. Asset discovery technologies are primarily categorized into active scanning and passive monitoring. Active scanning can be further categorized into agent-based and agentless methods, with agentless active scanning being more feasible in smart grids. Common agentless active scanning techniques scan network devices based on network protocols such as ARP, ICMP, and SNMP.

[0004] Existing access control methods typically employ static authorization mechanisms, which are unable to adapt to the dynamically changing network environment and security requirements of smart grids. Traditional methods often rely on predefined rules and fixed trust boundaries, making them incapable of addressing complex and ever-changing threats and attacks. Furthermore, existing technologies lack the ability to continuously monitor and assess terminal devices in real time, making it difficult to promptly identify and respond to potential security risks. This situation requires further improvement. Summary of the Invention

[0005] In order to solve the problem that the existing static authorization mechanism cannot adapt to the dynamic network environment, this application provides an access control method for a distributed new energy grid-connected system based on a grid architecture, which adopts the following technical solutions:

[0006] In a first aspect, the present application provides an access control method for a distributed new energy grid-connected system based on a grid architecture, comprising the following steps:

[0007] Deploy a zero-trust pan-endpoint security gateway to perform dynamic authorization and access control;

[0008] Active scanning and passive traffic analysis are performed through the security gateway to determine the identity information of all new energy terminals in the grid;

[0009] Based on the collected identity information, identity authentication is performed on a target terminal requesting grid connection, where the target terminal is any one of the new energy terminals;

[0010] If the identity authentication is successful, a continuous trust evaluation is performed on the target terminal, and the access rights of the target terminal are dynamically adjusted based on the trust evaluation results;

[0011] Perform identity-based dynamic authorization to allow or block access by the target terminal;

[0012] The behavior of the target terminal is continuously monitored. If any abnormal behavior is found, the current session is immediately terminated and identity authentication and trust evaluation are performed again.

[0013] By adopting the above-mentioned technical solution, this application deploys a zero-trust pan-terminal security gateway to fully grasp the identity information of all new energy terminals in the grid, realizes dynamic authorization and access control, and solves the problem that the static authorization mechanism cannot adapt to the dynamic network environment; by performing continuous trust evaluation and dynamic permission adjustment on the target terminal, it overcomes the limitations of traditional methods that rely on predefined rules and fixed trust boundaries; at the same time, this application continuously monitors terminal behavior, and once an abnormality is found, it can immediately terminate the session and re-authenticate, effectively making up for the lack of real-time evaluation and response capabilities of existing technologies; therefore, the access control method provided by this application can effectively deal with complex and changeable threats and attacks in smart grids, and significantly improve the security of distributed new energy grid-connected systems.

[0014] Optionally, the identity information includes IP address, MAC address, open port, operating system type, running service and characteristic message.

[0015] By adopting the above technical solution, this application builds a more complete and reliable terminal identity portrait through multi-dimensional information collection. First, the network identity of the device is determined by the IP address and MAC address, and then the open ports are scanned to understand possible services and applications. Then, the operating system type is identified to grasp the basic environment of the device, and then the functional characteristics of the device are analyzed by running services. Finally, the communication mode of the device is captured through characteristic messages. This not only improves the accuracy of device identification, but also provides a basis for subsequent access control and security management, thereby enhancing the security and reliability of the entire system.

[0016] Optionally, the trust assessment includes real-time assessment of multi-dimensional risk parameters, where the multi-dimensional risk parameters include terminal identity or type, access time, network location, and device security status.

[0017] By adopting the above technical solution, this application first determines the basic trust level based on the terminal identity or type, then judges potential abnormal behavior based on the access time, then evaluates possible geographical risks through network location, and finally evaluates the overall security of the terminal based on the device security status. It can not only comprehensively reflect the current security status of the terminal, but also capture possible risk changes in a timely manner, thereby providing accurate decision-making basis for dynamic authorization and access control.

[0018] Optionally, the abnormal behavior includes a MAC address change, a feature packet change, or a service port change.

[0019] By adopting the above technical solution, this application first monitors changes in MAC addresses to detect possible device impersonation or identity deception; secondly, analyzes changes in feature packets to identify potential abnormal communication patterns or malware activities; and finally, monitors changes in service ports to detect unauthorized service startups or backdoor programs.

[0020] Optionally, the method further includes the following steps:

[0021] Determining a dynamic trust score of the target terminal based on historical behavior, current state, and environmental factors of the target terminal;

[0022] Based on the dynamic trust score, an access authority level of the target terminal is determined.

[0023] By adopting the above technical solution, this application first analyzes the historical behavior of the target terminal; secondly, it evaluates the current status, and then considers environmental factors to comprehensively calculate a dynamic trust score. Based on the dynamic trust score, the access permission level of the terminal is determined to achieve fine-grained permission control from highly restricted to fully trusted.

[0024] Optionally, the method further includes the following steps:

[0025] Obtain a pre-established distributed new energy terminal energy flow model, and based on the energy flow model, track and analyze the energy generation, transmission, storage and consumption of the target terminal in real time;

[0026] Calculate and allocate dynamic energy credits to the target terminal based on real-time tracking and analysis results;

[0027] Using the energy credit of the target terminal as an additional trust evaluation parameter to dynamically adjust the access rights of the target terminal;

[0028] The current energy flow of the target terminal is compared with the model expectation. When an abnormal energy flow pattern is detected, a deep security check of the target terminal is triggered, and the access rights of the target terminal are adjusted accordingly.

[0029] By adopting the above-mentioned technical solution, this application first establishes an energy flow model of distributed new energy terminals for real-time tracking and analysis of the energy generation, transmission, storage and consumption of the terminals; then, based on the analysis results, a dynamic energy credit is calculated and allocated to each terminal as an additional trust assessment parameter for dynamically adjusting the access rights of the terminal; at the same time, the system continuously compares the current energy flow of the terminal with the model expectations. Once an abnormal energy flow pattern is detected, a deep security check is triggered and the access rights are adjusted accordingly, thereby being able to more comprehensively evaluate the credibility of the terminal and effectively prevent attacks based on energy manipulation.

[0030] Optionally, the deep security check includes:

[0031] Performing time series analysis on the historical energy data of the target terminal to identify long-term abnormal patterns;

[0032] Comparing the energy behavior of the target terminal with other terminals of the same type to discover potential group anomalies;

[0033] Analyzing the correlation between the energy behavior of the target terminal and external environmental factors to identify unreasonable energy patterns;

[0034] Based on the results of the deep security check, a personalized permission restoration plan is formulated for the target terminal, and the permission restoration plan includes an observation period, restriction lifting conditions, and progressive permission restoration steps.

[0035] By adopting the above technical solution, this application first performs a time series analysis on the historical energy data of the target terminal to identify possible long-term abnormal patterns; secondly, the energy behavior of the target terminal is compared with that of terminals of the same type to discover potential group anomalies; then, the correlation between the energy behavior of the target terminal and external environmental factors is analyzed to identify unreasonable energy patterns; based on the results of the deep security check, a personalized permission recovery plan is formulated for the target terminal, including setting an observation period, clarifying the conditions for lifting restrictions and designing progressive permission recovery steps. Targeted recovery strategies can be formulated according to specific circumstances, which not only ensures the security of the system but also provides a flexible permission management mechanism.

[0036] Optionally, the method further includes the following steps:

[0037] Constructing a terminal-anomaly type matrix, an anomaly type-recovery strategy matrix, and an environmental factor-energy pattern matrix including the target terminal;

[0038] Based on the results of the deep security check on the target terminal and the execution effect of the permission recovery solution, regularly updating the matrix elements related to the target terminal;

[0039] Calculating the optimal recovery strategy combination of the target terminal using matrix operations;

[0040] Analyzing the abnormal behavior of the target terminal and the time evolution of the recovery process based on the time dimension;

[0041] Based on the analysis results, the deep security inspection process and permission recovery solution for the target terminal are dynamically optimized.

[0042] By adopting the above technical solution, this application first constructs a terminal-anomaly type matrix, an anomaly type-recovery strategy matrix and an environmental factor-energy mode matrix, and then regularly updates these matrices based on the deep security inspection results and the execution effect of the permission recovery plan. By using matrix operations, the optimal recovery strategy combination of the target terminal is quickly calculated; at the same time, through the time evolution analysis of the terminal's abnormal behavior and recovery process, the deep security inspection process and permission recovery plan are dynamically optimized; thereby, complex security scenarios can be automatically handled, and accurate matching and dynamic adjustment of strategies can be achieved.

[0043] In a second aspect, the present application provides an access control system for a distributed new energy grid-connected system based on a grid architecture, comprising:

[0044] Security gateway deployment module, used to deploy zero-trust pan-endpoint security gateways for dynamic authorization and access control;

[0045] An identity information determination module, configured to perform active scanning and passive traffic analysis through the security gateway to determine the identity information of all new energy terminals in the grid;

[0046] An identity authentication module, configured to perform identity authentication on a target terminal requesting grid connection based on the collected identity information, wherein the target terminal is any one of the new energy terminals;

[0047] An access rights adjustment module, configured to perform a continuous trust evaluation on the target terminal if the identity authentication is passed, and dynamically adjust the access rights of the target terminal based on the trust evaluation result;

[0048] A dynamic authorization module, configured to perform identity-based dynamic authorization to allow or block access by the target terminal;

[0049] The behavior monitoring module is used to continuously monitor the behavior of the target terminal. If any abnormal behavior is found, the current session is immediately terminated and identity authentication and trust evaluation are re-performed.

[0050] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the processor implements the steps of the access control method for the distributed new energy grid-connected system based on the grid architecture.

[0051] In summary, this application includes at least one of the following beneficial technical effects:

[0052] 1. This application deploys a zero-trust pan-terminal security gateway to fully grasp the identity information of all new energy terminals in the grid, achieve dynamic authorization and access control, and solve the problem that static authorization mechanisms cannot adapt to dynamic network environments. By continuously evaluating the trust of target terminals and dynamically adjusting permissions, this application overcomes the limitations of traditional methods that rely on predefined rules and fixed trust boundaries. At the same time, this application continuously monitors terminal behavior and can immediately terminate the session and re-authenticate once an anomaly is detected, effectively making up for the lack of real-time evaluation and response capabilities in existing technologies. Therefore, the access control method provided by this application can effectively respond to complex and changing threats and attacks in smart grids and significantly improve the security of distributed new energy grid-connected systems.

[0053] 2. This application first establishes an energy flow model for distributed new energy terminals, which is used to track and analyze the terminals' energy generation, transmission, storage, and consumption in real time. Based on the analysis results, a dynamic energy credit is calculated and allocated to each terminal, which serves as an additional trust assessment parameter for dynamically adjusting the terminal's access rights. Furthermore, the system continuously compares the terminal's current energy flow with the model's expectations. Once an abnormal energy flow pattern is detected, a deep security check is triggered and access rights are adjusted accordingly. This allows for a more comprehensive assessment of the terminal's trustworthiness and effectively prevents attacks based on energy manipulation.

[0054] 3. This application first constructs a terminal-anomaly type matrix, an anomaly type-recovery strategy matrix, and an environmental factor-energy mode matrix. Then, based on the deep security inspection results and the execution effect of the permission recovery plan, these matrices are updated regularly, and the optimal recovery strategy combination of the target terminal is quickly calculated using matrix operations. At the same time, by analyzing the time evolution of the terminal's abnormal behavior and recovery process, the deep security inspection process and permission recovery plan are dynamically optimized. This enables the automatic processing of complex security scenarios and the realization of accurate matching and dynamic adjustment of policies. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 This is a flow chart of an access control method for a distributed new energy grid-connected system based on a grid architecture according to an embodiment of the present application;

[0056] Figure 2This is a flow chart of determining a dynamic trust score in an access control method for a distributed new energy grid-connected system based on a grid architecture according to an embodiment of the present application;

[0057] Figure 3 This is a flow chart of allocating energy credits in an access control method for a distributed new energy grid-connected system based on a grid architecture according to an embodiment of the present application;

[0058] Figure 4 This is a flow chart of formulating a permission recovery scheme in an access control method for a distributed new energy grid-connected system based on a grid architecture according to an embodiment of the present application;

[0059] Figure 5 This is a flowchart of matrix operations in an access control method for a distributed new energy grid-connected system based on a grid architecture according to an embodiment of the present application;

[0060] Figure 6 This is a module diagram of an access control system of a distributed new energy grid-connected system based on a grid architecture according to an embodiment of the present application;

[0061] Figure 7 This is a diagram of the internal structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0062] The terms used in the following examples of the present application are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in the specification and appended claims of this application, the singular expressions "a," "an," "said," "above," "the," and "this" are intended to include plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used in this application refers to any or all possible combinations comprising one or more of the listed items.

[0063] In the following, the terms "first" and "second" are used for descriptive purposes only and should not be understood to imply or suggest relative importance or implicitly indicate the number of the technical features indicated. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of this application, unless otherwise specified, "plurality" means two or more.

[0064] The embodiments of the present application are described in further detail below with reference to the accompanying drawings.

[0065] In the first aspect, the present application provides an access control method for a distributed new energy grid-connected system based on a grid architecture, referring to Figure 1 , including the following steps:

[0066] S110. Deploy a zero-trust pan-endpoint security gateway to perform dynamic authorization and access control.

[0067] In this embodiment, the Zero Trust Pan-Endpoint Security Gateway is a network security device based on the Zero Trust security model. It can manage various types of new energy terminal devices, including smart meters, charging stations, power plant terminals, microgrid systems, Internet of Vehicles charging systems, and shared bike charging modules. This gateway is deployed at the network edge of the distributed new energy grid-connected system to intercept and control all traffic in and out of the network.

[0068] Specifically, a zero-trust endpoint security gateway can be deployed as a hardware appliance or software. For example, a next-generation firewall that supports zero-trust architecture can be used as a hardware gateway, or dedicated zero-trust gateway software can be deployed on a server. Gateway configuration includes enabling authentication, access control, encrypted communications, and setting up a policy engine to support dynamic authorization decisions.

[0069] S120. Perform active scanning and passive traffic analysis through the security gateway to determine the identity information of all new energy terminals in the grid.

[0070] In this embodiment, active scanning refers to the gateway actively detecting devices in the network and collecting their information. Passive traffic analysis refers to analyzing the network traffic passing through the gateway and extracting information about the devices.

[0071] Specifically, active scanning technology proactively detects and discovers devices within a managed address range, collecting fingerprint information about IoT devices, such as IP addresses, MAC addresses, port status, and protocol versions, thereby identifying the devices present on the network. Existing active scanning technologies are primarily categorized as host scanning, port scanning, and vulnerability scanning. Active scanning can be further categorized as agent-based and agentless, differing in whether the scanned device has a corresponding agent to respond to authorized active scanning. However, in smart grids, agentless active scanning is more feasible due to limitations in computing power and storage space on terminal devices. Mainstream agentless active scanning technologies mostly scan network devices based on network protocols such as ARP, ICMP, and SNMP. Common scanning tools include Nmap, X-Scan, Advanced Port Scanner, and Zmap. Passive traffic analysis involves security gateways analyzing traffic data mirrored from core routers to observe characteristic terminal messages.

[0072] S130. Based on the collected identity information, perform identity authentication on the target terminal requesting grid connection, where the target terminal is any one of all new energy terminals.

[0073] The identity information includes IP address, MAC address, open ports, operating system type, running services and characteristic messages.

[0074] Specifically, when a new energy terminal requests to access the network, the security gateway first intercepts the request. The gateway requires the terminal to provide identity credentials, such as a digital certificate, device ID, etc. The gateway then compares the provided credentials with the previously collected identity information. The comparison process includes verifying the consistency of the IP address and MAC address, analyzing the terminal's network behavior and response characteristics, determining whether its operating system type matches the records, checking whether the open ports and running services are as expected, and analyzing whether the characteristic messages match. If the credentials match and are valid, the authentication is passed; otherwise, the access request is rejected.

[0075] S140: If the identity authentication is successful, a continuous trust evaluation is performed on the target terminal, and the access rights of the target terminal are dynamically adjusted based on the trust evaluation result.

[0076] In this embodiment, trust assessment is a process of continuously evaluating the trustworthiness of a terminal, achieved by real-time evaluation of multi-dimensional risk parameters, including terminal identity or type, access time, network location, and device security status.

[0077] Specifically, the system employs a trust scoring mechanism that assigns different weights to each risk parameter. For example, a base score is assigned based on the terminal type (e.g., critical power generation equipment or general monitoring equipment). Points are then added or subtracted based on factors such as access time (whether it's within normal operating hours), network location (whether it's from the expected network segment), and device security status (such as patch updates and antivirus software status). The final trust score determines the range of resources the terminal can access and the types of operations it can perform. This scoring process is ongoing; the system continuously updates the trust score based on the terminal's real-time status and adjusts access permissions accordingly.

[0078] S150: Perform identity-based dynamic authorization to allow or block access by the target terminal.

[0079] Specifically, the system pre-defines a series of access policy templates, each corresponding to a different identity type and trust level. When a terminal requests access to a resource, the authorization system comprehensively considers its identity characteristics (such as device type and functional role) and its current trust score to select the most appropriate policy template. For example, a critical power generation device with a high trust score would be granted higher access rights, allowing it to perform critical operations; whereas a standard monitoring device with a lower trust score would only be allowed to perform basic data read operations.

[0080] S160. Continuously monitor the behavior of the target terminal. If abnormal behavior is found, immediately terminate the current session and re-perform identity authentication and trust assessment.

[0081] Among them, abnormal behavior includes changes in MAC address, signature packet or service port.

[0082] Specifically, the security gateway continuously monitors the target terminals that have been connected to the network and analyzes their network behavior and communication patterns in real time. It then periodically checks the MAC address of the target terminal. If it is found to be inconsistent with the MAC address recorded during the initial authentication, it is considered an abnormality. It continuously analyzes the data packets sent by the target terminal. If changes in characteristic packets that are inconsistent with the normal pattern are observed, they are marked as abnormal. It monitors the service ports opened by the target terminal. If an unauthorized port is detected to be open or closed, it is determined to be abnormal. Once any of the above abnormal behaviors is detected, the security gateway immediately triggers the response mechanism. First, the security gateway immediately terminates the current network session of the target terminal and cuts off its connection to the network. At the same time, the abnormal event is recorded in the security log for subsequent analysis and auditing. After terminating the session, the security gateway requires the target terminal to re-authenticate. This authentication process may be more stringent than the initial authentication and may require additional verification steps or manual intervention.

[0083] In one embodiment, referring to Figure 2 , the method further comprises the steps of:

[0084] S210: Determine a dynamic trust score of the target terminal based on historical behavior, current status, and environmental factors of the target terminal.

[0085] Among them, historical behavior includes the terminal's past access patterns, abnormal event records and compliance performance; the current status includes the terminal's real-time network activity, resource usage and security patch status; environmental factors take into account the overall network security situation, time sensitivity and geographical location.

[0086] Specifically, the system uses a multi-dimensional scoring model to calculate a dynamic trust score. First, historical behavior is weighted, with terminals that have consistently performed well receiving a higher base score. This base score is then adjusted based on current status. For example, detecting unusual network activity will lower the score. Finally, environmental factors are used as correction factors to lower the overall trust score during specific periods or in high-risk areas.

[0087] S220: Determine the access permission level of the target terminal based on the dynamic trust score.

[0088] The system pre-defines multiple access rights levels, each corresponding to a different range of trust scores. As the dynamic trust score changes, the terminal's access rights level adjusts accordingly, enabling trust-based adaptive access control.

[0089] Specifically, the system sets the following access permission levels: High Trust (allows full access), Medium Trust (allows limited access), Low Trust (allows only minimal access), and Untrust (denies all access). When a terminal's dynamic trust score changes, the system reassesses its permission level.

[0090] In one embodiment, referring to Figure 3 , the method further comprises the steps of:

[0091] S310: Obtain a pre-established distributed new energy terminal energy flow model, and based on the energy flow model, track and analyze the energy generation, transmission, storage, and consumption of the target terminal in real time.

[0092] Among them, the distributed new energy terminal energy flow model describes the energy flow law of new energy terminals under different times and environmental conditions.

[0093] Specifically, the system uses energy monitoring devices deployed on terminals to collect real-time energy-related data, including power generation, energy storage, and power consumption. This data is input into a pre-established energy flow model, which calculates the theoretical energy flow based on current environmental parameters (such as sunlight intensity and temperature). The system compares the actual observed energy flow with the theoretical value predicted by the model to determine the terminal's energy utilization efficiency and the degree of anomaly. For example, if a solar terminal's power generation on a sunny day is far lower than the model expects, the system will flag this as a potential anomaly, which may be a sign of equipment failure or malicious interference.

[0094] S320: Calculate and allocate dynamic energy credits for the target terminal based on the real-time tracking and analysis results.

[0095] Among them, energy credit is a comprehensive indicator that reflects the efficiency and reliability of terminal energy use. Efficient and stable terminals will obtain higher energy credits.

[0096] Specifically, this embodiment uses a points-based method to calculate energy credits. When the terminal operates normally, points will gradually accumulate, while abnormal behavior will result in points being deducted. The rate of increase or decrease of points will be dynamically adjusted based on the nature and duration of the behavior.

[0097] S330: Use the energy credit of the target terminal as an additional trust evaluation parameter to dynamically adjust the access rights of the target terminal.

[0098] Specifically, this embodiment converts energy credits into a standardized trust factor, which, along with other security parameters such as identity authentication strength and historical behavior records, determines the terminal's access permission level. For example, the system sets a threshold; when energy credits exceed this threshold, the terminal's overall trust score increases, potentially granting it a higher level of access permission.

[0099] S340: Compare the current energy flow of the target terminal with the model expectation. When an abnormal energy flow pattern is detected, trigger a deep security check of the target terminal and adjust the access rights of the target terminal accordingly.

[0100] Among them, abnormal energy flow patterns may be early indicators of equipment failure, environmental changes or security threats.

[0101] Specifically, the system continuously compares the actual energy flow data of the terminal with the model's expected value. When significant deviations are detected, a series of in-depth safety checks are triggered.

[0102] In one embodiment, referring to Figure 4 In step S340, the deep security check includes:

[0103] S341. Perform time series analysis on the historical energy data of the target terminal to identify long-term abnormal patterns.

[0104] Among them, by performing time series analysis on the historical energy data of the target terminal, long-term abnormal behaviors that are not easily discovered by real-time monitoring can be identified.

[0105] In this embodiment, a sliding window method is used to analyze the terminal's historical energy data. A prediction model is then applied to the processed data to predict future energy behavior trends. If there is a significant and persistent deviation between the actual observed value and the predicted value, the system will mark it as a long-term abnormal pattern.

[0106] S342. Compare the energy behavior of the target terminal with that of other terminals of the same type to discover potential group anomalies.

[0107] Terminals of the same type and in close geographic locations should exhibit similar energy behavior patterns. This embodiment uses horizontal comparison to identify individual terminals exhibiting abnormal performance and to identify possible systemic issues or regional anomalies. For example, in a group of multiple wind turbine terminals, if most terminals report normal power generation, but a target terminal reports abnormally low power generation, the system will identify this as an example of a group anomaly, and a targeted safety inspection may be required.

[0108] S343. Analyze the correlation between the energy behavior of the target terminal and external environmental factors, and identify unreasonable energy patterns.

[0109] Specifically, the system uses the terminal's energy behavior as the dependent variable, and relevant external environmental factors such as sunlight intensity, wind speed, temperature, and grid load as independent variables. The system continuously collects this environmental data and uses a model to predict the terminal's ideal energy behavior under current conditions. If there is a significant difference between the actual observed value and the model's prediction, it is flagged as an unreasonable energy pattern.

[0110] S344. Based on the results of the deep security check, develop a personalized permission recovery plan for the target terminal. The permission recovery plan includes an observation period, restriction lifting conditions, and progressive permission recovery steps.

[0111] Specifically, the system first sets an observation period for the terminal based on the results of the deep security check. The length of the observation period depends on the severity of the anomaly and may range from a few hours to a few weeks. During the observation period, the terminal's access rights will be restricted to the lowest necessary level. At the same time, the system will formulate a series of conditions for lifting restrictions, which may include continuous normal operation time, energy efficiency improvement, passing of security audits, etc. When the terminal meets these conditions, the system will initiate a gradual permission recovery step. For example, for a photovoltaic terminal whose permissions are restricted due to energy anomalies, its permission recovery plan may include: a 7-day observation period, during which the energy behavior is required to be more than 95% consistent with the model expectations, and then the permission is increased by one level every 3 days until it is fully restored.

[0112] In one embodiment, referring to Figure 5 , the method further comprises the steps of:

[0113] S510: Construct a terminal-abnormality type matrix including the target terminal, an abnormality type-recovery strategy matrix, and an environmental factor-energy mode matrix.

[0114] Specifically, the system first collects historical data, including terminal anomaly records, recovery strategies implemented and their effectiveness, and the correspondence between environmental factors and energy patterns. This data is then used to initialize three matrices. For example, in the terminal-anomaly type matrix, each element represents the frequency of a specific type of anomaly occurring at a terminal; in the anomaly type-recovery strategy matrix, the element value indicates the effectiveness of a recovery strategy for a specific anomaly type; and in the environmental factor-energy pattern matrix, the elements reflect the expected energy pattern under certain environmental conditions.

[0115] S520: Based on the in-depth security check result of the target terminal and the execution effect of the permission recovery solution, regularly update the matrix elements related to the target terminal.

[0116] Specifically, the system sets a regular update cycle, such as weekly. During each update cycle, the system collects the results of deep security checks on target terminals and the effectiveness of the permission recovery plan during that period. The system then uses this new data to adjust the relevant matrix elements. For example, if the frequency of a certain type of anomaly on a target terminal increases, the system will increase the corresponding value in the terminal-anomaly type matrix accordingly.

[0117] S530: Calculate the optimal recovery strategy combination of the target terminal using matrix operations.

[0118] In this embodiment, the system first multiplies the terminal-anomaly type matrix by the anomaly type-recovery strategy matrix to produce a terminal-recovery strategy matrix. Each element in the matrix represents the potential effectiveness of a recovery strategy for a specific terminal. Then, relevant information is extracted from the environmental factor-energy pattern matrix and applied as a weighting factor to the terminal-recovery strategy matrix.

[0119] S540: Analyze the abnormal behavior of the target terminal and the time evolution of the recovery process based on the time dimension.

[0120] Analysis of the time dimension can reveal the dynamic characteristics of abnormal terminal behavior and recovery processes. By tracking the changes in these characteristics over time, the system can identify potential cyclical patterns, long-term trends, or sudden events.

[0121] S550. Based on the analysis results, dynamically optimize the deep security inspection process and permission recovery solution for the target terminal.

[0122] Specifically, the system leverages the analysis results from the previous steps, including the optimal strategy combination derived from matrix operations and the patterns revealed by temporal analysis, to adjust the deep security inspection process and permission recovery plan. For example, if temporal analysis shows that a certain type of anomaly is more frequent during specific time periods, the system will increase the frequency or intensity of inspections during those periods.

[0123] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0124] On the second aspect, the present application provides an access control system for a distributed new energy grid-connected system based on a grid architecture. The access control system for a distributed new energy grid-connected system based on a grid architecture of the present application is described below in combination with the above-mentioned access control method for a distributed new energy grid-connected system based on a grid architecture.

[0125] Reference Figure 6, an access control system for a distributed new energy grid-connected system based on a grid architecture, comprising:

[0126] Security gateway deployment module, used to deploy zero-trust pan-endpoint security gateways for dynamic authorization and access control;

[0127] The identity information determination module is used to perform active scanning and passive traffic analysis through the security gateway to determine the identity information of all new energy terminals in the grid;

[0128] An identity authentication module is used to authenticate the target terminal requesting grid connection based on the collected identity information, where the target terminal is any one of all new energy terminals;

[0129] The access rights adjustment module is used to continuously evaluate the trust of the target terminal if the identity authentication is passed, and dynamically adjust the access rights of the target terminal based on the trust evaluation results;

[0130] Dynamic authorization module, used to perform identity-based dynamic authorization to allow or block access to the target terminal;

[0131] The behavior monitoring module is used to continuously monitor the behavior of the target terminal. If any abnormal behavior is found, the current session will be terminated immediately and identity authentication and trust assessment will be re-performed.

[0132] In one embodiment, the present application provides an electronic device, which may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The electronic device includes a processor, a memory and a network interface connected via a system bus. The processor of the electronic device is used to provide computing and control capabilities. The memory of the electronic device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the electronic device is used to store data. The network interface of the electronic device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, an access control method for a distributed new energy grid-connected system based on a grid architecture is implemented.

[0133] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the electronic device to which the solution of the present application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0134] In one embodiment, an electronic device is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0135] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing the relevant hardware through a computer program. The above-described computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the above-described method embodiments. Any reference to memory, storage, database, or other media used in the embodiments provided herein may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0136] The above are all preferred embodiments of the present application, and are not intended to limit the scope of protection of the present application. Therefore, any equivalent changes made based on the structure, shape, and principle of the present application should be included in the scope of protection of the present application.

Claims

1. An access control method for a distributed new energy grid-connected system based on a grid architecture, characterized in that: The steps include: Deploy a zero-trust pan-endpoint security gateway to perform dynamic authorization and access control; Active scanning and passive traffic analysis are performed through the security gateway to determine the identity information of all new energy terminals in the grid; Based on the collected identity information, identity authentication is performed on a target terminal requesting grid connection, where the target terminal is any one of the new energy terminals; If the identity authentication is successful, a continuous trust evaluation is performed on the target terminal, and the access rights of the target terminal are dynamically adjusted based on the trust evaluation results; Perform identity-based dynamic authorization to allow or block access by the target terminal; Continuously monitor the behavior of the target terminal. If any abnormal behavior is found, immediately terminate the current session and re-authenticate and re-evaluate the identity. The method further comprises the steps of: Obtain a pre-established distributed new energy terminal energy flow model, and based on the energy flow model, track and analyze the energy generation, transmission, storage and consumption of the target terminal in real time; Calculate and allocate dynamic energy credits to the target terminal based on real-time tracking and analysis results; Using the energy credit of the target terminal as an additional trust evaluation parameter to dynamically adjust the access rights of the target terminal; The current energy flow of the target terminal is compared with the model expectation. When an abnormal energy flow pattern is detected, a deep security check of the target terminal is triggered, and the access rights of the target terminal are adjusted accordingly.

2. The access control method for a distributed new energy grid-connected system based on a grid architecture according to claim 1, characterized in that: The identity information includes IP address, MAC address, open ports, operating system type, running services and characteristic messages.

3. The access control method for a distributed new energy grid-connected system based on a grid architecture according to claim 2, characterized in that: The trust assessment includes real-time evaluation of multi-dimensional risk parameters, including terminal identity or type, access time, network location, and device security status.

4. The access control method for a distributed new energy grid-connected system based on a grid architecture according to claim 2, characterized in that: The abnormal behavior includes a MAC address change, a signature packet change, or a service port change.

5. The access control method for a distributed new energy grid-connected system based on a grid architecture according to claim 1, characterized in that: The method further comprises the steps of: Determining a dynamic trust score of the target terminal based on historical behavior, current state, and environmental factors of the target terminal; Based on the dynamic trust score, an access authority level of the target terminal is determined.

6. The access control method for a distributed new energy grid-connected system based on a grid architecture according to claim 1, characterized in that: The in-depth security check includes: Performing time series analysis on the historical energy data of the target terminal to identify long-term abnormal patterns; Comparing the energy behavior of the target terminal with other terminals of the same type to discover potential group anomalies; Analyzing the correlation between the energy behavior of the target terminal and external environmental factors to identify unreasonable energy patterns; Based on the results of the deep security check, a personalized permission restoration plan is formulated for the target terminal, and the permission restoration plan includes an observation period, restriction lifting conditions, and progressive permission restoration steps.

7. The access control method for a distributed new energy grid-connected system based on a grid architecture according to claim 6, characterized in that: The method further comprises the steps of: Constructing a terminal-anomaly type matrix, an anomaly type-recovery strategy matrix, and an environmental factor-energy pattern matrix including the target terminal; Based on the results of the deep security check on the target terminal and the execution effect of the permission recovery solution, regularly updating the matrix elements related to the target terminal; Calculating the optimal recovery strategy combination of the target terminal using matrix operations; Analyzing the abnormal behavior of the target terminal and the time evolution of the recovery process based on the time dimension; Based on the analysis results, the deep security inspection process and permission recovery solution for the target terminal are dynamically optimized.

8. An access control system for a distributed new energy grid-connected system based on a grid architecture, characterized in that: An access control method for a distributed new energy grid-connected system based on a grid architecture according to any one of claims 1 to 7 is applied, comprising: Security gateway deployment module, used to deploy zero-trust pan-endpoint security gateways for dynamic authorization and access control; An identity information determination module, configured to perform active scanning and passive traffic analysis through the security gateway to determine the identity information of all new energy terminals in the grid; An identity authentication module, configured to perform identity authentication on a target terminal requesting grid connection based on the collected identity information, wherein the target terminal is any one of the new energy terminals; An access rights adjustment module, configured to perform a continuous trust evaluation on the target terminal if the identity authentication is passed, and dynamically adjust the access rights of the target terminal based on the trust evaluation result; A dynamic authorization module, configured to perform identity-based dynamic authorization to allow or block access by the target terminal; The behavior monitoring module is used to continuously monitor the behavior of the target terminal. If any abnormal behavior is found, the current session is immediately terminated and identity authentication and trust evaluation are re-performed.

9. An electronic device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the access control method of the distributed new energy grid-connected system based on the grid architecture described in any one of claims 1 to 7 are implemented.

Images