Dynamic access control method based on local communication network

Abstract

The invention relates to the technical field of electric power internet of things, in particular to a dynamic access control method based on a local communication network, which realizes fine-grained access control and authority management, and allows authorized users or equipment to access specific electric power resources and functions. The method mainly comprises the steps of establishing a dynamic access control model, realizing a dynamic access control strategy, performing dynamic access control optimization based on an intelligent algorithm, and designing a security audit mechanism. According to the method, dynamic control over power terminal access is achieved, corresponding dynamic access control strategies are formulated according to various conditions such as identity authentication failure and insufficient authority in the power terminal access process, the safety and stability of a system are guaranteed, the efficiency and accuracy of dynamic access control are improved, a perfect safety audit mechanism is established, and the safety audit efficiency is improved. Various behaviors and events in the access process of the power terminal are monitored, potential safety risks are found and processed in time, and the safety of the system is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of electric power Internet of Things, and in particular to a dynamic access control method based on a local communication network. Background Art

[0002] In the traditional access control model, the access subject obtains the corresponding permissions through role attributes. However, under the zero-trust architecture, the previous relatively static or relatively closed network environment has become less and less, and is gradually developing towards an open environment. The identity of the access subject is not fixed, and login and logout operations are performed frequently, which puts higher requirements on the access control model.

[0003] In view of the above problems, it is necessary to study a dynamic access control method based on the local communication network. Summary of the invention

[0004] The purpose of the present invention is to provide a dynamic access control method based on a local communication network to solve the problem that the terminal service terminal and the edge aggregation terminal still lack security protection and are vulnerable to attacks and subsequent attacks.

[0005] To achieve the above object, the present invention provides the following technical solutions:

[0006] The first aspect of the present invention provides a dynamic access control method based on a local communication network, characterized in that: fine-grained access control and authority management are implemented, and authorized users or devices access specific power resources and functions, mainly including:

[0007] Establish a dynamic access control model: According to the identity and authority level of the power terminal, establish a dynamic access control model, including a role authorization model and an access control matrix, to achieve dynamic control of access to the power terminal;

[0008] Implement dynamic access control strategy: formulate corresponding dynamic access control strategy for various situations in the process of power terminal access to ensure the security and stability of the system;

[0009] Dynamic access control optimization based on intelligent algorithms: For large power systems, the authorization and access control matrix involved in dynamic access control is very large, so it is necessary to optimize it through intelligent algorithms to improve the efficiency and accuracy of dynamic access control;

[0010] The process of dynamic access control optimization based on intelligent algorithms is as follows:

[0011] Access Control Matrix

[0012] The access control matrix M is an n×m matrix, where n is the number of users (or subjects) and m is the number of resources (or objects). ijrepresents the access rights of user i to resource j;

[0013] Among them, M ij =1 means user i has access rights to resource j, M ij =0 means no access rights;

[0014] Optimizing the objective function

[0015] Construct the comprehensive objective function F:

[0016] F=α*Delay+β*(1-Accuracy)

[0017] Among them, α and β are weight coefficients used to balance the importance of access delay and access control accuracy; Delay represents the average access delay, and Accuracy represents the access control accuracy;

[0018] The average access delay Delay can be calculated by the following formula:

[0019]

[0020] Where N is the total number of access requests, Tk is the processing time of the kth access request;

[0021] The access control accuracy can be calculated using the following formula:

[0022] textAccuracy = total number of access requests / number of correctly authorized access requests;

[0023] Design a safety audit mechanism: Establish a comprehensive safety audit mechanism to monitor various behaviors and events during the access process of power terminals, and promptly identify and handle potential safety risks.

[0024] Preferably, it comprises: a dynamic access control server and an edge device, wherein the edge device communicates with the dynamic access control server;

[0025] The edge device obtains a device network access certificate from the dynamic access control server, and sends access information carrying the device network access certificate to the dynamic access control server; the dynamic access control server determines whether to allow the edge device to access the network based on the certificate chain;

[0026] After receiving the access information sent by the edge device, the state access control server performs identity authentication on the edge device according to the set rule and the access information.

[0027] Preferably, the edge device includes: a concentrator, a fusion terminal, a message sending terminal, a key acquisition module, and a detailed information sending module, the message sending terminal is used to send access request information to the dynamic access control server, and the access information also carries brief device information;

[0028] A key acquisition module, after receiving the trusted verification message sent by the dynamic access control server, verifies the legitimacy of the certificate of the policy execution server, and obtains the session key if the certificate is legitimate;

[0029] The detailed information sending module is used to send the device detailed information to the dynamic access control server in a symmetrically encrypted manner using the session key.

[0030] Preferably, the dynamic access control server includes:

[0031] An identity authentication module, used to verify the validity of the device network access certificate, and if the device network access certificate is valid, verify whether the edge device meets the access conditions according to the policy rules;

[0032] A trusted verification module, configured to send a trusted verification message to the edge device when the edge device is under load access conditions;

[0033] The identity information determination module is used to receive the device detailed information and generate a device code, and the device identity information is formed by the device detailed information and the device code.

[0034] Preferably, the dynamic access control server further includes:

[0035] The certificate sending module is used to send the device network access certificate to the edge device when the edge device sends access request information to the dynamic access control server, wherein the rule determines whether to allow the edge device to access the network based on the certificate chain.

[0036] Preferably, the edge device obtains a device network access certificate from a dynamic access control server, and sends access information carrying the device network access certificate to the dynamic access control server;

[0037] Wherein, the policy rule determines whether to allow the edge device to access the network based on the certificate chain;

[0038] After receiving the access information sent by the edge device, the dynamic access control server performs identity authentication on the edge device according to the policy rule and the access information.

[0039] Preferably, the edge device obtains a device network access certificate from a dynamic access control server, and sends access information carrying the device network access certificate to the dynamic access control server, including: the edge device sends access request information to the dynamic access control server, and after the dynamic access control server responds to the access request information, sends access information to the execution server, wherein the access information also carries brief device information;

[0040] After receiving the trusted verification message sent by the dynamic access control server, the edge device verifies the legitimacy of the certificate of the dynamic access control server, and obtains the session key if the certificate is legitimate;

[0041] The edge device sends device detailed information to the dynamic access control server in a symmetrically encrypted manner using the session key.

[0042] Preferably, after receiving the trusted verification message sent by the policy execution server, the edge device verifies the legitimacy of the certificate of the policy execution server, and obtains the session key if the certificate is legitimate, including:

[0043] The edge device extracts the public key from the certificate if the certificate is valid;

[0044] The edge device verifies the message signature using the public key and decrypts the message signature to determine the session key.

[0045] Preferably, after receiving the access information sent by the edge device, the dynamic access control server performs identity authentication on the edge device according to the policy rule and the access information, including:

[0046] The dynamic access control server verifies the validity of the device network access certificate, and if the device network access certificate is valid, verifies whether the edge device meets the access conditions according to the policy rules;

[0047] The dynamic access control server sends a trusted verification message to the edge device when the edge device has a load access condition;

[0048] The dynamic access control server receives the device detailed information and generates a device code, and the device identity information is formed by the device detailed information and the device code.

[0049] Preferably, the dynamic access control server sends the policy rule and sends the device network access certificate to the edge device, including:

[0050] In a case where the dynamic access control server authenticates the edge device, the dynamic access control server sends a policy rule to the policy execution server;

[0051] In the case where the edge device sends access request information to the policy execution server, the dynamic access control server sends the device network access certificate to the edge device, wherein the policy rule determines whether to allow the edge device to access the network based on the certificate chain.

[0052] Compared with the prior art, the present invention has the following beneficial effects:

[0053] The present invention studies how to achieve fine-grained access control and authority management to ensure that only authorized users or devices can access specific power resources and functions; establish a dynamic access control model: according to the identity and authority level of the power terminal, a dynamic access control model is established, including a role authorization model, an access control matrix, etc., to achieve dynamic control of access to the power terminal.

[0054] Implement dynamic access control strategies: In response to various situations during the access process of power terminals, such as identity authentication failure, insufficient permissions, etc., formulate corresponding dynamic access control strategies to ensure the security and stability of the system.

[0055] Dynamic access control optimization based on intelligent algorithms: For large-scale power systems, the authorization and access control matrix involved in dynamic access control is very large, so it is necessary to optimize it through intelligent algorithms to improve the efficiency and accuracy of dynamic access control.

[0056] Design a security audit mechanism: Establish a comprehensive security audit mechanism to monitor various behaviors and events during the access process of power terminals, promptly discover and handle potential security risks, and ensure the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work.

[0058] Figure 1 It is a flow chart of a dynamic access control method based on a local communication network of the present invention. DETAILED DESCRIPTION

[0059] The technical solutions in the embodiments of the present invention are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0060] A dynamic access control method based on a local communication network realizes fine-grained access control and authority management, and authorized users or devices access specific power resources and functions, mainly including: establishing a dynamic access control model: according to the identity and authority level of the power terminal, a dynamic access control model is established, including a role authorization model and an access control matrix, to realize dynamic control of access to the power terminal;

[0061] Implement dynamic access control strategies: formulate corresponding dynamic access control strategies for various situations during the access process of power terminals, such as identity authentication failure and insufficient permissions, to ensure the security and stability of the system;

[0062] Dynamic access control optimization based on intelligent algorithms: For large power systems, the authorization and access control matrix involved in dynamic access control is very large, so it is necessary to optimize it through intelligent algorithms to improve the efficiency and accuracy of dynamic access control;

[0063] The process of dynamic access control optimization based on intelligent algorithms is as follows:

[0064] Access Control Matrix

[0065] The access control matrix M is an n×m matrix, where n is the number of users (or subjects) and m is the number of resources (or objects). ij represents the access rights of user i to resource j;

[0066] Among them, M ij =1 means user i has access rights to resource j, M ij =0 means no access rights;

[0067] Optimizing the objective function

[0068] Construct the comprehensive objective function F:

[0069] F=α*Delay+β*(1-Accuracy)

[0070] Among them, α and β are weight coefficients used to balance the importance of access delay and access control accuracy; Delay represents the average access delay, and Accuracy represents the access control accuracy;

[0071] The average access delay Delay can be calculated by the following formula:

[0072]

[0073] Where N is the total number of access requests, Tk is the processing time of the kth access request;

[0074] The access control accuracy can be calculated using the following formula:

[0075] textAccuracy = total number of access requests / number of correctly authorized access requests;

[0076] The present invention optimizes the access control strategy through a genetic algorithm, thereby effectively improving the efficiency and accuracy of the access control.

[0077] Design a security audit mechanism: Establish a comprehensive security audit mechanism to monitor various behaviors and events during the access process of power terminals, promptly discover and handle potential security risks, and ensure the security of the system.

[0078] A dynamic access control server and an edge device, wherein the edge device communicates with the dynamic access control server; the edge device obtains a device network access certificate from the dynamic access control server, and sends access information carrying the device network access certificate to the dynamic access control server; the dynamic access control server determines whether to allow the edge device to access the network based on the certificate chain;

[0079] After receiving the access information sent by the edge device, the state access control server performs identity authentication on the edge device according to the set rule and the access information.

[0080] The edge device includes: a concentrator, a fusion terminal, a message sending terminal, a key acquisition module, and a detailed information sending module. The message sending terminal is used to send access request information to the dynamic access control server, and the access information also carries brief device information;

[0081] A key acquisition module, after receiving the trusted verification message sent by the dynamic access control server, verifies the legitimacy of the certificate of the policy execution server, and obtains the session key if the certificate is legitimate;

[0082] The detailed information sending module is used to send the device detailed information to the dynamic access control server in a symmetrically encrypted manner using the session key.

[0083] The dynamic access control server includes:

[0084] An identity authentication module, used to verify the validity of the device network access certificate, and if the device network access certificate is valid, verify whether the edge device meets the access conditions according to the policy rules;

[0085] A trusted verification module, configured to send a trusted verification message to the edge device when the edge device is under load access conditions;

[0086] The identity information determination module is used to receive the device detailed information and generate a device code, and the device identity information is formed by the device detailed information and the device code.

[0087] The dynamic access control server also includes:

[0088] The certificate sending module is used to send the device network access certificate to the edge device when the edge device sends access request information to the dynamic access control server, wherein the rule determines whether to allow the edge device to access the network based on the certificate chain.

[0089] The edge device obtains a device network access certificate from the dynamic access control server, and sends access information carrying the device network access certificate to the dynamic access control server;

[0090] Wherein, the policy rule determines whether to allow the edge device to access the network based on the certificate chain;

[0091] After receiving the access information sent by the edge device, the dynamic access control server performs identity authentication on the edge device according to the policy rule and the access information.

[0092] The edge device obtains a device network access certificate from a dynamic access control server, and sends access information carrying the device network access certificate to the dynamic access control server, including: the edge device sends access request information to the dynamic access control server, and after the dynamic access control server responds to the access request information, sends access information to the execution server, wherein the access information also carries brief device information;

[0093] After receiving the trusted verification message sent by the dynamic access control server, the edge device verifies the legitimacy of the certificate of the dynamic access control server, and obtains the session key if the certificate is legitimate;

[0094] The edge device uses the session key to send the device detailed information to the dynamic access control policy execution server in a symmetrically encrypted manner to verify the legitimacy of the certificate. If the certificate is legitimate, the session key is obtained, including:

[0095] The edge device extracts the public key from the certificate if the certificate is valid;

[0096] The edge device verifies the message signature using the public key and decrypts the message signature to determine the session key.

[0097] After receiving the access information sent by the edge device, the dynamic access control server performs identity authentication on the edge device according to the policy rule and the access information, including:

[0098] The dynamic access control server verifies the validity of the device network access certificate, and if the device network access certificate is valid, verifies whether the edge device meets the access condition according to the policy rule;

[0099] The dynamic access control server sends a trusted verification message to the edge device when the edge device has a load access condition;

[0100] The dynamic access control server receives the device detailed information and generates a device code, and the device identity information is formed by the device detailed information and the device code.

[0101] The dynamic access control server sends the policy rule and sends the device network access certificate to the edge device, including:

[0102] In a case where the dynamic access control server authenticates the edge device, the dynamic access control server sends a policy rule to the policy execution server;

[0103] In the case where the edge device sends access request information to the policy execution server, the dynamic access control server sends the device network access certificate to the edge device, wherein the policy rule determines whether to allow the edge device to access the network based on the certificate chain.

[0104] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0105] The preferred embodiments of the present invention disclosed above are only used to help illustrate the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A dynamic access control method based on a local communication network, characterized in that: Implement fine-grained access control and authority management, and authorized users or devices can access specific power resources and functions, mainly including: Establish a dynamic access control model: According to the identity and authority level of the power terminal, establish a dynamic access control model, including a role authorization model and an access control matrix, to achieve dynamic control of access to the power terminal; Implement dynamic access control strategies: formulate corresponding dynamic access control strategies for various situations during the access process of power terminals; The process of dynamic access control optimization based on intelligent algorithms is as follows: Access Control Matrix The access control matrix M is an n×m matrix, where n is the number of users and m is the number of resources. ij represents the access rights of user i to resource j; Among them, M ij =1 means user i has access rights to resource j, M ij =0 means no access rights; Optimizing the objective function Construct the comprehensive objective function F: F=α*Delay+β*(1-Accuracy) Among them, α and β are weight coefficients used to balance the importance of access delay and access control accuracy; Delay represents the average access delay, and Accuracy represents the access control accuracy; The average access delay Delay is calculated using the following formula: Where N is the total number of access requests, Tk is the processing time of the kth access request; Access control accuracy is calculated using the following formula: textAccuracy = total number of access requests / number of correctly authorized access requests; Design a safety audit mechanism: Establish a comprehensive safety audit mechanism to monitor various behaviors and events during the access process of power terminals, and promptly identify and handle potential safety risks.

2. A method for dynamic access control based on a local communication network according to claim 1, characterized in that: include: A dynamic access control server and an edge device, wherein the edge device communicates with the dynamic access control server; The edge device obtains a device network access certificate from the dynamic access control server, and sends access information carrying the device network access certificate to the dynamic access control server; The dynamic access control server determines whether to allow the edge device to access the network based on the certificate chain; After receiving the access information sent by the edge device, the state access control server performs identity authentication on the edge device according to the set rule and the access information.

3. The method of dynamic access control based on a local communication network according to claim 1, characterized in that: The edge device includes: a concentrator, a fusion terminal, a message sending terminal, a key acquisition module, and a detailed information sending module. The message sending terminal is used to send access request information to the dynamic access control server, and the access information also carries brief device information; A key acquisition module, after receiving the trusted verification message sent by the dynamic access control server, verifies the legitimacy of the certificate of the policy execution server, and obtains the session key if the certificate is legitimate; The detailed information sending module is used to send the device detailed information to the dynamic access control server in a symmetrically encrypted manner using the session key.

4. A method for dynamic access control based on a local communication network according to claim 3, characterized in that: The dynamic access control server comprises: An identity authentication module, used to verify the validity of the device network access certificate, and if the device network access certificate is valid, verify whether the edge device meets the access conditions according to the policy rules; A trusted verification module, configured to send a trusted verification message to the edge device when the edge device is under load access conditions; The identity information determination module is used to receive the device detailed information and generate a device code, and the device identity information is formed by the device detailed information and the device code.

5. The method of dynamic access control based on a local communication network according to claim 3, characterized in that: The dynamic access control server also includes: The certificate sending module is used to send the device network access certificate to the edge device when the edge device sends access request information to the dynamic access control server, wherein the rule determines whether to allow the edge device to access the network based on the certificate chain.

6. A method for dynamic access control based on a local communication network according to claim 3, characterized in that: The edge device obtains a device network access certificate from the dynamic access control server, and sends access information carrying the device network access certificate to the dynamic access control server; Wherein, the policy rule determines whether to allow the edge device to access the network based on the certificate chain; After receiving the access information sent by the edge device, the dynamic access control server performs identity authentication on the edge device according to the policy rule and the access information.

7. A method for dynamic access control based on a local communication network according to claim 1, characterized in that: The edge device obtains a device network access certificate from a dynamic access control server, and sends access information carrying the device network access certificate to the dynamic access control server, including: the edge device sends access request information to the dynamic access control server, and after the dynamic access control server responds to the access request information, sends access information to the execution server, wherein the access information also carries device brief information; After receiving the trusted verification message sent by the dynamic access control server, the edge device verifies the legitimacy of the certificate of the dynamic access control server, and obtains the session key if the certificate is legitimate; The edge device sends device detailed information to the dynamic access control server in a symmetrically encrypted manner using the session key.

8. A method for dynamic access control based on a local communication network according to claim 1, characterized in that: After receiving the trusted verification message sent by the policy execution server, the edge device verifies the legitimacy of the certificate of the policy execution server, and obtains the session key if the certificate is legitimate, including: The edge device extracts the public key from the certificate if the certificate is valid; The edge device verifies the message signature using the public key and decrypts the message signature to determine the session key.

9. A method for dynamic access control based on a local communication network according to claim 1, characterized in that: After receiving the access information sent by the edge device, the dynamic access control server performs identity authentication on the edge device according to the policy rule and the access information, including: The dynamic access control server verifies the validity of the device network access certificate, and if the device network access certificate is valid, verifies whether the edge device meets the access conditions according to the policy rules; The dynamic access control server sends a trusted verification message to the edge device when the edge device has a load access condition; The dynamic access control server receives the device detailed information and generates a device code, and the device identity information is formed by the device detailed information and the device code.

10. A method for dynamic access control based on a local communication network according to claim 1, characterized in that: The dynamic access control server sends the policy rule and sends the device network access certificate to the edge device, including: In a case where the dynamic access control server authenticates the edge device, the dynamic access control server sends a policy rule to the policy execution server; In the case where the edge device sends access request information to the policy execution server, the dynamic access control server sends the device network access certificate to the edge device, wherein the policy rule determines whether to allow the edge device to access the network based on the certificate chain.

Images