A dynamic access control method based on a local communication network

Abstract

This invention relates to the field of power Internet of Things (IoT) technology, specifically a dynamic access control method based on a local communication network. This method enables fine-grained access control and permission management, allowing authorized users or devices to access specific power resources and functions. The main components include: establishing a dynamic access control model, implementing dynamic access control strategies, optimizing dynamic access control based on intelligent algorithms, and designing a security audit mechanism. This invention achieves dynamic control over power terminal access. For various situations during the power terminal access process, such as authentication failures or insufficient permissions, corresponding dynamic access control strategies are formulated to ensure system security and stability, improve the efficiency and accuracy of dynamic access control, and establish a comprehensive security audit mechanism to monitor various behaviors and events during the power terminal access process, promptly detect and handle potential security risks, and ensure system security.

Description

Technical Field

[0001] This invention relates to the field of power Internet of Things (IoT) technology, specifically a dynamic access control method based on a local communication network. Background Technology

[0002] In traditional access control models, users acquire corresponding permissions based on role attributes. However, in zero-trust architectures, the relatively static or closed network environments of the past are becoming increasingly rare, gradually evolving towards open environments. User identities are not fixed, and login and logout operations are frequent, placing higher demands on access control models.

[0003] To address the above issues, it is necessary to study a dynamic access control method based on a local communication network. Summary of the Invention

[0004] The purpose of this invention is to provide a dynamic access control method based on a local communication network, which solves the problem that the security protection of terminal service terminals and edge aggregation terminals is still lacking and vulnerable to attacks, leading to subsequent attacks.

[0005] To achieve the above objectives, the present invention provides the following technical solution:

[0006] The first aspect of this invention provides a dynamic access control method based on a local communication network, characterized by: implementing fine-grained access control and permission management, allowing authorized users or devices to access specific power resources and functions, mainly comprising:

[0007] Establish a dynamic access control model: Based on the identity and permission level of the power terminal, establish a dynamic access control model, including a role authorization model and an access control matrix, to achieve dynamic control over access to the power terminal;

[0008] Implement dynamic access control policies: Develop corresponding dynamic access control policies for various situations during the power terminal access process to ensure the security and stability of the system;

[0009] Dynamic access control optimization based on intelligent algorithms: For large power systems, dynamic access control involves a very large authorization and access control matrix, so it is necessary to optimize it through intelligent algorithms to improve the efficiency and accuracy of dynamic access control.

[0010] The process of optimizing dynamic access control based on intelligent algorithms is as follows:

[0011] Access Control Matrix

[0012] The access control matrix M is an n×m matrix, where n is the number of users (or subjects) and m is the number of resources (or objects); the elements M in the matrix... ijThis indicates the access permissions of user i to resource j;

[0013] Among them, M ij =1 indicates that user i has access to resource j, M ij =0 indicates no access permission;

[0014] Optimize objective function

[0015] Construct the comprehensive objective function F:

[0016] F=α*Delay+β*(1-Accuracy)

[0017] Here, α and β are weighting coefficients used to balance the importance of access latency and access control accuracy; Delay represents average access latency, and Accuracy represents access control accuracy.

[0018] Average access latency (Delta) can be calculated using the following formula:

[0019]

[0020] Where N is the total number of access requests, and Tk is the processing time for the k-th access request;

[0021] Access control accuracy can be calculated using the following formula:

[0022] textAccuracy = Total number of access requests / Number of correctly authorized access requests;

[0023] Design a security audit mechanism: Establish a sound security audit mechanism to monitor various behaviors and events during the power terminal access process, and promptly identify and address potential security risks.

[0024] Preferably, it includes: a dynamic access control server and an edge device, wherein the edge device communicates with the dynamic access control server;

[0025] The edge device obtains a device network access certificate from the dynamic access control server and sends access information carrying the device network access certificate to the dynamic access control server; the dynamic access control server determines whether to allow the edge device to enter the network based on the certificate chain.

[0026] After receiving the access information sent by the edge device, the access control server performs authentication on the edge device according to the set rules and the access information.

[0027] Preferably, the edge device includes: a concentrator, a converged terminal, a message sending terminal, a key acquisition module, and a detailed information sending module. The message sending terminal is used to send access request information to the dynamic access control server, and the access information also carries brief device information.

[0028] After receiving the trusted verification message sent by the dynamic access control server, the key acquisition module verifies the validity of the certificate of the policy enforcement server. If the certificate is valid, it acquires the session key.

[0029] The detailed information sending module is used to send device details to the dynamic access control server using the session key in a symmetric encryption manner.

[0030] Preferably, the dynamic access control server includes:

[0031] The authentication module is used to verify the validity of the device's network access certificate. If the device's network access certificate is valid, it verifies whether the edge device meets the access conditions according to the policy rules.

[0032] A trusted verification module is used to send a trusted verification message to the edge device under the condition of load access of the edge device;

[0033] The identity information determination module is used to receive the device details and generate a device code, and to construct device identity information by combining the device details and the device code.

[0034] Preferably, the dynamic access control server further includes:

[0035] The certificate sending module is used to send the device network access certificate to the edge device when the edge device sends access request information to the dynamic access control server, wherein the rule determines whether to allow the edge device to enter the network based on the certificate chain.

[0036] Preferably, the edge device obtains the device access certificate from the dynamic access control server and sends the access information carrying the device access certificate to the dynamic access control server;

[0037] The policy rules determine whether to allow edge devices to access the network based on the certificate chain;

[0038] After receiving the access information sent by the edge device, the dynamic access control server performs authentication on the edge device according to the policy rules and the access information.

[0039] Preferably, the edge device obtains a device network access certificate from the dynamic access control server and sends access information carrying the device network access certificate to the dynamic access control server, including: the edge device sends access request information to the dynamic access control server, and after the dynamic access control server responds to the access request information, it sends access information to the execution server, wherein the access information also carries brief device information;

[0040] After receiving the trusted verification message sent by the dynamic access control server, the edge device verifies the validity of the dynamic access control server's certificate. If the certificate is valid, it obtains the session key.

[0041] The edge device uses the session key to send device details to the dynamic access control server in a symmetric encrypted manner.

[0042] Preferably, after receiving the trusted verification message sent by the policy enforcement server, the edge device verifies the validity of the policy enforcement server's certificate. If the certificate is valid, it obtains the session key, including:

[0043] If the certificate is valid, the edge device extracts the public key from the certificate;

[0044] The edge device uses the public key to verify the message signature and decrypts the message signature to determine the session key.

[0045] Preferably, after receiving the access information sent by the edge device, the dynamic access control server performs authentication on the edge device according to the policy rules and the access information, including:

[0046] The dynamic access control server verifies the validity of the device's network access certificate. If the device's network access certificate is valid, it verifies whether the edge device meets the access conditions according to the policy rules.

[0047] The dynamic access control server sends a trusted verification message to the edge device under the condition of the edge device's load access.

[0048] The dynamic access control server receives the device details and generates a device code. The device identification information is formed by combining the device details and the device code.

[0049] Preferably, the dynamic access control server sends policy rules and sends the device network access certificate to the edge device, including:

[0050] When the dynamic access control server authenticates the edge device, the dynamic access control server sends policy rules to the policy enforcement server.

[0051] When the edge device sends an access request to the policy enforcement server, the dynamic access control server sends the device's network access certificate to the edge device, wherein the policy rules determine whether to allow the edge device to access the network based on the certificate chain.

[0052] Compared with the prior art, the beneficial effects of the present invention are:

[0053] This invention studies how to achieve fine-grained access control and permission management to ensure that only authorized users or devices can access specific power resources and functions; and establishes a dynamic access control model: based on the identity and permission level of the power terminal, a dynamic access control model is established, including a role authorization model, access control matrix, etc., to achieve dynamic control of power terminal access.

[0054] Implement dynamic access control policies: For various situations during the power terminal access process, such as authentication failure and insufficient permissions, formulate corresponding dynamic access control policies to ensure the security and stability of the system.

[0055] Dynamic access control optimization based on intelligent algorithms: For large power systems, dynamic access control involves a very large authorization and access control matrix, so it is necessary to optimize it through intelligent algorithms to improve the efficiency and accuracy of dynamic access control.

[0056] Design a security audit mechanism: Establish a sound security audit mechanism to monitor various behaviors and events during the power terminal access process, promptly identify and address potential security risks, and ensure system security. Attached Figure Description

[0057] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 This is a flowchart of a dynamic access control method based on a local communication network according to the present invention. Detailed Implementation

[0059] The technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0060] A dynamic access control method based on a local communication network enables fine-grained access control and permission management, allowing authorized users or devices to access specific power resources and functions. The method mainly includes: establishing a dynamic access control model: based on the identity and permission level of the power terminal, a dynamic access control model is established, including a role authorization model and an access control matrix, to achieve dynamic control over the access of the power terminal.

[0061] Implement dynamic access control policies: For various situations during the power terminal access process, such as authentication failure and insufficient permissions, formulate corresponding dynamic access control policies to ensure the security and stability of the system;

[0062] Dynamic access control optimization based on intelligent algorithms: For large power systems, dynamic access control involves a very large authorization and access control matrix, so it is necessary to optimize it through intelligent algorithms to improve the efficiency and accuracy of dynamic access control.

[0063] The process of optimizing dynamic access control based on intelligent algorithms is as follows:

[0064] Access Control Matrix

[0065] The access control matrix M is an n×m matrix, where n is the number of users (or subjects) and m is the number of resources (or objects); the elements M in the matrix... ij This indicates the access permissions of user i to resource j;

[0066] Among them, M ij =1 indicates that user i has access to resource j, M ij =0 indicates no access permission;

[0067] Optimize objective function

[0068] Construct the comprehensive objective function F:

[0069] F=α*Delay+β*(1-Accuracy)

[0070] Here, α and β are weighting coefficients used to balance the importance of access latency and access control accuracy; Delay represents average access latency, and Accuracy represents access control accuracy.

[0071] Average access latency (Delta) can be calculated using the following formula:

[0072]

[0073] Where N is the total number of access requests, and Tk is the processing time for the k-th access request;

[0074] Access control accuracy can be calculated using the following formula:

[0075] textAccuracy = Total number of access requests / Number of correctly authorized access requests;

[0076] This invention optimizes access control strategies using genetic algorithms, effectively improving the efficiency and accuracy of access control.

[0077] Design a security audit mechanism: Establish a sound security audit mechanism to monitor various behaviors and events during the power terminal access process, promptly identify and address potential security risks, and ensure system security.

[0078] A dynamic access control server and an edge device are configured, wherein the edge device communicates with the dynamic access control server; the edge device obtains a device access certificate from the dynamic access control server and sends access information carrying the device access certificate to the dynamic access control server; the dynamic access control server determines whether to allow the edge device to access the network based on the certificate chain.

[0079] After receiving the access information sent by the edge device, the access control server performs authentication on the edge device according to the set rules and the access information.

[0080] Edge devices include: a concentrator, a converged terminal, a message sending terminal, a key acquisition module, and a detailed information sending module. The message sending terminal is used to send access request information to the dynamic access control server, and the access information also carries brief device information.

[0081] After receiving the trusted verification message sent by the dynamic access control server, the key acquisition module verifies the validity of the certificate of the policy enforcement server. If the certificate is valid, it acquires the session key.

[0082] The detailed information sending module is used to send device details to the dynamic access control server using the session key in a symmetric encrypted manner.

[0083] Dynamic access control servers include:

[0084] The authentication module is used to verify the validity of the device's network access certificate. If the device's network access certificate is valid, it verifies whether the edge device meets the access conditions according to the policy rules.

[0085] A trusted verification module is used to send a trusted verification message to the edge device under the condition of load access of the edge device;

[0086] The identity information determination module is used to receive the device details and generate a device code, and to construct device identity information by combining the device details and the device code.

[0087] The dynamic access control server also includes:

[0088] The certificate sending module is used to send the device network access certificate to the edge device when the edge device sends access request information to the dynamic access control server, wherein the rule determines whether to allow the edge device to enter the network based on the certificate chain.

[0089] The edge device obtains the device access certificate from the dynamic access control server and sends the access information carrying the device access certificate to the dynamic access control server.

[0090] The policy rules determine whether to allow edge devices to access the network based on the certificate chain;

[0091] After receiving the access information sent by the edge device, the dynamic access control server authenticates the edge device according to the policy rules and the access information.

[0092] The edge device obtains a device network access certificate from the dynamic access control server and sends access information carrying the device network access certificate to the dynamic access control server. This includes: the edge device sending access request information to the dynamic access control server, and after the dynamic access control server responds to the access request information, sending access information to the execution server. The access information also carries brief device information.

[0093] After receiving the trusted verification message sent by the dynamic access control server, the edge device verifies the validity of the dynamic access control server's certificate. If the certificate is valid, it obtains the session key.

[0094] The edge device uses the session key to send device details to the dynamic access control policy enforcement server in a symmetric encrypted manner. The server verifies the validity of the certificate. If the certificate is valid, the server obtains the session key, including:

[0095] If the certificate is valid, the edge device extracts the public key from the certificate;

[0096] The edge device uses the public key to verify the message signature and decrypts the message signature to determine the session key.

[0097] After receiving the access information sent by the edge device, the dynamic access control server performs authentication on the edge device according to the policy rules and the access information, including:

[0098] The dynamic access control server verifies the validity of the device's network access certificate. If the device's network access certificate is valid, it verifies whether the edge device meets the access conditions according to the policy rules.

[0099] The dynamic access control server sends a trusted verification message to the edge device under the condition of the edge device's load access.

[0100] The dynamic access control server receives the device details and generates a device code. The device identification information is formed by combining the device details and the device code.

[0101] The dynamic access control server sends policy rules and sends the device's network access certificate to the edge device, including:

[0102] When the dynamic access control server authenticates the edge device, the dynamic access control server sends policy rules to the policy enforcement server.

[0103] When the edge device sends an access request to the policy enforcement server, the dynamic access control server sends the device's network access certificate to the edge device, wherein the policy rules determine whether to allow the edge device to access the network based on the certificate chain.

[0104] In the description of this specification, references to terms such as "an embodiment," "example," "specific example," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0105] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A dynamic access control method based on a local communication network, characterized in that: To implement fine-grained access control and permission management, allowing authorized users or devices to access specific power resources and functions, including: Establish a dynamic access control model: Based on the identity and permission level of the power terminal, establish a dynamic access control model, including a role authorization model and an access control matrix, to achieve dynamic control over access to the power terminal; Implement dynamic access control policies: Develop corresponding dynamic access control policies for various situations during the power terminal access process; The process of optimizing dynamic access control based on intelligent algorithms is as follows: Access Control Matrix The access control matrix M is an n×m matrix, where n is the number of users and m is the number of resources; the elements M in the matrix... ij This indicates the access permissions of user i to resource j; Among them, M ij =1 indicates that user i has access to resource j, M ij =0 indicates no access permission; Optimize objective function Construct the comprehensive objective function F: F = α*Delay + β*(1−Accuracy) Where α and β are weighting coefficients used to balance the importance of access latency and access control accuracy; Delay represents the average access latency, and Accuracy represents the access control accuracy. Average access delay (Delay) is calculated using the following formula: Where N is the total number of access requests, and Tk is the processing time for the k-th access request; Access control accuracy is calculated using the following formula: Accuracy = Total number of access requests / Number of correctly authorized access requests; Design a security audit mechanism: Establish a security audit mechanism to monitor various behaviors and events during the power terminal access process, and identify and address potential security risks.

2. The dynamic access control method based on a local communication network according to claim 1, characterized in that, include: A dynamic access control server and an edge device, wherein the edge device communicates with the dynamic access control server; The edge device obtains a device network access certificate from the dynamic access control server and sends access information carrying the device network access certificate to the dynamic access control server. The dynamic access control server determines whether to allow edge devices to access the network based on the certificate chain. After receiving the access information sent by the edge device, the dynamic access control server authenticates the edge device according to the policy rules and the access information. The policy rules determine whether to allow the edge device to join the network based on the certificate chain.

3. The dynamic access control method based on a local communication network according to claim 2, characterized in that: The edge device includes: a concentrator, a converged terminal, a message sending terminal, a key acquisition module, and a detailed information sending module. The message sending terminal is used to send access request information to the dynamic access control server. The access request information also carries brief device information. The key acquisition module, upon receiving the trusted verification message sent by the dynamic access control server, verifies the validity of the certificate of the dynamic access control server, and if the certificate is valid, acquires the session key. The detailed information sending module is used to send device details to the dynamic access control server using the session key in a symmetric encrypted manner.

4. The dynamic access control method based on a local communication network according to claim 3, characterized in that: The dynamic access control server includes: The authentication module is used to verify the validity of the device's network access certificate. If the device's network access certificate is valid, it verifies whether the edge device meets the access conditions according to the policy rules. The trusted verification module is used to send a trusted verification message to the edge device when the edge device meets the access conditions; The identity information determination module is used to receive the device details and generate a device code, and to construct device identity information by combining the device details and the device code.

5. The dynamic access control method based on a local communication network according to claim 3, characterized in that: The dynamic access control server also includes: The certificate sending module is used to send the device access certificate to the edge device when the edge device sends access request information to the dynamic access control server.

6. The dynamic access control method based on a local communication network according to claim 2, characterized in that: The edge device obtains a device network access certificate from the dynamic access control server and sends access information carrying the device network access certificate to the dynamic access control server, including: the edge device sends access request information to the dynamic access control server, and after the dynamic access control server responds to the access request information, the edge device sends access information to the dynamic access control server, wherein the access request information also carries brief device information. After receiving the trusted verification message sent by the dynamic access control server, the edge device verifies the validity of the dynamic access control server's certificate. If the certificate is valid, it obtains the session key. The edge device uses the session key to send device details to the dynamic access control server in a symmetric encrypted manner.

7. The dynamic access control method based on a local communication network according to claim 2, characterized in that: After receiving the trusted verification message sent by the dynamic access control server, the edge device verifies the validity of the dynamic access control server's certificate. If the certificate is valid, it obtains the session key, including: If the certificate is valid, the edge device extracts the public key from the certificate; The edge device uses the public key to verify the message signature and decrypts the message signature to determine the session key.

8. The dynamic access control method based on a local communication network according to claim 2, characterized in that: After receiving the access information sent by the edge device, the dynamic access control server performs authentication on the edge device according to the policy rules and the access information, including: The dynamic access control server verifies the validity of the device's network access certificate. If the device's network access certificate is valid, it verifies whether the edge device meets the access conditions according to the policy rules. When the edge device meets the access conditions, the dynamic access control server sends a trusted verification message to the edge device. The dynamic access control server receives detailed device information and generates a device code. The detailed device information and the device code together constitute the device identity information.

Images