Power network context scene association access control method and system

Abstract

The invention belongs to the technical field of power information security, and discloses a power network context scene association access control method and system, and the method comprises the steps: obtaining an access request and multi-dimensional context information associated with the access request, the multi-dimensional context information comprises at least one of time information, position information, equipment state information, user behavior information and network environment information, analyzing the multi-dimensional context information, identifying a power business scene to which the current access request belongs, and dynamically generating or adjusting an access control strategy for the current access request; and performing an access control operation on the access request based on the dynamically generated or adjusted access control policy. According to the method, the access control strategy can be dynamically adjusted according to the real-time context and the specific service scene of the power network, the accuracy, the flexibility and the safety of access control are improved, and the method effectively adapts to a complex and changeable power network operation environment.

Description

Technical Field

[0001] The present invention relates to the technical field of electric power information security, and particularly to a dynamic access control method and system based on context awareness and scenario association, aiming to improve the security and operation and maintenance efficiency of electric power network information systems. Background Art

[0002] With the rapid development of smart grids, the informatization and intelligentization levels of electric power networks are increasing day by day. Various electric power business systems (such as dispatching automation systems, energy management systems EMS, distribution automation systems, marketing systems, remote monitoring systems, etc.) carry key business data and control instructions, and their secure and stable operation is of crucial significance to national energy security and social and economic development. At present, the access control mechanisms of electric power networks mostly adopt traditional models such as role-based access control (RBAC) or attribute-based access control (ABAC). These models mainly rely on pre-configured static policies to bind user identities, roles or attributes to resource permissions.

[0003] However, the actual operating environment of electric power networks is extremely complex and dynamic, and business scenarios also show diverse characteristics, such as daily inspections, emergency repairs, planned maintenance, remote equipment debugging, big data analysis, third-party service access, etc. In these different scenarios, there are significant differences in users' access requirements for resources, the sensitivity of operation behaviors, and potential security risks.

[0004] Traditional static access control policies often prove inadequate when dealing with these dynamic changes, mainly manifested in: the rigidity of the policies leads to insufficient flexibility, making it difficult to dynamically adjust permissions according to context factors such as the time, location, real-time status of the device, and the current network security situation of the operation; the lack of effective perception and in-depth understanding of specific business scenarios, for example, in the emergency repair scenario, it is difficult to support the need for temporary and strictly time-bound permission elevation; the permission setting granularity is often relatively coarse. To accommodate various possible business requirements, administrators may grant users a set of permissions that exceed the requirements of the current task, which is likely to result in permission surplus and abuse in specific scenarios, increasing the risk of unauthorized operations and data leakage; at the same time, for abnormal access behaviors or potential security threats, traditional mechanisms lack real-time risk assessment and linkage control capabilities, leading to a lag in risk response. Although concepts such as context-aware access control (CAAC) and risk-based access control (RBAC) provide new ideas for solving the above problems, their applications in the power network field are still in the exploratory stage, especially lacking a systematic solution that can deeply associate multi-dimensional context information with specific power business scenarios and dynamically generate and adjust refined access control policies. How to effectively identify complex and changing power business scenarios and build a dynamic and intelligent mapping relationship between scenarios and access control policies is the key technical challenge faced by the current power information security field.

[0005] Therefore, it is of great significance to develop a method and system that can make full use of multi-dimensional context information during the operation of the power network, accurately identify business scenarios, and dynamically adjust access control policies for improving the intelligent level of power network access control and the overall security protection ability. Summary of the Invention

[0006] The main purpose of the present invention is to overcome the problems of rigid existing power network access control policies, lack of scenario awareness ability, coarse permission granularity, and lag in risk response, and provide a power network context scenario association access control method and system.

[0007] To achieve the above object, the technical solutions adopted by the present invention are as follows:

[0008] The present invention provides a method for context - aware access control in a power network, comprising the following steps: Step S1: Obtain an access request and multi - dimensional context information associated with the access request. The multi - dimensional context information is dynamically changing and can reflect the specific environment and status when the access request occurs, including at least time information (such as the specific time of access, working day / holiday, working hours / non - working hours), location information (such as the geographical location where the access is initiated, logical location, IP address attribution), device status information (such as the current operating status, health condition, load situation, security patch level of the accessed device), user behavior information (such as the user's historical access pattern, recent operation sequence, login frequency, abnormal operation record), and network environment information (such as the current network traffic, security alert level, whether there is a known network attack).

[0009] Step S2: Analyze the multi - dimensional context information based on a preset scenario rule library or through a scenario recognition model to identify the power business scenario to which the current access request belongs. A power business scenario is a typical activity unit in the operation and management of a power system with specific goals, participants, operations, and environmental characteristics, such as daily inspection scenarios, emergency repair scenarios, remote operation and maintenance scenarios, data analysis scenarios, third - party collaboration scenarios, etc. The scenario rule library can be predefined by domain experts and contains a series of "IF - THEN" rules for judging the scenario type according to the combination of context information. For example, "IF (time = early morning AND location = non - office area AND operation = modify critical parameters) THEN scenario = high - risk abnormal operation scenario". The scenario recognition model is usually trained based on machine learning algorithms (such as decision trees, support vector machines, neural networks, clustering algorithms, etc.). By learning historical context data and corresponding known scenarios, the model can automatically identify the scenario to which a new access request belongs.

[0010] Step S3: According to the power business scenario, and in combination with a preset dynamic access control policy library or through a policy generation model, dynamically generate or adjust the access control policy for the current access request. The dynamic access control policy library can pre - store baseline policy templates and adjustment rules for different power business scenarios. The policy generation model can dynamically calculate the most appropriate access control decision based on the characteristics of the current scenario, the attributes of the user, the sensitivity of the resource, and the real - time risk assessment result. For example, in the "emergency repair" scenario, the control authority of the repair personnel for specific equipment can be temporarily increased, but strict restrictions are imposed on the validity period of the authority and the scope of operations, and behavior auditing is strengthened.

[0011] Step S4: Perform an access control operation on the access request based on the dynamically generated or adjusted access control policy. This includes deciding whether to allow access, deny access, partially allow (such as read-only permission, restricted operation frequency), require multi-factor authentication, record detailed audit logs, or trigger an alarm notification according to the policy.

[0012] The present invention also provides a power network context scenario associated access control system, including: a context information acquisition module, which is used to implement step S1 in the above method, that is, to acquire an access request and associated multi-dimensional context information. This module can integrate a variety of data collection interfaces and interface with various sensors, log systems, business systems, etc. in the power network.

[0013] A scenario recognition module, connected to the context information acquisition module, which is used to implement step S2 in the above method, that is, to analyze the context information and identify the power business scenario. This module can build a scenario rule engine or load a pre-trained scenario recognition model.

[0014] A policy management module, connected to the scenario recognition module, which is used to implement step S3 in the above method, that is, to dynamically generate or adjust an access control policy according to the identified scenario. This module can include a dynamic access control policy library and a policy generation engine.

[0015] An access control execution module, connected to the policy management module, which is used to implement step S4 in the above method, that is, to perform specific access control operations according to the generated policy. This module usually serves as a combination of a policy decision point (PDP) and a policy enforcement point (PEP).

[0016] The beneficial effects of the present invention are as follows:

[0017] 1. By real-time sensing and analyzing multi-dimensional context information and associating with specific power business scenarios, the access control decision of the present invention is no longer static and isolated, but can be dynamically adjusted according to the actual situation, so as to more accurately match the business requirements and security requirements, effectively cope with the complex and changeable power network environment, and improve the accuracy and dynamics of access control.

[0018] 2. The present invention can effectively identify and respond to different power business scenarios, provide differentiated and customized access control policies for access requests in different scenarios, and dynamically grant the minimum necessary permissions according to the scenario and context, avoiding the risk of permission abuse that may be caused by overly broad permission settings in the traditional method, improving the flexibility, business continuity and overall security of the system, and enhancing the scenario adaptation ability and fine-grained permission management.

[0019] 3. By integrating risk assessment into the access control decision-making process, the present invention can focus on and restrict high-risk access requests, and can adjust the strategy in a timely manner according to changes in the context to cope with potential threats, realizing the transformation from passive defense to active risk management. At the same time, on the premise of ensuring security, the user experience of compliance operations and the operation and maintenance efficiency of emergency scenarios are optimized, and the risk prevention and active response capabilities are strengthened. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0021] Figure 1 It is a schematic diagram of the overall architecture of an implementation manner of the context-aware access control system for a power network according to the present invention;

[0022] Figure 2 It is a schematic diagram of the process flow of an implementation manner of the context-aware access control method for a power network according to the present invention;

[0023] Figure 3 It is a schematic diagram of an implementation manner of the context information processing, scene recognition, and policy generation process according to the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0024] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, rather than all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the scope of protection of the present invention.

[0025] Embodiment 1:

[0026] Implementation of a context-aware access control method for a power network

[0027] Please refer to Figure 2 , this embodiment describes the detailed steps of a context-aware access control method for a power network.

[0028] Step S1: Obtain an access request and multi-dimensional context information.

[0029] When a user or a system component (collectively referred to as the access subject below) attempts to access a certain resource in the power grid (such as a database, a control instruction interface, a configuration file, etc.), the system first captures the access request. The access request usually includes the access subject identifier, the target resource identifier, and the type of requested operation (such as read, write, execute, delete, etc.). At the same time, the context information acquisition module actively collects or passively receives multi-dimensional context information related to this access request. This information may come from:

[0030] Time information: The system clock obtains the current timestamp to determine whether it is working hours, a holiday, etc.

[0031] Location information: The physical or logical location of the access subject is obtained through IP address location, GPS information (for mobile terminals or operation and maintenance personnel), base station location, or network topology analysis.

[0032] Device status information: The operating status (such as normal, warning, under maintenance), load level, and security configuration (such as firewall rules, patch version) of the target resource or related power equipment are obtained from the device management system, the SCADA system, or the device itself.

[0033] User behavior information: The historical behavior patterns (such as commonly used login IP, commonly used operation time, access frequency), recent operation sequences, and whether there are records of abnormal login attempts of the access subject are queried from the user authentication system and the log audit system.

[0034] Network environment information: The current network traffic status, security domain information, and whether there are relevant security alerts or threat intelligence are obtained from the network monitoring system and the intrusion detection system (IDS / IPS).

[0035] Attributes of the access request itself: For example, whether the requested operation is a high-risk operation and whether the requested resource is a core sensitive resource.

[0036] Step S2: Preprocessing of context information.

[0037] The obtained original context information may have problems such as inconsistent formats, data redundancy, and noise interference. Therefore, it needs to be preprocessed, including:

[0038] Data cleaning: Remove invalid or incorrect data.

[0039] Format conversion: Convert data from different sources into a unified format for subsequent processing.

[0040] Feature extraction and quantization: Extract key features from the original information and represent them quantitatively. For example, convert the IP address into a geographical region label and quantify the device status "warning" as a relatively high risk value.

[0041] Step S3: Power business scenario recognition.

[0042] The scenario recognition module receives the preprocessed context information vector C = T, L, D, U, N, A,.... This module can perform scenario recognition in one or a combination of the following ways:

[0043] 1) Recognition based on a rule library: A series of "IF context condition combinations THEN scenario category" rules defined by power domain experts are stored in the scenario rule library. For example:

[0044] IF (T = normal working hours on a weekday AND L = office area AND U = normal operation sequence AND D = equipment normal) THEN Scene = daily office scenario

[0045] IF (T = any time AND A = emergency control instruction AND D = equipment fault alarm AND U = authorized emergency response personnel) THEN Scene = emergency repair scenario

[0046] 2) Recognition based on a scenario recognition model: A machine learning model (such as a pre-trained decision tree, support vector machine, or deep neural network model) is used. By learning a large amount of historical context data and their corresponding true scenario labels, this model can automatically learn the feature patterns of scenarios from the context information. Input the current context information vector C, and the model outputs the predicted scenario category Scene ID and its confidence level. For example, the model may recognize "remote planned maintenance scenario", "data batch query and analysis scenario", "new equipment access and commissioning scenario", etc.

[0047] Step S3a: Risk assessment.

[0048] Before generating a policy, a risk assessment of the access request is performed. The risk assessment module calculates a comprehensive risk score R based on the current context information and the recognized scenario. For example, a weighted scoring model can be used:

[0049] R = w t ·f t (T) + w l ·f l (L) + w d ·f d (D) + w u ·f u (U) + w n ·f n (N) + w a ·f a (A)

[0050] where, w xis the risk weight of each context dimension, f x (X) is the risk mapping function of the context information of the corresponding dimension (for example, the risk value of accessing f t (T) during non-working hours is higher than that during working hours; the risk value of operating the core device f a (A) is higher than that of operating ordinary devices). The scenario itself may also have an inherent risk coefficient. The obtained risk score R can be an important input for policy generation. For example, high-risk scenarios or high-risk requests may trigger more stringent access control policies.

[0051] Step S4: Dynamically generate or adjust the access control policy.

[0052] The policy management module dynamically generates or adjusts the access control policy according to the identified power business scenario Scene ID , in combination with the identity / role of the access subject, the attributes of the target resource, and the risk assessment result.

[0053] 1) Based on the dynamic access control policy library: Different baseline access policy sets for different scenarios are predefined in the policy library. For example, for the "daily inspection scenario", the inspection personnel are allowed to read the relevant device status parameters but are prohibited from modifying the configuration; for the "emergency repair scenario", the repair engineer is temporarily granted full control rights over the faulty device, but a strict permission validity period (such as 2 hours) is set, and all operations are forced to be recorded.

[0054] 2) Through the policy generation model: A more advanced method is to adopt the policy generation model, which can be an intelligent agent based on reinforcement learning or a complex decision logic. It comprehensively considers the scenario Scene ID , the user profile User profile , the resource attributes Resource attr , and the real-time risk score RiskScore, and then outputs a specific access control decision P = Decision(Scene ID ,User profile ,Resource attr ,RiskScore). The policy P may include allow / deny, specific permission subsets (such as allowing reading field A and prohibiting writing field B), access conditions (such as requiring secondary approval, restricting the number of concurrent connections), etc.

[0055] Step S5: Execute the access control operation. The access control execution module receives the final access control policy P generated by the policy management module and enforces it.

[0056] If the policy is allow, the access request is released, and the access subject is allowed to perform the requested operation on the target resource.

[0057] If the policy is to deny, the access request is blocked.

[0058] If the policy contains restrictive conditions, execute according to the conditions (such as only granting read-only permissions, or requiring the user to perform secondary authentication through dynamic passwords, biometrics, etc.).

[0059] Step S6: Audit records.

[0060] All access attempts, whether successful or not, and their related context information, identified scenarios, generated policies, and execution results, should be detailedly recorded in the audit log (through the audit and monitoring module, such as Figure 1 implemented by J in

[0061] In steps S3 and S4, a knowledge graph engine can be utilized for assistance. Various entities (such as users, devices, systems, data, regions) and their relationships in the power network are stored in the knowledge graph. When identifying scenarios, query the knowledge graph to obtain richer association information for auxiliary judgment. When generating policies, use the knowledge graph for permission reasoning or recommendation.

[0062] Embodiment 2: Construction of an access control system for power network context scenario association

[0063] Please refer to Figure 1 , this embodiment describes a typical architecture of an access control system for power network context scenario association. This system mainly consists of the following modules:

[0064] 1) Context information acquisition module:

[0065] Data acquisition interface unit: Provides multiple standard interfaces (such as Syslog, JDBC, ODBC, SNMP, MQTT, RESTfulAPI) for collecting raw context data from various data sources in the power network (such as SCADA system logs, EMS operation records, network device logs, security device alarms, identity authentication systems, physical security systems, IoT sensor platforms, meteorological services, GIS services, etc.).

[0066] Data preprocessing unit: Cleans, denoises, unifies the format, synchronizes time, fuses data (for example, associates an IP address with a specific physical device or user), and performs feature engineering on the collected raw data, and outputs a structured context feature vector.

[0067] 2) Scenario recognition module:

[0068] Scenario Rule Engine: It has a built-in configurable rule library that stores scenario recognition rules defined by power safety experts and business experts. The rule engine matches the rules based on the input context feature vector to identify the current business scenario.

[0069] Scenario Model Unit: Deploy one or more scenario recognition models trained through machine learning algorithms (such as classification models trained based on historical data). This unit receives context features and outputs the most likely business scenario and its confidence level.

[0070] Scenario Library: Stores the descriptions, features, and metadata related to the defined power business scenarios.

[0071] 3) Risk Assessment Module:

[0072] Risk Factor Library: Defines various risk factors related to power network access and their quantification criteria, such as user credibility, resource sensitivity, operation risk level, environmental threat level, etc.

[0073] Risk Calculation Engine: Based on the current context information, the identified business scenario, and the risk factor library, it calculates the comprehensive risk score of the current access request in real time. It can adopt a calculation method based on formulas or a risk prediction model based on machine learning.

[0074] 4) Policy Management Module:

[0075] Dynamic Policy Library: Stores access control policy templates and fine-grained permission definitions for different power business scenarios and different risk levels.

[0076] Policy Generation Engine: The core decision-making unit. It receives the scenario information from the scenario recognition module, the risk score from the risk assessment module, the attributes of the access subject, and the attributes of the target resource, and then selects, combines, or dynamically generates the most appropriate access control policy from the policy library according to the preset policy generation logic.

[0077] Policy Distribution Interface: Transfers the generated access control policy to the access control execution module.

[0078] 5) Access Control Execution Module:

[0079] Policy Decision Point: Receives the access request and the access control policy generated by the policy management module, and makes the final allow / deny decision.

[0080] Policy Enforcement Point: Deployed on various key access paths of the power network (such as network boundaries, server fronts, application gateways), responsible for intercepting access requests and actually executing access control actions according to the decision result of the PDP.

[0081] 6) Knowledge Graph Engine:

[0082] Graph database: Stores the knowledge graph in the power domain, including entities, attributes, and relationships;

[0083] Graph query and reasoning interface: Provides the scenario recognition module and the policy management module with the ability to query entity relationships and perform semantic reasoning to obtain deeper context insights, assisting in more accurate scenario judgment and policy formulation.

[0084] 7) Audit and monitoring module:

[0085] Logging unit: Records in detail all access requests, collected context information, identified scenarios, evaluated risks, generated policies, execution results, and any policy adjustments.

[0086] Monitoring and alerting unit: Monitors the system operation status and access behavior in real time. For situations such as policy violation attempts, high-risk events, and system anomalies, generates alerts and notifies the administrator.

[0087] Report and analysis unit: Provides statistical reports and data analysis functions to help the administrator understand the effectiveness of access control, identify potential security trends, and optimize policies.

[0088] 8) Management console: Provides a graphical user interface for the administrator to configure system parameters, manage the scenario rule library and policy library, view monitoring information and audit logs, handle alert events, and perform system maintenance.

[0089] In actual deployment, these modules can be deployed in a centralized or distributed manner according to needs. For example, the policy enforcement points usually need to be distributed close to the protected resources, while other modules can be centrally deployed in the security management center.

[0090] Through the above methods and systems, the intelligent and adaptive capabilities of power network access control can be significantly improved, providing strong guarantees for the safe and stable operation of the power system.

[0091] Although the specific implementation manners of the present invention have been described above, those skilled in the art should understand that these specific implementation manners are only examples. Without departing from the principles and essence of the present invention, those skilled in the art can make various omissions, substitutions, and changes to the details of the above methods and systems. For example, combining the above method steps so as to perform substantially the same functions in a substantially the same manner to achieve substantially the same results belongs to the scope of the present invention. Therefore, the scope of the present invention is only defined by the appended claims.

Claims

1. A method for context - scenario - associated access control in a power network, characterized in that, It includes the following steps: Step S1: Obtain an access request and multi-dimensional context information associated with the access request, where the multi-dimensional context information includes at least one of time information, location information, device status information, user behavior information, and network environment information; Step S2: Analyze the multi-dimensional context information based on a preset scenario rule library or through a scenario recognition model to identify the power business scenario to which the current access request belongs; Step S3: According to the power business scenario and in combination with a preset dynamic access control policy library or through a policy generation model, dynamically generate or adjust an access control policy for the current access request; Step S4: And perform an access control operation on the access request based on the dynamically generated or adjusted access control policy.

2. The power network context scenario associated access control method according to claim 1, wherein After obtaining the multi-dimensional context information, it further includes: preprocessing the multi-dimensional context information, and the preprocessing includes data cleaning, format conversion, and feature extraction.

3. The power network context scenario associated access control method according to claim 1, characterized in that The power business scenarios include daily inspection scenarios, emergency repair scenarios, remote operation and maintenance scenarios, data analysis scenarios, or third-party collaboration scenarios.

4. A power network context scenario associated access control method according to claim 1, characterized in that The scenario recognition model is trained based on machine learning algorithms, and the machine learning algorithms include at least one of decision trees, support vector machines, neural networks, or clustering algorithms.

5. A power network context scenario associated access control method according to claim 1, characterized in that The step of dynamically generating or adjusting the access control policy further includes: performing a risk assessment on the current access request according to the power business scenario and the multi-dimensional context information to obtain a risk level; combining the risk level and the power business scenario to generate or adjust the access control policy, and the access control policy includes allowing access, denying access, restricting access permissions, or triggering secondary authentication.

6. The access control method for power network context scenario association according to claim 5, characterized in that, The risk assessment can adopt the following risk scoring function: Among them, R represents the risk score, and C i represents the i-th context factor, and f i (C i ) represents the risk calculation function corresponding to the i-th context factor, and w i represents the weight of the i-th context factor, and satisfies 7. The access control method for context scenario association of a power network according to claim 1, characterized in that The method further includes: using a knowledge graph to construct the association relationships between users, resources, operations, permissions, and business scenarios in the power network to assist in scenario recognition and policy generation.

8. A power network context scenario association access control system for implementing the method according to any one of claims 1 to 7, characterized in that, It includes: A context information acquisition module configured to obtain an access request and multi-dimensional context information associated with the access request, where the multi-dimensional context information includes at least one of time information, location information, device status information, user behavior information, and network environment information; a scenario recognition module connected to the context information acquisition module and configured to analyze the multi-dimensional context information based on a preset scenario rule library or through a scenario recognition model to identify the power business scenario to which the current access request belongs; A policy management module connected to the scenario recognition module and configured to dynamically generate or adjust an access control policy for the current access request according to the power business scenario and in combination with a preset dynamic access control policy library or through a policy generation model; And an access control execution module connected to the policy management module and configured to perform an access control operation on the access request based on the dynamically generated or adjusted access control policy.

9. An access control system for associating power network context scenarios according to claim 8, characterized in that, The system further includes: a risk assessment module, connected to the scenario recognition module and the policy management module, configured to perform a risk assessment on the current access request according to the power service scenario and the multi-dimensional context information, and provide the risk assessment result to the policy management module for generating or adjusting the access control policy.

10. An access control system for associating power network context scenarios according to claim 8, characterized in that, The system further includes: a knowledge graph engine, connected to the scenario recognition module and the policy management module, configured to store and query the association relationships among users, resources, operations, permissions, and service scenarios in the power network, and assist in scenario recognition and policy generation.

Images