Zero-trust-based power grid safety protection method, framework and computer storage medium

Abstract

The invention is suitable for the technical field of power grids, and provides a zero-trust-based power grid security protection method and architecture, and a computer storage medium, and the method comprises the steps: an access subject sends an access request to a trust agent for identity verification at the first time of initiating access; establishing an initial trust level for the access subject passing the verification; allocating access authority to the access main body, establishing a bidirectional encrypted data channel between the access main body and the authorized access resource, and performing data communication to complete access; wherein the access resource has been registered in the trust agent, and the access of the access subject to the access resource is realized through a software defined boundary. According to the method, the risk of the security power plant terminal can be effectively identified, the network attack is blocked in time, and the risk of the power grid network attack received from the power plant access terminal is effectively reduced. The trust technology can block network attacks in time, and the risk of power grid attacks of a power plant access terminal is effectively reduced.

Description

Technical Field

[0001] The present application belongs to the field of power grid technology, and in particular, to a zero-trust-based power grid security protection method, architecture, and computer storage medium. Background Art

[0002] With the development of energy Internet, the large-scale access of distributed generation (DG) to the power grid, the network protection boundary protection cannot guarantee the safe access of DG, and will also generate more extensive data interaction, bringing more serious network security protection challenges. As my country puts forward new security protection requirements for industrial control systems, industrial control systems have become an important part of the country's key infrastructure, and the security of industrial control systems is related to national strategic security. After the grid-connected power plant is connected to the grid, the attacks and infringements of hackers and malicious codes on the grid-connected power plant will expand horizontally through the network, causing power system accidents. Due to the security protection capabilities and uncertainties of the grid-connected power plant, the security protection management of the grid-connected power plant must be highly valued.

[0003] At present, the access of grid-connected power plants is mainly divided into three architectures: intranet APN dedicated line access, Internet gateway proxy mode and mutual benefit gateway routing mode access.

[0004] Intranet APN dedicated line access: Traditional power plan side terminal access adopts APN dedicated line access, using grid side vertical encryption equipment, grid side data acquisition / gateway server, power grid side vertical encryption equipment, grid side reverse horizontal isolation device and other equipment. Under this architecture, since the physical location of the power plan side terminal cannot be controlled, if it is controlled after a network attack or social engineering attack, the attacker can invade important systems such as industrial control systems through a single authentication.

[0005] Internet mapping and gateway proxy mode: including border security devices, DMZ zone security devices, secure access gateways, UNDMZ zone security devices and other security devices. In this architecture, the power plan terminal needs a USB-key hardware certificate to connect to the power grid service system WEB server through the Internet channel. Use NAT technology to convert the private network IP of the secure access gateway to the public network IP. After the power plan side terminal accesses the public network IP of the secure access gateway and the secure access gateway is authenticated by the MAC address and personnel certificate, the gateway proxy power plan side terminal can access the internal WEB server. Since the power plan terminal and the secure access gateway are connected through an encrypted channel, the network boundary security protection device cannot read the encrypted traffic packets for analysis. Since the internal access is represented by the gateway agent, the internal access analysis cannot determine which power plan terminal the access source IP address belongs to.

[0006] Internet Mapping and Gateway Routing Mode: Different from the Internet Mapping and Gateway Proxy Mode, after the secure access gateway performs MAC address and personnel certificate authentication, the gateway uses routing to assign internal IP addresses to the Power Plan terminal, and the Power Plan terminal directly accesses the internal WEB server. Compared with the Internet Mapping and Gateway Proxy Mode, internal traffic analysis can accurately locate the corresponding terminal, but the company's network boundary extends to the power plant side terminal. In this case, due to the single authentication mode of the gateway, after the side terminal is interrupted, it is easy for attackers to conduct more internal horizontal attacks.

[0007] In summary, the current power system network security protection system gives priority to boundary isolation protection. According to the general principle of horizontal isolation of network areas of "security partition, network, horizontal isolation, vertical authentication", encryption authentication devices are deployed at the vertical boundary. The current protection system adopts "authentication" and believes in "mechanism", believing that network equipment is trustworthy. However, the development of the power Internet of Things and the fuzzy network boundaries of large-scale heterogeneous terminal connections and the diversification of access scenarios have caused certain risks in the existing security protection system. Summary of the invention

[0008] The embodiments of the present application provide a zero-trust-based power grid security protection method, architecture, and computer storage medium, which can solve the problem that the boundaries of the power Internet of Things development and large-scale heterogeneous terminal connection networks are blurred and security protection cannot be effectively achieved.

[0009] In a first aspect, an embodiment of the present application provides a zero-trust-based power grid security protection method, including:

[0010] The access subject sends the access request to the trust agent for identity authentication as soon as it initiates access;

[0011] Establishing an initial trust level for authenticated access subjects;

[0012] Assign access rights to the access subject, establish a two-way encrypted data channel between the access subject and the authorized access resource, and complete the access through data communication;

[0013] The access resource has been registered in the trust agent, and the access subject's access to the access resource is implemented through a software-defined boundary.

[0014] When the access subject initiates access to a resource, it first sends the request to the trust agent, which verifies the identity of the access subject; secondly, the access subject establishes initial trust through secure identity authentication. A two-way encrypted data channel is established between the access initiator and the authorized access, and data communication is carried out. The access resource has been registered in the trust agent, and the subject's access to the resource is realized through the software-defined boundary. The reallocation of the accessed resource is hidden. Therefore, it can achieve secure resource access and prevent illegal access subjects from launching malicious attacks on the power Internet of Things terminals, affecting the safe operation of the power grid.

[0015] Exemplarily, the access subject includes a person or a terminal.

[0016] Exemplarily, the trust agent performing identity authentication includes:

[0017] Access the original information of the access subject and establish a unified identity database;

[0018] Wherein, the identity and trust level of the access subject are determined based on the original information of the access subject;

[0019] Customize unified access rules based on the identity database, specifically including: setting access rights to access resources based on the trust level of the access subject, where the trust level of the access subject must be higher than or equal to the security level of the accessed resource.

[0020] Exemplarily, the security level of the access resource is customized by the provider of the access resource.

[0021] Exemplarily, the unified identity database may identify devices, applications, components, and services;

[0022] Among them, the unified identity database is synchronized with the application directory of each system.

[0023] Exemplarily, a mechanism for continuously evaluating the access subject is also included, which specifically includes:

[0024] Continuously collect, identify and analyze the behavior of the access subject;

[0025] The trust level of the access subject is dynamically adjusted based on the results of collection, identification and analysis, and the access permission is terminated when the trust level is lower than the security level of the accessed resource.

[0026] Exemplarily, the dynamic adjustment of the trust level specifically includes:

[0027] Set the initial trust level T0, which is obtained by weighting α0, β0, and λ0, and its calculation formula is:

[0028] α0=N / (N+U+X)

[0029] β0=U / (N+U+X)

[0030] λ0=1 / (N+U+X)

[0031] Among them, α0 is the normal probability of terminal operation, β0 is the probability of abnormal terminal operation, λ0 is the uncertainty degree of terminal trust, N is the number of normal events, U is the number of abnormal events, and the uncertainty factor X is introduced to reduce extreme deviations. The value can be changed according to needs, and the default value is 1;

[0032] Dynamically adjusted trust level T n It is expressed as:

[0033]

[0034] In formula (1), C n is the uncertainty factor of the iteration measurement, with a value interval of (0, 1); T n-1 is the trust level of the n-1th iteration; L j is the security impact range of the terminal, R j It represents the reliability of the terminal, and its value range is [0,1]. δ is the value of the influencing factor C, and its value range is [0,j]. Where j represents the number of terminal risk items, and its value range is [1,10].

[0035] In a second aspect, the embodiment of the present application provides a zero-trust-based power grid security protection architecture, including:

[0036] One or more access subjects;

[0037] A unified identity management module is used to access the original information of the access subject according to the zero-trust-based power grid security protection method, establish a unified identity database and formulate access rules;

[0038] An encrypted data channel is established between the access subject and the accessed resource to perform data communication and complete data access;

[0039] A dynamic control module is used to collect and analyze the behavior of the access subject in the encrypted data channel, adjust the trust level of the access subject based on the zero-trust-based power grid security protection method, and disconnect the encrypted data channel when the current level is lower than the security level of the accessed resource.

[0040] Exemplarily, the encrypted data channel is a bidirectional encrypted data channel.

[0041] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, a zero-trust-based power grid security protection method is implemented.

[0042] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here.

[0043] Compared with the prior art, the embodiments of the present application have the following beneficial effects: a "one identity authentication, "continued trust" mechanism. The interactive network adopts a risk protection system based on a zero trust framework with continuous identity authentication, real-time trust assessment, dynamic access control technology and integrated isolation devices and encryption protection devices, which have been put into use in the power system network. The technical verification scenario in the distributed power plant access test shows that the experimental results show that the method can effectively identify the security risks of the power plant terminal, block network attacks in time, and effectively reduce the risk of network attacks on the power grid received from the power plant access terminal. Trust technology can block network attacks in time and effectively reduce the risk of power grid attacks by power plant access terminals. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0045] Figure 1 It is a schematic diagram of a method provided by an embodiment of the present application;

[0046] Figure 2 This is a schematic diagram of dynamic adjustment of trust level provided by an embodiment of the present application;

[0047] Figure 3 It is a schematic diagram of an architecture provided by an embodiment of the present application. DETAILED DESCRIPTION

[0048] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0049] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0050] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0051] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0052] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0053] The zero-trust-based power grid security protection method provided in the embodiment of the present application can be applied to power grid systems, etc. The embodiment of the present application does not impose any restrictions on the specific type of terminal equipment.

[0054] For example, it can be used for terminal cabinets, servers, desktop devices, handheld devices, etc.

[0055] The technical solution provided by the embodiments of the present application will be introduced below through specific examples.

[0056] See also Figure 1 , which is a flow chart of the zero-trust-based power grid security protection method provided in an embodiment of the present application, is provided as an example rather than a limitation.

[0057] In a possible implementation, a zero-trust-based power grid security protection method includes:

[0058] The access subject sends the access request to the trust agent for identity authentication as soon as it initiates access;

[0059] Establishing an initial trust level for authenticated access subjects;

[0060] Assign access rights to the access subject, establish a two-way encrypted data channel between the access subject and the authorized access resource, and complete the access through data communication;

[0061] The access resource has been registered in the trust agent.

[0062] When the access subject initiates access to a resource, it first sends the request to the trust agent, which verifies the identity of the access subject; secondly, the access subject establishes initial trust through secure identity authentication. A two-way encrypted data channel is established between the access initiator and the authorized access, and data communication is carried out. The access resource has been registered in the trust agent, and the subject's access to the resource is realized through the software-defined boundary. The reallocation of the accessed resource is hidden. Therefore, it can achieve secure resource access and prevent illegal access subjects from launching malicious attacks on the power Internet of Things terminals, affecting the safe operation of the power grid.

[0063] Exemplarily, the access subject includes a person or a terminal.

[0064] Exemplarily, the trust agent performing identity authentication includes:

[0065] Access the original information of the access subject and establish a unified identity database;

[0066] Wherein, the identity and trust level of the access subject are determined based on the original information of the access subject;

[0067] Customize unified access rules based on the identity database, specifically including: setting access rights to access resources based on the trust level of the access subject, where the trust level of the access subject must be higher than or equal to the security level of the accessed resource.

[0068] In order to ensure that the network security protection of power plant terminals is solid and reliable when they are connected to the power grid, the power grid side actively improves its defense capabilities, extracts the original information of the access subject, establishes a unified identity, and determines the security and trust level of the access subject identity through the original information. The access subject can be a person or a terminal. Similarly, the unified identity can also identify devices, applications, components and services. Through the Internet of Things access, the original information is extracted, a unified identity is established, and a comprehensive identity authentication mode is formed. Among them, the unified identification database should be synchronized with the application directory of each system to ensure the real-time and validity of the identity information. After obtaining the unified identity of personnel and equipment, a unified policy library is generated by formulating unified access rules. The unified policy library contains management-level policies and application-level policies to perform unified management of access rules. The management-level policy is the primary screening of the security access process. The main work is to define the trust level of the access subject and the accessible services corresponding to its security level, and formulate encrypted access methods. If the access subject needs to access the content of the accessed object, the trust level of the access subject is higher than or equal to the security level of the accessed object, which is calculated by the trust measurement method. The security level of the accessed object depends on the accessed party that provides data services in data interaction and is formulated according to the security requirements of the accessed party. In addition, the unified policy library is also responsible for defining the encrypted access to the accessed object during data interaction, and is managed and called by the application level.

[0069] Exemplarily, this embodiment also includes a mechanism for continuously evaluating the access subject, which specifically includes:

[0070] Continuously collect, identify and analyze the behavior of the access subject;

[0071] The trust level of the access subject is dynamically adjusted based on the results of collection, identification and analysis, and the access permission is terminated when the trust level is lower than the security level of the accessed resource.

[0072] The process can be referred to Figure 2 As shown, after the access begins, the access behavior of the access subject (including access requests, visitor database, system database, resource access requirements, threat intelligence) and other data are continuously collected, identified and analyzed, and calculations are performed based on the trust measurement algorithm to evaluate in real time whether the trust level is met. When the trust level is lower than the security level of the accessed resource, the access is interrupted and the identity information of the visitor is removed from the identity database, making it impossible to perform the next identity authentication.

[0073] The default of the zero-trust security protection system is that all devices, users, and network traffic should undergo new authentication and authorization. The continuous trust evaluation mechanism is to enhance the terminal monitoring and trust analysis capabilities, continuously collect, identify, and analyze the behavior of visitors, thereby improving the accuracy of terminal trust measurement and providing support for the implementation of accurate protection. This continuous trust evaluation determines the degree of trust of the access subject through dynamic calculation. Different types of terminals have different performance and characteristics: processor, memory, disk usage, etc. Describe the performance of the device; packet loss rate, mean time between failures, etc. Describe the reliability of the device; illegal connections and port scanning indicate the security of the device. A trust metric calculation method is proposed to judge the network security performance of the access subject through the comprehensive calculation of the access subject's characteristic values, form an initial trust evaluation value, calculate the current trust metric value using the trust evaluation value and risk metric value, estimate it using the weighted average method, and iterate based on historical data and monitoring conditions.

[0074] Exemplarily, the dynamic adjustment of the trust level, i.e., the trust measurement algorithm, specifically includes:

[0075] Set the initial trust level T0, which is obtained by weighting α0, β0, and λ0, and its calculation formula is:

[0076] α0=N / (N+U+X)

[0077] β0=U / (N+U+X)

[0078] λ0=1 / (N+U+X)

[0079] Among them, α0 is the normal probability of terminal operation, β0 is the probability of abnormal terminal operation, λ0 is the uncertainty degree of terminal trust, N represents the number of normal events, and U represents the number of abnormal events. In order to reduce extreme deviations, an uncertainty factor X is introduced. This value can be changed according to demand, and the default value is 1. It should be noted that the weighted ratio of the three parameters α0, β0, and λ0 can be adjusted according to the actual production operation situation. This solution adopts the weighted average method to calculate the initial trust level T0. That is, T0 = α0 + β0 + λ0.

[0080] Dynamically adjusted trust level T n It is expressed as:

[0081]

[0082] In formula (1), C n is the uncertainty factor of the iteration measurement, with a value interval of (0, 1); T n-1 is the trust level of the n-1th iteration; L j is the security impact range of the terminal, R jIt represents the reliability of the terminal, and its value range is [0,1]. δ is the value of the influencing factor C, and its value range is [0,j]. Among them, j represents the number of terminal risk items, and its value range is [1,10]. In practical applications, the value increases or decreases according to the actual operation of the network factory interaction.

[0083] Normal network communication is defined as a normal event, and malicious network attack traffic is defined as an abnormal event. The number of both types of events is counted, and the network communication is determined to be normal through various operation characteristic values. If the number of illegal connections or port scans exceeds the set value, the current network communication is considered abnormal.

[0084] Energy Internet is highly open, both at the commercial and technical levels. Zero-trust architecture can limit the horizontal expansion of cyber attacks by limiting access rights to a minimum, and to a certain extent solves the hidden danger that the security design of the business system cannot foresee all network security scenarios. Dynamic access control is aimed at the access of IoT terminals to the power grid business, and mainly includes three processing mechanisms: one is a unified rule base mechanism to achieve the separation of rule management and application processing; the second is to simplify the rule design mode through comprehensive authentication and standardize the rules in the form of access control lists; the third is to standardize the processing flow of services and components, and query the access policies and authentications through the unified policy library. The dynamic access mechanism adaptively assigns the minimum permissions to the access subject according to the trust index of the access terminal and the adaptive policy, and builds a more fine-grained control mechanism. Dynamic access control dynamically monitors the behavior status of the access subject through continuous trust evaluation, and denies the access behavior of the access subject when the terminal is judged to be abnormal.

[0085] For example, the present application embodiment provides a zero-trust-based power grid security protection architecture, referring to Figure 3 As shown, it includes: one or more access subjects 100, a unified identity management module 200, an encrypted data channel 300 and a dynamic control module 400. The unified identity management module 200 is used to access the original information of the access subject according to the zero-trust-based power grid security protection method, establish a unified identity identification database and formulate access rules; the encrypted data channel 300 is established between the access subject and the accessed resource to perform data communication to complete data access; the dynamic control module 400 is used to collect and analyze the behavior of the access subject in the encrypted data channel, adjust the trust level of the access subject based on the zero-trust-based power grid security protection method, and disconnect the encrypted data channel when the current level is lower than the security level of the accessed resource. Exemplarily, the encrypted data channel 300 is a bidirectional encrypted data channel.

[0086] The implementation process of the power plant-grid network security model based on the zero-trust protection framework is as follows:

[0087] (1) It is required that IoT terminals must interact with the business backend system through IoT access agents;

[0088] (2) Unified management and monitoring of IoT terminals, standardizing the management mechanism of IoT terminals, and dynamically evaluating the trust level of access subjects;

[0089] (3) Establish access control measures on the data access interface on the power grid side and perform flow control according to data access rules;

[0090] (4) Establish corresponding data access control measures based on data classification rules;

[0091] (5) Based on the trust level and access subject of the data access authorization management system, power plant power grid data interaction is carried out on the basis of the zero-trust security protection framework.

[0092] As a "default untrusted" network protection framework, when the access subject needs to interact with the accessed network, the corresponding access rights must be granted through the policy decision point (PDP) and the policy enforcement point (PEP). The PDP consists of a policy engine (PE) that decides whether to authorize the access subject and a policy administrator (PE) responsible for the communication path. The PEP is responsible for enabling, monitoring, and terminating the connection between the access subject and the accessed object. The basis for PE's judgment can come from the continuous diagnosis and mitigation system, industry compliance system, threat intelligence source, and various services submitting information to PE. Zero trust security protection follows the basic principles of physical security, logical security, process security, and continuous auditing. Its essence is to establish an identity-based dynamic access mechanism between the access subject and the accessed object. PE uses trust evaluation strategies and the identity information of the access object, external threat intelligence and other information as input to perform continuous trust evaluation and realize dynamic access control between the visitor and the accessed network. Each access behavior under the zero trust mechanism requires re-authentication and authorization, which provides a more reliable solution to the dilemma of blurred network boundaries faced by the digital reform of the power system.

[0093] In a third aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, a zero-trust-based power grid security protection method is implemented.

[0094] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0095] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0096] An embodiment of the present application also provides a network device, which includes: at least one processor, a memory, and a computer program stored in the memory and executable on the at least one processor, wherein the processor implements the steps in any of the above-mentioned method embodiments when executing the computer program.

[0097] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0098] An embodiment of the present application provides a computer program product. When the computer program product runs on a mobile terminal, the mobile terminal can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0099] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0100] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0101] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0102] In the embodiments provided in the present application, it should be understood that the disclosed devices / network equipment and methods can be implemented in other ways. For example, the device / network equipment embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0103] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0104] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A zero-trust-based power grid security protection method, characterized in that: include: The access subject sends the access request to the trust agent for identity authentication as soon as it initiates access; Establishing an initial trust level for authenticated access subjects; Assign access rights to the access subject, establish a two-way encrypted data channel between the access subject and the authorized access resource, and complete the access through data communication; The access resource has been registered in the trust agent.

2. A zero-trust-based power grid security protection method as claimed in claim 1, characterized in that: The access subjects include people and terminals.

3. A zero-trust-based power grid security protection method as claimed in claim 1, characterized in that: The trust agent performs identity authentication including: Access the original information of the access subject and establish a unified identity database; Wherein, the identity and trust level of the access subject are determined based on the original information of the access subject; Customize unified access rules based on the identity database, specifically including: setting access rights to access resources based on the trust level of the access subject, where the trust level of the access subject must be higher than or equal to the security level of the accessed resource.

4. A zero-trust-based power grid security protection method as claimed in claim 3, characterized in that: The security level of the access resource is customized by the provider of the access resource.

5. A zero-trust-based power grid security protection method as claimed in claim 3, characterized in that: The unified identity database can identify devices, applications, components and services; Among them, the unified identity database is synchronized with the application directory of each system.

6. A zero-trust-based power grid security protection method as claimed in claim 1, characterized in that: It also includes a mechanism for continuous evaluation of the access subject, which specifically includes: Continuously collect, identify and analyze the behavior of the access subject; The trust level of the access subject is dynamically adjusted based on the results of collection, identification and analysis, and the access permission is terminated when the trust level is lower than the security level of the accessed resource.

7. A zero-trust-based power grid security protection method as claimed in claim 6, characterized in that: The dynamic adjustment of the trust level specifically includes: Set the initial trust level T0, which is obtained by weighting α0, β0, and λ0, and its calculation formula is: α0=N / (N+U+X) β0=U / (N+U+X) λ0=1 / (N+U+X) Among them, α0 is the normal probability of terminal operation, β0 is the probability of abnormal terminal operation, λ0 is the uncertainty degree of terminal trust, N is the number of normal events, U is the number of abnormal events, and the uncertainty factor X is introduced to reduce extreme deviations. The value can be changed according to needs, and the default value is 1; Dynamically adjusted trust level T n It is expressed as: In formula (1), C n is the uncertainty factor of the iteration measurement, with a value interval of (0, 1); T n-1 is the trust level of the n-1th iteration; L j is the security impact range of the terminal, ranging from [0,1], R j The reliability of the terminal ranges from [0,1]; δ is the value of the influence factor C, which ranges from [0,j], where j represents the number of terminal risk items, which ranges from [1,10].

8. A zero-trust-based power grid security protection architecture, characterized in that: include: One or more access subjects; A unified identity management module, used to access the original information of the access subject according to the method described in any one of claims 3 to 5, establish a unified identity database and formulate access rules; An encrypted data channel is established between the access subject and the accessed resource to perform data communication and complete data access; A dynamic control module is used to collect and analyze the behavior of the access subject in the encrypted data channel, adjust the trust level of the access subject based on the method described in claims 6-8, and disconnect the encrypted data channel when the current level is lower than the security level of the accessed resource.

9. The zero-trust-based power grid security protection architecture according to claim 8, characterized in that: The encrypted data channel is a bidirectional encrypted data channel.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images