Smart grid access control method and system based on dynamic management of node authority

Abstract

The application provides a kind of intelligent power grid access control method and system based on node authority dynamic management, obtains the node authority configuration data set of intelligent power grid system, executes authority feature analysis processing to node authority configuration data set, generates the authority feature set associated with each node authority configuration sequence, dynamically weight allocation processing is carried out to dynamic adjustment feature and static constraint feature in authority feature set, generates the dynamic authority adjustment instruction of node authority configuration sequence, generates the updated node authority configuration data set, and the updated node authority configuration data set is synchronized to multiple edge computing nodes of intelligent power grid system, executes access behavior real-time monitoring processing, generates access behavior feature set, and generates access control decision instruction according to access behavior feature set to trigger authority update operation.The application improves the security protection level and dynamic environment adaptability of intelligent power grid access control system.

Description

Technical Field

[0001] This invention relates to the field of access control, and more specifically, to a smart grid access control method and system based on dynamic node permission management. Background Technology

[0002] In the field of smart grid security, access control technology is a core mechanism for ensuring the safe operation of the power system. It constrains access behavior to devices and data through dynamic management of node permissions. Traditional smart grid access control methods typically employ static permission configuration strategies or permission update mechanisms based on time periods or role attributes, relying on a centralized permission server for global permission distribution. However, static configuration strategies are difficult to adapt to the dynamic adjustment of node resources and frequent access of edge computing devices in the smart grid, leading to a mismatch between permission settings and actual access needs. Simple dynamic adjustment mechanisms cannot effectively integrate the dynamic characteristics of node behavior with system security constraint rules, causing deviations in permission level determination. Centralized permission distribution models suffer from high synchronization latency and uneven network load in large-scale edge node scenarios, especially prone to causing permission data synchronization problems during sudden surges in access requests. Summary of the Invention

[0003] This invention provides a smart grid access control method and system based on dynamic node permission management.

[0004] In a first aspect, embodiments of the present invention provide a smart grid access control method based on dynamic node permission management, comprising:

[0005] Obtain a set of node permission configuration data for a smart grid system. The set of node permission configuration data includes multiple node permission configuration sequences, and each node permission configuration sequence consists of at least one node identifier and a corresponding permission level identifier.

[0006] Perform permission feature analysis processing on the node permission configuration data set to generate a permission feature set associated with each node permission configuration sequence. The permission feature set includes dynamic adjustment features of node permissions and static constraint features of node permissions.

[0007] Dynamic weight allocation is performed on the dynamic adjustment features and static constraint features in the permission feature set to generate dynamic permission adjustment instructions for the node permission configuration sequence;

[0008] According to the dynamic permission adjustment instruction, the node permission configuration sequence is dynamically adjusted to generate an updated node permission configuration data set, and the updated node permission configuration data set is synchronized to multiple edge computing nodes of the smart grid system.

[0009] Real-time monitoring of access behavior is performed on the multiple edge computing nodes. An access behavior feature set is generated based on the updated node permission configuration data set, and an access control decision instruction is generated based on the access behavior feature set to trigger a permission update operation.

[0010] In a second aspect, embodiments of the present invention provide a computer system, comprising:

[0011] A memory, wherein a computer program is stored;

[0012] A processor is used to load the computer program to implement the smart grid access control method based on node permission dynamic management as described above.

[0013] The smart grid access control method based on dynamic node permission management provided by this invention performs multi-dimensional fusion analysis of the dynamic adjustment features and static constraint features of node permissions and performs dynamic weight allocation processing. This allows the generation process of permission adjustment instructions to simultaneously reflect changes in real-time node behavior patterns and the constraints of inherent system security rules, thereby significantly improving the accuracy and scenario adaptability of permission configuration updates. By sharding and synchronizing the updated node permission configuration data according to the distribution topology of edge computing nodes and establishing a two-way authenticated transmission channel, the method ensures the integrity of permission data while enabling rapid collaborative updates of large-scale edge nodes, effectively improving the execution efficiency of permission adjustment instructions in a distributed architecture. By triggering permission level re-evaluation operations through dynamic matching and anomaly detection mechanisms based on real-time access behavior feature sets, a dynamic coupling feedback link between permission status and node behavior is constructed. This allows the permission management strategy to respond in real-time to changes in the smart grid operating environment, maintaining the flexible adjustment capability of node permissions while strengthening the proactive defense against abnormal access behavior, thus comprehensively improving the security protection level and dynamic environment adaptability of the smart grid access control system. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 This is a flowchart of a smart grid access control method based on dynamic node permission management provided in an embodiment of the present invention.

[0016] Figure 2 This is a schematic diagram of the composition of a computer system provided in an embodiment of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Please see Figure 1 , Figure 1 The flowchart illustrates a smart grid access control method based on dynamic node permission management, provided in an embodiment of the present invention. This smart grid access control method based on dynamic node permission management can be executed by a computer system and may include the following steps:

[0019] Step S100: Obtain the node permission configuration data set of the smart grid system. The node permission configuration data set includes multiple node permission configuration sequences. Each node permission configuration sequence consists of at least one node identifier and a corresponding permission level identifier.

[0020] The node permission configuration dataset is a summary of permission configuration information for each node in a smart grid system. It contains multiple node permission configuration sequences. Each node permission configuration sequence is the specific permission configuration information for each node, consisting of a node identifier and a corresponding permission level identifier. The node identifier is used to uniquely identify each node in the smart grid system; it can be, for example, a node's IP address or device number. The node identifier allows for accurate location of the specific node. The permission level identifier indicates the permission level possessed by the node. Different permission levels correspond to different operational permission ranges. For example, a higher permission level allows operations such as system configuration and data modification, while a lower permission level only allows operations such as data viewing.

[0021] When obtaining the node permission configuration data set, it can be extracted from the database of the central management node of the smart grid system. The central management node centrally manages and stores the node permission configurations for the entire system. Through database query statements, such as the SQL statement "SELECT * FROM node_permission_config", all node permission configuration data can be retrieved from the table storing node permission configuration information, thus obtaining the node permission configuration data set. For example, in a smart grid system with three nodes: Node A has an IP address of 192.168.1.100 and its permission level is high; Node B has an IP address of 192.168.1.101 and its permission level is medium; Node C has an IP address of 192.168.1.102 and its permission level is low. The node permission configuration dataset then contains the node permission configuration sequences for these three nodes, namely (192.168.1.100, high-level permissions), (192.168.1.101, medium-level permissions), and (192.168.1.102, low-level permissions).

[0022] Step S200: Perform permission feature analysis processing on the node permission configuration data set to generate a permission feature set associated with each node permission configuration sequence. The permission feature set includes the dynamic adjustment features of node permissions and the static constraint features of node permissions.

[0023] Permission feature analysis involves in-depth analysis of the node permission configuration dataset to uncover feature information related to the permission configuration sequence of each node. The permission feature set is a collection of various features obtained after analysis. Among them, dynamically adjusted features reflect the possible changes in node permissions under different times and scenarios, while static constraint features reflect the fixed restrictions on node permissions.

[0024] As one implementation method, step S200 involves performing permission feature analysis processing on the node permission configuration data set to generate a permission feature set associated with each node permission configuration sequence. Specifically, this may include the following steps S210 to S230:

[0025] Step S210: Obtain the historical access record data set of the smart grid system. The historical access record data set includes the historical access timestamp sequence and the historical access operation type sequence corresponding to the permission configuration sequence of each node.

[0026] The historical access record dataset is a summary of past access behavior records of each node in the smart grid system. The historical access timestamp sequence records the exact time each node performed an access operation, accurate to the year, month, day, hour, minute, and second. The timestamps clearly show the temporal sequence and time intervals of node access behavior. The historical access operation type sequence records the specific type of access operation performed by each node, such as data query, data modification, and equipment control.

[0027] Historical access record data can be obtained through the log server of the smart grid system. The log server records the access behavior information of each node and stores it in log files. Log parsing tools, such as Logstash, can be used to parse the log files and extract the historical access timestamp sequence and historical access operation type sequence corresponding to the permission configuration sequence of each node. For example, for node A (IP address 192.168.1.100), its historical access timestamp sequence might be [2025-01-01 10:00:00, 2025-01-01 11:30:00, 2025-01-02 09:15:00], and its historical access operation type sequence might be [data query, data modification, device control].

[0028] Step S220: Extract a node permission status data set that is time-related to the historical access record data set from the node permission configuration data set. The node permission status data set includes multiple node permission status parameters.

[0029] The node permission status dataset is a time-related dataset selected from the node permission configuration dataset and associated with the historical access record dataset. Node permission status parameters are specific parameters describing the node permission status, such as whether a permission is enabled or disabled, and the validity period of the permission.

[0030] When extracting node permission status data sets, time matching can be used. First, the timestamps in the historical access record data set are compared with the time information in the node permission configuration data set to identify node permission configuration data within the same time range or with a temporal relationship. Then, node permission status parameters are extracted from these matching data to form the node permission status data set. For example, if historical access record data shows that node A performed a data query operation on 2025-01-01 10:00:00, time matching can be used to find the permission status parameters of node A at that time in the node permission configuration data set. For example, if the permission is enabled and the permission validity period is from 2025-01-01 to 2025-01-31, these parameters can be combined into a part of the node permission status data set.

[0031] Step S230: Perform joint feature mapping processing on the historical access record data set and the node permission status data set to generate dynamic adjustment features and static constraint features; wherein, the dynamic adjustment features include at least one of the following: node permission access frequency fluctuation features and node permission cross-level operation features; the static constraint features include at least one of the following: node permission hierarchical binding features and node permission resource configuration constraint features.

[0032] Joint feature mapping processing involves correlating and analyzing historical access record datasets and node permission status datasets to extract information reflecting node permission characteristics. Dynamic adjustment features describe the changes in node permissions under dynamic conditions; access frequency fluctuation features reflect the frequency changes of node access operations over different time periods; and cross-level operation features indicate whether a node has performed operations exceeding its current permission level. Static constraint features reflect the fixed restrictions on node permissions; hierarchical binding features represent the binding relationship between node permissions and preset levels; and resource configuration constraint features represent the restrictions on the quantity and type of resources a node accesses.

[0033] When performing joint feature mapping, feature extraction algorithms from machine learning, such as Principal Component Analysis (PCA), can be used. First, the historical access record dataset and the node permission status dataset are integrated to form a multi-dimensional data matrix. Then, the PCA algorithm is used to reduce the dimensionality of this data matrix and extract the main feature components. For dynamically adjusted features, the access frequency of nodes in different time periods is calculated by analyzing the historical access timestamp sequence and the historical access operation type sequence, resulting in access frequency fluctuation features. Simultaneously, the operation types of nodes are compared with the operation types allowed at the current permission level to determine if cross-level operations exist, resulting in cross-level operation features. For statically constrained features, the node's permission level information and resource configuration information are directly extracted from the node permission configuration dataset, resulting in hierarchical binding features and resource configuration constraint features. For example, by analyzing the historical access records and permission status data of node A, it is found that its access frequency in a certain week is significantly higher than in other weeks, which reflects the access frequency fluctuation feature; if node A performs a device control operation that only high-level permissions can perform at a certain moment, but it has only intermediate permissions, this reflects the cross-level operation feature. The node permission configuration data clearly shows that node A has a medium-level permission and can only access resources of a specified type and quantity. This reflects the hierarchical binding feature and resource configuration constraint feature.

[0034] Step S300: Perform dynamic weight allocation processing on the dynamic adjustment features and static constraint features in the permission feature set to generate dynamic permission adjustment instructions for the node permission configuration sequence.

[0035] Dynamic weight allocation assigns different weights to dynamically adjustable features and static constraint features based on different scenarios and requirements, comprehensively considering the impact of these features on node permission adjustments. Dynamic permission adjustment instructions are generated based on the weight allocation results and are used to adjust node permissions, guiding the smart grid system to make corresponding adjustments to node permissions.

[0036] As one implementation method, step S300 involves dynamically weighting the dynamic adjustment features and static constraint features in the permission feature set to generate dynamic permission adjustment instructions for the node permission configuration sequence. This may specifically include the following steps S310 to S330:

[0037] Step S310: Obtain the pre-configured dynamic weight allocation strategy. The dynamic weight allocation strategy includes multiple weight allocation modes, and each weight allocation mode corresponds to a node permission adjustment scenario.

[0038] The pre-configured dynamic weight allocation strategy is a pre-defined strategy used to assign weights to dynamically adjustable features and static constraint features. The weight allocation mode is the specific allocation method in this strategy. Different weight allocation modes correspond to different node permission adjustment scenarios. For example, the weight allocation of dynamically adjustable features and static constraint features will be different in different scenarios such as when the system is under high load or when a security incident occurs.

[0039] The pre-configured dynamic weight allocation strategy can be obtained from the configuration file of the smart grid system. The configuration file is typically stored in text format, using a preset format such as JSON. The dynamic weight allocation strategy can be read from the configuration file using file reading functions in programming languages, such as the `json.load()` function.

[0040] Step S320: Perform feature dimension matching processing on the dynamically adjusted features and statically constrained features to generate feature matching results associated with the dynamic weight allocation strategy.

[0041] Feature dimension matching involves matching the dimensions of dynamically adjusted features and statically constrained features with the dimensions in a dynamic weight allocation strategy to determine a suitable weight allocation pattern. The feature matching result is the outcome of this matching process, indicating which weight allocation pattern best matches the current feature configuration.

[0042] When performing feature dimension matching, similarity calculation algorithms, such as the cosine similarity algorithm, can be used. First, the dynamically adjusted features and statically constrained features are represented as vectors, with each feature dimension corresponding to a component of the vector. Then, the feature dimensions in each weight allocation pattern are also represented as vectors. The cosine similarity algorithm is used to calculate the similarity between the current feature vector and the feature vectors of each weight allocation pattern. The weight allocation pattern with the highest similarity is the matched pattern. For example, if the current dynamically adjusted feature vector is [0.3, 0.7], the statically constrained feature vector is [0.6, 0.4], the feature vector of weight allocation pattern A is [0.5, 0.5], and the feature vector of weight allocation pattern B is [0.8, 0.2]. The cosine similarity algorithm calculates that the current feature vector has a similarity of 0.8 with pattern A and a similarity of 0.6 with pattern B; therefore, the feature matching result is pattern A.

[0043] Step S330: Determine the target weight allocation mode among multiple weight allocation modes based on the feature matching results, and perform weighted fusion processing on the dynamic adjustment features and static constraint features based on the target weight allocation mode to generate dynamic permission adjustment instructions; wherein, the dynamic permission adjustment instructions include at least one of the following: node permission level promotion instructions, node permission level demotion instructions, and node permission resource redistribution instructions.

[0044] The target weight allocation pattern is the most suitable pattern for the current feature situation, determined from multiple weight allocation patterns based on feature matching results. The weighted fusion process involves weighting and summing the dynamically adjusted features and statically constrained features according to the weights in the target weight allocation pattern to obtain a comprehensive feature value. A dynamic permission adjustment instruction is then generated based on this comprehensive feature value.

[0045] After determining the target weight allocation mode, the corresponding feature values ​​are weighted and summed according to the weights of the dynamically adjusted features and static constraint features in that mode. For example, if the target weight allocation mode is Mode A, the weight of the dynamically adjusted feature is 0.6, the weight of the static constraint feature is 0.4, the value of the dynamically adjusted feature is 0.7, and the value of the static constraint feature is 0.6, then the comprehensive feature value is 0.6 × 0.7 + 0.4 × 0.6 = 0.66. Based on the magnitude of the comprehensive feature value and preset rules, a dynamic permission adjustment instruction is generated. If the comprehensive feature value is greater than a certain threshold, an instruction to elevate the node permission level may be generated; if the comprehensive feature value is less than another threshold, an instruction to demote the node permission level may be generated; if the comprehensive feature value is within a certain range, an instruction to reallocate node permission resources may be generated. For example, when the comprehensive feature value is greater than 0.8, an instruction to elevate the node's permission level is generated, raising the node's permission level from low to medium; when the comprehensive feature value is less than 0.2, an instruction to demote the node's permission level is generated, demoting the node's permission level from high to medium; when the comprehensive feature value is between 0.3 and 0.7, an instruction to reallocate node permission resources is generated, adjusting the number and type of resources that the node can access.

[0046] Step S400: Perform dynamic permission adjustment processing on the node permission configuration sequence according to the dynamic permission adjustment instruction, generate an updated node permission configuration data set, and synchronize the updated node permission configuration data set to multiple edge computing nodes of the smart grid system.

[0047] Dynamic permission adjustment processing involves adjusting the permission information in the node permission configuration sequence according to dynamic permission adjustment instructions. The updated node permission configuration data set is a summary of the new node permission configuration information obtained after the adjustment. Synchronizing the updated node permission configuration data set to multiple edge computing nodes ensures that the permission information of all nodes in the entire smart grid system remains consistent, enabling accurate access control.

[0048] As one implementation method, step S400 involves performing dynamic permission adjustment processing on the node permission configuration sequence according to the dynamic permission adjustment instruction to generate an updated node permission configuration data set. Specifically, this may include the following steps S410 to S450:

[0049] Step S410: Create a permission adjustment transaction associated with the dynamic permission adjustment instruction in the central management node of the smart grid system, and capture the set of permission change operations and transaction log data generated during the execution of the permission adjustment transaction;

[0050] A permission adjustment transaction is an operational unit created to adjust node permissions, and it includes a series of permission change operations. The permission change operation set is a summary of the specific permission change operations performed during the execution of the permission adjustment transaction, such as permission level elevation and permission resource reallocation. The transaction log data records detailed information about the execution of the permission adjustment transaction, including the time of the operation, the operator, and the content of the operation.

[0051] Creating permission adjustment transactions in the central management node can utilize the database's transaction management mechanism, such as MySQL's `START TRANSACTION` statement. Then, based on the dynamic permission adjustment instructions, corresponding permission change operations are generated and added to the transaction. During transaction execution, logging tools, such as Python's `logging` module, are used to record detailed information about permission change operations and the transaction, thereby capturing the set of permission change operations and transaction log data. For example, to elevate node A's permission level from low to medium based on dynamic permission adjustment instructions, a permission level update operation is added to the transaction, and information such as the operation time and operator is recorded in the transaction log data.

[0052] Step S420: Extract permission status snapshot data that is operationally related to the permission change operation set from the transaction log data, and generate a transaction execution trajectory feature set based on the permission status snapshot data;

[0053] Permission status snapshot data is a record of the node's permission status at a specific point in time during the execution of a permission adjustment transaction. It reflects the specific status of the node's permissions at that point in time. The transaction execution trajectory feature set is a set of features generated based on the permission status snapshot data to describe the transaction execution process and trajectory. It can help analyze the execution status and impact of the transaction.

[0054] Extracting permission status snapshot data from transaction log data involves parsing and filtering the transaction log data. First, based on the operation time in the permission change operation set, the permission status records at the corresponding time points are found in the transaction log data. Then, these records are extracted to form permission status snapshot data. Data mining algorithms, such as sequence pattern mining algorithms, can be used to generate a transaction execution trajectory feature set based on the permission status snapshot data. By analyzing the temporal order and changes in the permission status snapshot data, patterns and rules in the transaction execution process can be mined, generating a transaction execution trajectory feature set. For example, by analyzing the permission status snapshot data of node A, it is found that its permission level gradually increases from low-level to medium-level during transaction execution, and this increase is accompanied by adjustments to certain resource permissions; this information constitutes the transaction execution trajectory feature set.

[0055] Step S430: Perform transaction atomicity verification on the set of permission change operations based on the transaction execution trajectory feature set, and generate a transaction verification result set containing the operation execution order verification result and the permission status consistency verification result;

[0056] Transaction atomicity verification ensures that all operations in a set of permission change operations either execute completely successfully or fail completely, guaranteeing data consistency and integrity. Operation execution order verification checks whether the operations in the permission change operation set are executed in the correct order, while permission state consistency verification checks whether the permission state of nodes after operation execution meets expectations and rules.

[0057] When performing transaction atomicity verification, a state machine model can be used. Information from the transaction execution trajectory feature set is converted into state machine states and transition rules. Then, the set of permission change operations is verified based on the state machine's operation. For operation execution order verification, it checks whether the execution order conforms to the state machine's transition rules; for permission state consistency verification, it checks whether the permission state of the node after the operation is in a valid state defined by the state machine. For example, in a permission adjustment transaction, a permission level elevation operation is performed first, followed by a resource permission reallocation operation. Through state machine verification, if the operation execution order is correct and the permission state of the node after the operation conforms to the permission level and resource permission rules, then both the operation execution order verification result and the permission state consistency verification result are passed, and the generated transaction verification result set indicates that the transaction was successfully executed.

[0058] Step S440: If the operation execution order verification result in the transaction verification result set meets the preset timing constraint rules and the permission status consistency verification result meets the preset permission level mapping rules, then perform incremental update processing on the node permission configuration data set to generate an incremental update dataset containing newly added permission configuration data and modified permission configuration data.

[0059] Sequence constraints are pre-defined rules governing the execution order of permission change operations, specifying which operations must be executed before or after other operations. Permission hierarchy mapping rules are rules governing the mapping relationship between node permission levels and permission operations, ensuring that the node's permission level and permission status are valid after the operation is executed. Incremental update processing updates only the changed portions of the node permission configuration data set, rather than updating the entire set, to improve update efficiency.

[0060] When the operation execution order verification result in the transaction verification result set meets the timing constraint rules and the permission status consistency verification result meets the permission level mapping rules, it indicates that the permission change operation was successfully executed and conforms to the rules. At this time, incremental update processing is performed on the node permission configuration data set. First, identify the permission configuration data in the node permission configuration data set that has been added or modified due to the permission change operation. For example, if the permission level of node A is promoted from low-level permission to medium-level permission, then its corresponding permission configuration data has been modified; if permission configuration information for a certain node is added, then this is the newly added permission configuration data. These newly added and modified permission configuration data are combined into an incremental update dataset.

[0061] Step S450: Divide the incremental update dataset into a set of data shards that match the node distribution topology of multiple edge computing nodes, and transmit each data shard in the set of data shards to the corresponding edge computing node in sequence according to the hierarchical order of the node distribution topology through a two-way authentication channel between the central management node and multiple edge computing nodes.

[0062] The node distribution topology describes the distribution structure and hierarchical relationship of multiple edge computing nodes in a smart grid system. A data shard set is a collection of multiple data shards obtained by dividing the incremental update dataset according to the node distribution topology; each data shard corresponds to one or more edge computing nodes. A two-way authentication channel is a secure channel used to verify the identities of both the central management node and the edge computing nodes during data transmission, ensuring the security and reliability of data transmission.

[0063] When dividing the incremental update dataset into a set of data shards, the division can be based on the structure of the node distribution topology and the load of the edge computing nodes. For example, if the edge computing nodes are distributed hierarchically according to geographical location, the incremental update dataset can be divided according to geographical location, with each data shard corresponding to an edge computing node in a geographical region. Then, through a two-way authentication channel between the central management node and multiple edge computing nodes, using a secure data transmission protocol such as SSL / TLS, each data shard in the data shard set is sequentially transmitted to its corresponding edge computing node according to the hierarchical order of the node distribution topology. For example, the data shard is first transmitted to the higher-level edge computing node, and then the higher-level edge computing node forwards the data shard to the next-level edge computing node, until all data shards have been transmitted to their corresponding edge computing nodes.

[0064] Step S500: Perform real-time monitoring of access behavior in multiple edge computing nodes, generate an access behavior feature set based on the updated node permission configuration data set, and generate access control decision instructions based on the access behavior feature set to trigger permission update operations.

[0065] Real-time access behavior monitoring and processing involves monitoring and analyzing the access behavior of nodes across multiple edge computing nodes in real time. The access behavior feature set is a collection of various features generated based on the updated node permission configuration data set and the real-time monitored access behavior data, reflecting the node's access behavior patterns and characteristics. Access control decision instructions are generated based on the access behavior feature set to control node access permissions. Triggering permission update operations allows for corresponding adjustments to the node's permissions based on these instructions.

[0066] As one implementation method, step S500 involves performing real-time access behavior monitoring processing across multiple edge computing nodes, generating an access behavior feature set based on the updated node permission configuration data set, and generating an access control decision instruction based on the access behavior feature set to trigger a permission update operation. Specifically, this may include the following steps S510–S540:

[0067] Step S510: Deploy an access behavior monitoring agent in each edge computing node. The access behavior monitoring agent is used to capture the real-time access request data stream of the target node corresponding to the edge computing node.

[0068] An access behavior monitoring agent is a program or tool specifically designed to monitor node access behavior. It can be deployed on each edge computing node. The target node is the node whose access behavior needs to be monitored, corresponding to the edge computing node. The real-time access request data stream is the real-time data traffic generated by the target node when performing access operations. It contains information such as the time of the access request, the target resource, and the operation type.

[0069] Deploying access behavior monitoring agents on each edge computing node can be automated using tools like Ansible. Ansible can automatically install and configure the access behavior monitoring agent on each edge computing node based on a pre-defined configuration file. The access behavior monitoring agent can use network packet capture tools, such as Wireshark's Python library `pyshark`, to capture real-time access request data streams from target nodes. For example, after deploying an access behavior monitoring agent on an edge computing node, the agent can capture access request data packets sent by the target node (e.g., node A) in real time, extracting information such as access time, target resource, and operation type to form a real-time access request data stream.

[0070] Step S520: Perform behavioral feature extraction processing on the real-time access request data stream to generate a real-time behavioral feature set of the target node. The real-time behavioral feature set includes at least one of the following: access request frequency features, access resource type distribution features, and cross-node operation association features.

[0071] Behavioral feature extraction (BMI) processes extract information from the real-time access request data stream that reflects the access behavior characteristics of the target node. The real-time behavioral feature set is a collection of various features obtained after extraction. The access request frequency feature reflects how frequently the target node sends access requests within a set time period. The access resource type distribution feature represents the proportion and distribution of the target node accessing different types of resources. The cross-node operation association feature reflects the operational association relationships between the target node and other nodes.

[0072] As one implementation method, step S520 involves performing behavioral feature extraction processing on the real-time access request data stream to generate a set of real-time behavioral features for the target node. Specifically, this may include the following steps S521 to S528:

[0073] Step S521: Divide the real-time access request data stream into time windows to generate multiple access request sub-streams corresponding to the time windows.

[0074] Time window segmentation divides the real-time access request data stream into multiple time windows based on time intervals, with each time window corresponding to a sub-stream of access requests. The size of the time window can be set according to actual needs, such as 1 minute, 5 minutes, etc.

[0075] The sliding window algorithm can be used to divide real-time access request data streams into time windows. First, a fixed-size time window is defined. Then, starting from the start time of the real-time access request data stream, access request data within the time window is sequentially extracted according to time order, forming access request sub-streams. For example, setting the time window to 1 minute, starting from 2025-01-01 10:00:00, access request data within the time windows of 2025-01-01 10:00:00-2025-01-01 10:01:00, 2025-01-01 10:01:00-2025-01-01 10:02:00, etc., are extracted sequentially, forming multiple access request sub-streams.

[0076] Step S522: Perform multidimensional feature statistical processing on each access request sub-stream to generate access request frequency features and access resource type distribution features.

[0077] Multidimensional feature statistical processing involves statistically analyzing information from multiple dimensions within the access request sub-stream. Access request frequency characteristics can be obtained by counting the number of access requests within each time window, reflecting the frequency of access by the target node within that time window. Access resource type distribution characteristics can be obtained by counting the number and proportion of accesses to different types of resources within each time window, reflecting the target node's access preferences for different types of resources.

[0078] Multidimensional feature statistics can be performed on each sub-stream of access requests using data analysis libraries such as Pandas. First, convert the sub-stream of access requests into a Pandas DataFrame object, and then use the statistical functions of the DataFrame for statistical analysis. For example, for a sub-stream of access requests, the `len(df)` function can be used to count the number of access requests, obtaining the access request frequency feature; the `df['resource_type'].value_counts(normalize=True)` function can be used to count the access ratio of different types of resources, obtaining the access resource type distribution feature.

[0079] Step S523: Perform feature difference calculation processing on the access request sub-streams of adjacent time windows to generate cross-node operation association features.

[0080] Feature difference calculation compares the feature differences between access request sub-streams in adjacent time windows to identify changes in the target node's operations across different time windows, thereby generating cross-node operation association features. These cross-node operation association features reflect the operational relationships between the target node and other nodes, such as whether resources on different nodes were accessed within different time windows.

[0081] The cosine similarity algorithm can be used to calculate the feature difference between access request sub-streams in adjacent time windows. First, the access request sub-streams in adjacent time windows are represented as feature vectors, with each feature dimension corresponding to an access feature, such as access resource type or access time. Then, the cosine similarity algorithm is used to calculate the similarity between two feature vectors; the lower the similarity, the greater the feature difference. By analyzing the feature difference, it can be determined whether the target node has performed cross-node operations, thus generating cross-node operation association features. For example, calculating the cosine similarity between the feature vectors of the access request sub-streams in time window A and time window B; if the similarity is low, it indicates that the target node's operations have changed significantly within these two time windows, possibly indicating cross-node operations.

[0082] Step S524: Perform feature vectorization processing on the access request frequency characteristics, access resource type distribution characteristics, and cross-node operation association characteristics to generate a real-time behavior feature set.

[0083] Feature vectorization converts access request frequency features, access resource type distribution features, and cross-node operation correlation features into vector form for subsequent analysis and processing. The real-time behavior feature set is a collection containing all feature vectors obtained after vectorization.

[0084] The NumPy library can be used to vectorize access request frequency features, access resource type distribution features, and cross-node operation correlation features. First, each feature is converted into a numerical form, and then these values ​​are combined into a vector. For example, the access request frequency feature is converted into a numerical value representing access frequency; the access resource type distribution feature is converted into a vector, with each component representing the access ratio of different resource types; and the cross-node operation correlation feature is converted into a numerical value representing the degree of cross-node operation. Finally, these numerical values ​​and vectors are combined into a larger vector, forming a feature vector within the real-time behavior feature set.

[0085] Step S525: Dynamically match the real-time behavior feature set with the permission constraints in the updated node permission configuration data set to generate a permission matching degree index set. This may include the following steps:

[0086] Step S526: Extract the set of permission constraints corresponding to the target node from the updated node permission configuration data set. The set of permission constraints includes multiple constraint parameters.

[0087] The permission constraint set is a summary of the permission restrictions for the target node in the updated node permission configuration data set. The constraint parameters are the specific restrictions, such as the access frequency limit and the list of accessible resource types.

[0088] As one implementation method, step S526, extracting the set of permission constraints corresponding to the target node from the updated node permission configuration data set, may specifically include the following steps S5261 to S5266:

[0089] Step S5261: Perform hierarchical parsing processing on the updated node permission configuration data set to generate a structured data tree containing multiple permission configuration levels, with each permission configuration level corresponding to a node permission type;

[0090] Hierarchical parsing involves parsing and organizing the updated node permission configuration data set according to permission levels, forming a structured data tree. Permission configuration levels represent different permission levels, with each level corresponding to a node permission type, such as high-level permissions, medium-level permissions, and low-level permissions.

[0091] A tree-structured algorithm can be used to perform hierarchical parsing on the updated node permission configuration dataset. First, based on the permission hierarchy information in the node permission configuration dataset, the data is categorized and sorted according to the permission level. Then, a tree structure is used to represent this data, where each node represents a permission configuration item, and the parent-child relationship between nodes represents the permission hierarchy. For example, a high-level permission node is the root node, intermediate-level permission nodes are children of high-level permission nodes, and low-level permission nodes are children of intermediate-level permission nodes, forming a structured data tree containing multiple permission configuration levels.

[0092] Step S5262: Locate the target permission configuration level associated with the target node in the structured data tree based on the identifier of the target node, and obtain the original permission configuration item set of the target node from the target permission configuration level;

[0093] The target permission configuration level is the level in the structured data tree that corresponds to the permission level of the target node. The original permission configuration item set is the collection of all permission configuration items for the target node in the target permission configuration level; it contains the initial permission information of the target node.

[0094] In a structured data tree, locating the target permission configuration level based on the identifier of the target node can be achieved using a depth-first search algorithm. Starting from the root node of the structured data tree, each node is recursively searched until a node matching the identifier of the target node is found; the level of this node is the target permission configuration level. Then, all permission configuration items related to the target node are retrieved from this level, forming the initial set of permission configuration items. For example, if the identifier of the target node is the IP address of node A (192.168.1.100), using a depth-first search algorithm in the structured data tree, the permission configuration level corresponding to this node is found to be the intermediate permission level, and then the initial set of permission configuration items for node A is retrieved from it.

[0095] Step S5263: Perform constraint filtering on the original set of permission configuration items, remove configuration items that do not contain permission constraint attributes from the original set of permission configuration items, and generate a set of candidate permission constraint configuration items;

[0096] Constraint filtering involves filtering the original set of permission configuration items, retaining only those that contain permission constraint attributes. The candidate permission constraint configuration item set is the set of filtered configuration items that contain permission constraint attributes.

[0097] Constraint filtering of the original set of permission configuration items can be performed using Python's list comprehensions. Iterate through the original set of permission configuration items, checking if each item contains a permission constraint attribute, such as access frequency limit or accessible resource type. If it does, keep the item; otherwise, remove it. For example, for each item in the original set of permission configuration items, check if it contains the "access_frequency_limit" attribute; if it does, keep it; otherwise, remove it, ultimately generating a set of candidate permission constraint configuration items.

[0098] Step S5264: Extract the constraint parameter identifier and constraint parameter value range corresponding to each candidate permission constraint configuration item from the candidate permission constraint configuration item set, and generate the initial permission constraint parameter set;

[0099] Constraint parameter identifiers are names used to identify each constraint parameter, such as "access_frequency_limit" (upper limit on access frequency) and "accessible_resource_types" (accessible resource types). The constraint parameter value range is the allowed range of values ​​for that constraint parameter. For example, the access frequency limit can be a specific numerical value, while the accessible resource type range can be a list of resource types. The initial permission constraint parameter set is the extracted set containing all constraint parameter identifiers and their value ranges.

[0100] Extracting constraint parameter identifiers and value ranges from a set of candidate permission constraint configuration items can be done using Python's dictionary operations. Iterate through the set of candidate permission constraint configuration items. For each item, extract its constraint parameter identifier and corresponding value range, storing them in a dictionary. Then, combine all the dictionaries into a list to form the initial permission constraint parameter set. For example, for a candidate permission constraint configuration item with the constraint parameter identifier "access_frequency_limit" and a value range of "100 times / minute", store them in a dictionary {"access_frequency_limit":"100 times / minute"}, and then add this dictionary to the initial permission constraint parameter set.

[0101] Step S5265: Perform parameter correlation verification on the initial permission constraint parameter set, merge duplicate constraint parameters with the same constraint parameter identifier, and remove conflicting constraint parameters that do not match the permission level identifier of the target node to generate a standardized permission constraint parameter set.

[0102] Parameter correlation validation checks and processes the initial set of permission constraint parameters to ensure their consistency and rationality. Merging duplicate constraint parameters with the same constraint parameter identifier combines multiple identical constraint parameters into one, avoiding duplication and redundancy. Removing conflicting constraint parameters that do not match the target node's permission level ensures that the constraint parameters conform to the target node's permission level. The standardized permission constraint parameter set is the result of this processing, containing standardized constraint parameters.

[0103] Performing parameter correlation validation on the initial set of permission constraint parameters can be done using Python's dictionary operations and logical judgments. First, iterate through the initial set of permission constraint parameters. For duplicate constraint parameters with the same constraint parameter identifier, merge or intersect their value ranges. Then, based on the target node's permission level identifier, check if each constraint parameter matches. If not, remove the constraint parameter. For example, if the initial set of permission constraint parameters contains two "access_frequency_limit" constraint parameters, one with a value range of "100 times / minute" and the other with a value range of "120 times / minute", merge them into a single constraint parameter with a value range of "100-120 times / minute". If the target node's permission level is medium, but a certain constraint parameter only applies to high-level permissions, remove that constraint parameter, ultimately generating a standardized set of permission constraint parameters.

[0104] Step S5266: Convert each standardized permission constraint parameter in the standardized permission constraint parameter set into a permission constraint condition expression in a preset format, and aggregate all permission constraint condition expressions into a permission constraint condition set.

[0105] A preset-formatted permission constraint expression is an expression obtained by converting standardized permission constraint parameters according to a preset format. It can be used for subsequent matching and judgment. A permission constraint set is a collection formed by aggregating all permission constraint expressions together.

[0106] Standardized permission constraint parameters can be converted into permission constraint expressions in a preset format using string formatting operations. For example, the standardized permission constraint parameter "access_frequency_limit:100-120 times / minute" can be converted into the permission constraint expression "access_frequency>=100and access_frequency<=120". Then, all permission constraint expressions are stored in a list to form a permission constraint set.

[0107] Step S527: Perform feature normalization processing on each real-time behavior feature in the real-time behavior feature set to generate a standardized behavior feature set.

[0108] Feature normalization is a process that standardizes each real-time behavior feature in the real-time behavior feature set, ensuring that its value falls within a defined range, typically [0,1]. The standardized behavior feature set is the set containing all standardized behavior features obtained after normalization.

[0109] Feature normalization can be performed on each real-time behavior feature in the real-time behavior feature set using the Min-Max normalization algorithm. For each real-time behavior feature, its maximum and minimum values ​​are found, and then normalization is performed using the following formula: normalized_value = (value - min_value) / (max_value - min_value). For example, for the access request frequency feature, whose value range is [0, 200], it is normalized to the interval [0, 1]. For an access request frequency value of 100, the normalized value is `(100-0) / (200-0) = 0.5`. After normalizing all real-time behavior features, a standardized behavior feature set is generated.

[0110] Step S528: Calculate the similarity between each standardized behavioral feature in the standardized behavioral feature set and the corresponding constraint parameter in the permission constraint set to generate a permission matching index set; wherein, the similarity calculation includes at least one of the following algorithms: cosine similarity algorithm, Euclidean distance similarity algorithm, and dynamic time warping similarity algorithm.

[0111] Similarity calculation compares the degree of similarity between standardized behavioral features and permission constraint parameters to assess whether the access behavior of a target node complies with permission constraints. The permission matching index set is a collection of all matching indices obtained after similarity calculation. Each matching index represents the degree of matching between a standardized behavioral feature and its corresponding permission constraint parameter.

[0112] The similarity calculation between each standardized behavioral feature in the standardized behavioral feature set and its corresponding constraint parameter in the permission constraint set can be performed using a chosen similarity algorithm. For example, using the cosine similarity algorithm, the standardized behavioral features and permission constraint parameters are represented as vectors, and then their cosine similarity is calculated. After calculating the similarity between all standardized behavioral features and their corresponding permission constraint parameters, a permission matching index set is generated.

[0113] Step S530: Dynamically match the real-time behavior feature set with the permission constraints in the updated node permission configuration data set to generate a permission matching index set.

[0114] This step is similar in function to step S525, both matching the real-time behavioral feature set with permission constraints to generate a set of permission matching indicators. Through dynamic matching processing, it is possible to evaluate in real time whether the access behavior of the target node meets the permission constraints.

[0115] During dynamic matching, each real-time behavior feature in the real-time behavior feature set is first compared and calculated with the corresponding constraint in the permission constraint set. Similarity calculation algorithms mentioned earlier, such as cosine similarity and Euclidean distance similarity algorithms, can be used. For each real-time behavior feature, its similarity to the corresponding permission constraint is calculated, resulting in a matching index. All matching indices are then aggregated to form a permission matching index set. For example, for the access request frequency feature in the real-time behavior feature set, it is compared with the access frequency upper limit constraint in the permission constraint set, and a similarity is calculated to obtain a matching index; for the access resource type distribution feature, it is compared with the accessible resource type constraint, and another similarity is calculated to obtain a matching index. Finally, all matching indices are combined into a permission matching index set.

[0116] Step S540: If there is an abnormal matching index below the preset threshold in the set of permission matching indexes, an access control decision instruction containing the identifier of the target node is generated, and the permission level re-evaluation operation of the target node is triggered through the access control decision instruction.

[0117] The preset threshold is a pre-defined standard value used to determine whether a matching degree indicator is abnormal. If a matching degree indicator falls below this threshold, the access behavior corresponding to that indicator is considered abnormal. Access control decision instructions are generated based on abnormal matching degree indicators to control the access permissions of target nodes. They include the identifier of the target node to ensure accurate operation on that node. The permission level reassessment operation re-evaluates and adjusts the permission level of the target node to ensure that its permissions match the actual access behavior.

[0118] As one implementation method, step S540, if there is an abnormal matching index below a preset threshold in the permission matching index set, then an access control decision instruction containing the identifier of the target node is generated, and the access control decision instruction triggers a permission level re-evaluation operation for the target node, which may specifically include the following steps S541 to S544:

[0119] Step S541: When an abnormal matching degree index is detected, obtain the abnormal behavior feature identifier corresponding to the abnormal matching degree index.

[0120] An abnormal behavior feature identifier is an identifier used to identify abnormal behavior features that correspond to an abnormality matching index. It can help locate specific abnormal behavior features.

[0121] When an abnormal matching score is detected, the abnormal behavior feature identifier corresponding to the abnormal matching score can be obtained through the index relationship in the permission matching score set. For example, the permission matching score set is a list, where each element corresponds to a matching score score and there is a corresponding list of abnormal behavior feature identifiers. When a matching score score is found to be lower than a preset threshold, the corresponding abnormal behavior feature identifier is obtained from the list of abnormal behavior feature identifiers by using the index of the matching score score in the list.

[0122] Step S542: Locate the abnormal behavior feature data segment in the real-time behavior feature set based on the abnormal behavior feature identifier.

[0123] The abnormal behavior feature data segment is a specific data segment in the real-time behavior feature set that corresponds to the abnormal behavior feature identifier. It contains detailed information about the abnormal behavior.

[0124] Locating anomalous behavior feature data segments within a real-time behavior feature set based on anomalous behavior feature identifiers can be done using dictionary operations. The real-time behavior feature set is stored in a dictionary, with the anomalous behavior feature identifier as the key and the corresponding anomalous behavior feature data segment as the value. Once the anomalous behavior feature identifier is obtained, the corresponding anomalous behavior feature data segment can be retrieved using a key lookup operation in the dictionary. For example, if the real-time behavior feature set is stored in the dictionary `{"access_frequency":[0.5,0.6,0.7],"access_resource_type":[0.2,0.3,0.5]}`, and the anomalous behavior feature identifier is "access_frequency", then the corresponding anomalous behavior feature data segment `[0.5,0.6,0.7]` can be retrieved using `real_time_behavior_features["access_frequency"]`.

[0125] Step S543: Perform behavior pattern recognition processing on the abnormal behavior feature data segment to generate an abnormal behavior pattern type identifier.

[0126] Behavioral pattern recognition processing involves analyzing and identifying abnormal behavioral feature data segments to determine their respective abnormal behavioral pattern types. Abnormal behavioral pattern type identifiers are labels obtained after identification to identify the type of abnormal behavioral pattern, such as "high-frequency access anomaly" or "cross-privilege access anomaly."

[0127] As one implementation method, step S543 involves performing behavior pattern recognition processing on the abnormal behavior feature data segment to generate an abnormal behavior pattern type identifier, which may specifically include the following steps S5431 to S5434:

[0128] Step S5431: Obtain the historical abnormal behavior pattern database, which contains multiple predefined abnormal behavior pattern templates.

[0129] The historical abnormal behavior pattern database is a database that stores information on historical abnormal behavior patterns. It contains multiple predefined abnormal behavior pattern templates. Each abnormal behavior pattern template describes the characteristics and patterns of different types of abnormal behavior. For example, a high-frequency access anomaly template might include features such as access frequency thresholds and access time distributions.

[0130] A database of historical abnormal behavior patterns can be obtained through database query operations. For example, the SQL statement "SELECT * FROM historical_abnormal_behavior_patterns" can be used to retrieve all abnormal behavior pattern templates from the database and store them in a data structure such as a list or dictionary.

[0131] Step S5432: Perform feature dimension expansion processing on the abnormal behavior feature data segment to generate an expanded abnormal behavior feature vector.

[0132] Feature dimension expansion processing involves processing anomalous behavior feature data segments to increase their feature dimensions, thereby improving the accuracy of behavior pattern recognition. The expanded anomalous behavior feature vector is a vector containing more feature dimensions obtained after the expansion processing.

[0133] Feature engineering methods can be used to expand the feature dimensions of abnormal behavior feature data segments. For example, for the access request frequency feature in the abnormal behavior feature data segment, its average, standard deviation, maximum, minimum, and other statistical features can be calculated and added to the abnormal behavior feature data segment to form an expanded abnormal behavior feature vector.

[0134] Step S5433: Perform pattern matching processing on the expanded abnormal behavior feature vector and multiple abnormal behavior pattern templates to generate a pattern matching degree set.

[0135] Pattern matching involves comparing the expanded abnormal behavior feature vector with multiple abnormal behavior pattern templates to find the best-matching abnormal behavior pattern. The pattern matching score set is the set of all matching scores obtained after the matching process; each matching score represents the degree of matching between the expanded abnormal behavior feature vector and an abnormal behavior pattern template.

[0136] Pattern matching between the expanded abnormal behavior feature vector and multiple abnormal behavior pattern templates can be performed using similarity calculation algorithms, such as the cosine similarity algorithm. For each abnormal behavior pattern template, it is represented as a feature vector, and then the cosine similarity between the expanded abnormal behavior feature vector and this feature vector is calculated to obtain a matching degree. All matching degrees are summed to form a pattern matching degree set.

[0137] Step S5434: Select the target abnormal behavior pattern template corresponding to the maximum pattern matching degree from the pattern matching degree set, and determine the pattern identifier of the target abnormal behavior pattern template as the abnormal behavior pattern type identifier.

[0138] The target abnormal behavior pattern template is the abnormal behavior pattern template with the highest matching degree in the pattern matching degree set. It represents the abnormal behavior pattern that best matches the expanded abnormal behavior feature vector. The pattern identifier is a unique identifier for the abnormal behavior pattern template. Determining it as the abnormal behavior pattern type identifier can accurately identify the type of abnormal behavior.

[0139] To filter the target anomalous behavior pattern template corresponding to the maximum pattern match score from the pattern match score set, the `max()` function and indexing operations can be used. First, find the maximum value in the pattern match score set. Then, use the index of this maximum value in the set to retrieve the corresponding target anomalous behavior pattern template from the list of anomalous behavior pattern templates. Finally, determine the pattern identifier of the target anomalous behavior pattern template as the anomalous behavior pattern type identifier.

[0140] Step S544: Generate access control decision instructions based on the abnormal behavior pattern type identifier, and send the access control decision instructions to the central management node to trigger the permission level reassessment operation.

[0141] Access control decision instructions are generated based on abnormal behavior pattern type identifiers to control the access permissions of target nodes. They contain the target node's identifier and the handling measures for that abnormal behavior. Sending access control decision instructions to the central management node can trigger the central management node to reassess and adjust the target node's permission hierarchy.

[0142] As one implementation method, step S544, generating an access control decision instruction based on the abnormal behavior pattern type identifier, and sending the access control decision instruction to the central management node to trigger the permission level re-evaluation operation, may specifically include the following steps S5441 to S5443:

[0143] Step S5441: Search for the corresponding permission adjustment action instruction in the preset permission adjustment policy library according to the abnormal behavior mode type identifier.

[0144] The pre-defined permission adjustment policy library is a repository that stores permission adjustment policies corresponding to different abnormal behavior patterns. It contains multiple permission adjustment action instructions. Permission adjustment action instructions are instructions designed for different abnormal behavior patterns to adjust the permissions of the target node, such as temporary permission freezing, permanent permission revocation, and permission level downgrading.

[0145] The dictionary operation can be used to find the corresponding permission adjustment action instruction in the preset permission adjustment strategy library based on the abnormal behavior pattern type identifier. The preset permission adjustment strategy library is stored in a dictionary, with the abnormal behavior pattern type identifier as the key and the corresponding permission adjustment action instruction as the value. Once the abnormal behavior pattern type identifier is obtained, the corresponding permission adjustment action instruction can be retrieved through a key lookup operation in the dictionary. For example, if the preset permission adjustment strategy library is stored in the dictionary {"high_frequency_access_abnormal":"temporary_permission_freeze","cross_permission_access_abnormal":"permission_level_downgrade"}, and the abnormal behavior pattern type identifier is "high_frequency_access_abnormal", then the corresponding permission adjustment action instruction "temporary_permission_freeze" can be retrieved through permission_adjustment_strategy_library["high_frequency_access_abnormal"].

[0146] Step S5442: If a permission adjustment action instruction is found, encapsulate the permission adjustment action instruction and the identifier of the target node into an access control decision instruction.

[0147] Encapsulating permission adjustment action instructions and the identifier of the target node into an access control decision instruction combines these two pieces of information into a single instruction to accurately convey permission adjustment operations to the target node.

[0148] If a permission adjustment action instruction is found, it can be encapsulated in JSON format along with the target node's identifier into an access control decision instruction. For example, if the permission adjustment action instruction is "temporary_permission_freeze" and the target node's identifier is "192.168.1.100", then the encapsulated access control decision instruction would be {"action":"temporary_permission_freeze","target_node_id":"192.168.1.100"}.

[0149] Step S5443: Transmit the access control decision instruction to the central management node through a secure communication channel, and trigger a permission level reassessment transaction for the target node in the central management node; wherein, the permission level reassessment transaction includes at least one of the following operations: temporary permission freeze operation, permanent permission revocation operation, and permission level downgrade operation.

[0150] A secure communication channel is used to ensure the secure transmission of access control decision instructions. It can use encryption technologies, such as SSL / TLS protocols, to encrypt the transmitted data. Triggering a permission level reassessment transaction for a target node in the central management node can reassess and adjust the permission level of the target node based on the permission adjustment action instructions in the access control decision instructions.

[0151] Transmitting access control decision instructions to the central management node via a secure communication channel can be achieved using Python's `requests` library in conjunction with the SSL / TLS protocol. First, a secure connection is established with the central management node. Then, the access control decision instructions are sent to the central management node in JSON format. Upon receiving the access control decision instructions, the central management node triggers the corresponding permission level reassessment transaction based on the permission adjustment action instruction within it. For example, if the permission adjustment action instruction is "temporary_permission_freeze", a temporary permission freeze operation is triggered in the central management node, temporarily freezing the target node's access permissions; if the permission adjustment action instruction is "permission_level_downgrade", a permission level downgrade operation is triggered, reducing the target node's permission level.

[0152] As one implementation, after generating an access control decision instruction based on the access behavior feature set to trigger a permission update operation in step S500, the method provided in this embodiment of the invention may further include:

[0153] Step S600: Send the access control decision instruction to the edge computing node corresponding to the target node to perform the permission update operation, and capture the permission change record data and node response status data generated during the execution of the permission update operation;

[0154] Sending access control decision commands to the edge computing node corresponding to the target node ensures that permission update operations are executed promptly at the edge. Permission change log data contains detailed information about permission changes recorded during the execution of the permission update operation, such as the time and content of the change. Node response status data shows the target node's response to the permission update operation, such as whether the permission update was successfully executed and whether any errors occurred during the process.

[0155] Sending access control decision commands to the corresponding edge computing nodes can be done using message queues, such as RabbitMQ. The access control decision commands are sent to the message queue, and the edge computing nodes retrieve the commands from the message queue and execute the permission update operation. During the permission update operation, a logging tool is used to record permission change data, and the node response status data of the target node is obtained through network communication. For example, using Python's `pika` library to send access control decision commands to the RabbitMQ message queue, the edge computing nodes use the same library to retrieve the commands from the message queue and execute the permission update operation, use the `logging` module to record permission change data, and obtain the node response status data of the target node through HTTP requests.

[0156] Step S700: Perform operation consistency analysis on the permission change record data and node response status data to generate a permission update execution result set, which includes permission update success identifiers and permission update exception event data;

[0157] Operational consistency analysis involves analyzing permission change logs and node response status data to ensure that the execution results of permission update operations meet expectations and rules. A permission update success identifier indicates whether the permission update operation was successfully executed, while permission update exception event data records any anomalies and related information that occurred during the execution of the permission update operation.

[0158] Consistency analysis of permission change logs and node response status data can be performed using rule-matching algorithms. First, a series of rules are defined, such as whether the permission change content in the permission change logs matches the execution results in the node response status data, and whether the execution time meets requirements. Then, the permission change logs and node response status data are matched against these rules, and a set of permission update execution results is generated based on the matching results. For example, if the permission change logs show that the target node's permission level has been upgraded from low to medium, and the node response status shows that the permission update was successful and the target node's permission level has changed to medium, then the permission update success identifier is set as success. If the node response status shows an error, such as a permission update failure, then the relevant error information is recorded as permission update exception event data.

[0159] Step S800: Extract permission update exception event data from the permission update execution result set, and perform exception root cause tracing processing on the permission update exception event data to generate an exception event association path set and an exception triggering condition set;

[0160] Root cause analysis involves in-depth analysis of permission update anomaly event data to identify the root cause of the anomaly. The anomaly event association path set records the process of the anomaly event and related information, while the anomaly triggering condition set contains the conditions and factors that led to the anomaly event.

[0161] Extracting permission update exception event data from the permission update execution result set can be done through filtering. Traverse the permission update execution result set to find records containing permission update exception event data. Performing root cause tracing on the permission update exception event data can be done using causal analysis methods, such as Fault Tree Analysis (FTA). Construct a fault tree, using the exception event as the top event, and analyze step-by-step the possible causes and intermediate events leading to the event until the root cause is found. For example, for a permission update failure exception event, FTA analysis might reveal that it was caused by network connection interruption, database operation errors, etc. Record these causes and related information, generating a set of exception event association paths and a set of exception triggering conditions.

[0162] Step S900: Based on the set of abnormal triggering conditions, perform instruction correction processing on the access control decision instruction, generate the corrected access control decision instruction, and resend the corrected access control decision instruction to the corresponding edge computing node;

[0163] Instruction correction processing adjusts and corrects access control decision instructions based on the set of abnormal triggering conditions to prevent recurrence of abnormal situations. The corrected access control decision instruction is the new access control decision instruction obtained after correction processing, which is resent to the corresponding edge computing node for permission update operation. By analyzing the abnormal triggering conditions, potential problems or deficiencies in the original access control decision instructions can be identified, and targeted corrections can then be made.

[0164] When revising access control decision instructions based on a set of exception triggering conditions, corresponding revision strategies need to be adopted according to different exception triggering conditions. For example, if the exception triggering condition indicates that the permission update operation failed due to the target node's current high load, a delayed execution parameter can be added to the revised access control decision instruction, setting an appropriate delay time to wait for the target node's load to decrease before executing the permission update operation. In specific implementation, a "delay_time" field can be added to the JSON format of the original access control decision instruction, with the value being the set delay time (e.g., 300 seconds), forming the revised access control decision instruction {"action":"temporary_permission_freeze","target_node_id":"192.168.1.100","delay_time":300}.

[0165] If the exception is triggered because the resource involved in the permission update operation is currently occupied by another task, causing an operation conflict, then the corrected access control decision directive can include resource release waiting logic. Add a "wait_for_resource_release" field with a value of "true" to the directive, indicating that the permission update operation should wait until the resource is released before proceeding. Simultaneously, a maximum waiting time can be set to avoid indefinite waiting; add a "max_wait_time" field to the directive, such as {"action":"permission_level_downgrade","target_node_id":"192.168.1.101","wait_for_resource_release":"true","max_wait_time":600}.

[0166] The process of resending the revised access control decision command to the corresponding edge computing node is similar to sending the command previously, and can also use message queues such as RabbitMQ. The revised command is sent to the message queue using Python's `pika` library. The edge computing node retrieves the command from the message queue and executes the permission update operation according to the new command requirements. Before sending, the revised command can be validated to ensure that its format and content meet the requirements, avoiding the occurrence of exceptions again.

[0167] Step S1000: Associate and store the set of abnormal event associated paths with the set of permission update execution results, generate permission update log data with abnormal markers, and synchronize the permission update log data with abnormal markers to the central management node of the smart grid system;

[0168] Linking and storing the set of associated paths for abnormal events with the set of execution results for permission updates integrates the occurrence process of abnormal events and the final result of permission update operations, facilitating subsequent querying, analysis, and auditing. Permission update log data marked with anomalies contains detailed information about abnormal events and the results of permission update operations, providing crucial data support for the security management of smart grid systems.

[0169] Related storage can utilize database technologies such as MySQL. First, create corresponding database tables to store the set of abnormal event-related paths and the set of permission update execution results. For the abnormal event-related path set, a table named "abnormal_event_related_paths" can be created, containing fields such as abnormal event ID, related path information, and abnormal trigger time. For the permission update execution result set, a table named "permission_update_results" can be created, containing fields such as permission update operation ID, permission update success identifier, and permission update abnormal event data. The relationship between the two tables is established using the abnormal event ID and the permission update operation ID.

[0170] After inserting the set of associated paths for abnormal events and the set of execution results for permission updates into the corresponding tables, a SQL query is used to join the two tables, generating permission update log data marked with anomalies. The query results are stored in a new table named "marked_permission_update_logs," which represents the permission update log data marked with anomalies. This marked permission update log data can be synchronized to the central management node of the smart grid system using a data synchronization tool such as DataX. DataX is an open-source data synchronization framework that enables data synchronization between different data sources. A DataX task is configured, using the database table storing the marked permission update log data as the source and the database table of the central management node as the target. DataX's synchronization task then synchronizes the data to the central management node. The synchronization frequency can be set, such as once every hour, to ensure that the central management node can promptly obtain the latest marked permission update log data.

[0171] Step S1100: Perform policy optimization analysis on the permission update log data marked with anomalies in the central management node, generate a set of decision policy optimization parameters for access control decision instructions, and feed the set of decision policy optimization parameters back to the permission dynamic evaluation model to trigger the model parameter update operation.

[0172] Policy optimization analysis involves in-depth analysis of permission update log data marked with anomalies to uncover patterns and issues, thereby optimizing the decision-making strategy for access control instructions. The decision-making strategy optimization parameter set is the set of parameters obtained after analysis and processing, used to optimize the decision-making strategy. Feeding this parameter set back to the permission dynamic evaluation model allows the model to adjust and update based on the new parameters, improving the model's accuracy and adaptability.

[0173] In the central management node, data mining and machine learning algorithms can be used to optimize and analyze permission update log data marked with anomalies. For example, association rule mining algorithms, such as the Apriori algorithm, can be used to analyze the correlation between anomalous events and permission update operations, access behavior characteristics, etc., in the permission update log data marked with anomalies. By setting appropriate support and confidence thresholds, frequently occurring association rules can be identified. For example, it may be found that when the frequency of access requests to the target node exceeds the threshold and the permission update operation involves changes to advanced permissions, anomalous events are more likely to occur. Based on this association rule, the decision-making strategy for access control instructions can be adjusted.

[0174] Clustering algorithms, such as K-Means, can also be used to cluster and analyze permission update log data with anomaly markers, grouping similar abnormal events and permission update operations into one category. By analyzing the characteristics and patterns of different clusters, potential problematic decision-making strategies and operational patterns can be identified. For example, if abnormal events in a certain cluster are mainly caused by excessively frequent permission update operations, a parameter limiting the permission update frequency can be added to the decision-making strategy. After generating a set of optimized parameters for the access control decision instructions, these parameters are fed back to the dynamic permission evaluation model to trigger model parameter updates. The dynamic permission evaluation model can be a deep learning-based neural network model, such as a multilayer perceptron (MLP). During model training, the optimized decision-making strategy parameter set is used as new input features to adjust the model's weights and bias parameters.

[0175] It is understood that the various algorithms involved in the above descriptions of the embodiments of the present invention, such as the Euclidean distance algorithm, the cosine similarity algorithm, the Apriori algorithm, etc., can all be obtained from relevant content in the prior art. To save space, they will not be elaborated on in the embodiments of the present invention. In addition, those skilled in the art can supplement the details based on common knowledge in the art when implementing the solution of the present invention. For example, they can use normalization to eliminate dimensional conflicts before feature fusion, use interpolation to eliminate dimensional differences, reasonably set the threshold based on historical data, experience or business scenario requirements, train the model based on a general model training method, etc. The present invention will not provide redundant descriptions of overly detailed implementation processes here.

[0176] Please see Figure 2 , Figure 2This is a schematic diagram of a computer system provided in an embodiment of the present invention. The computer system includes at least a processor 101, a communication interface 102, and a memory 103. The processor 101, communication interface 102, and memory 103 can be connected via a bus or other means. The processor 101 (or Central Processing Unit, CPU) is the computing and control core of the computer system, capable of parsing various instructions and processing various data within the computer system. The communication interface 102 may optionally include standard wired interfaces or wireless interfaces (such as Wi-Fi, mobile communication interfaces, etc.), and can be used to send and receive data under the control of the processor 101; the communication interface 102 can also be used for data transmission and interaction within the computer system. The memory 103 is a storage device in the computer system used to store programs and data. It is understood that the memory 103 here can include the computer system's built-in memory, or it can include extended memory supported by the computer system. The memory 103 provides storage space, which stores the computer system's operating system, including but not limited to: Android system, iOS system, Windows Phone system, etc., which are not limited in this invention.

[0177] In one embodiment, the processor 101 executes the smart grid access control method based on dynamic node permission management provided in the above embodiments of the present invention by running a computer program in the memory 103.

Claims

1. A smart grid access control method based on dynamic node permission management, characterized in that, include: Obtain a set of node permission configuration data for a smart grid system. The set of node permission configuration data includes multiple node permission configuration sequences, and each node permission configuration sequence consists of at least one node identifier and a corresponding permission level identifier. The node permission configuration data set is subjected to permission feature analysis processing to generate a permission feature set associated with each node permission configuration sequence. The permission feature set includes dynamic adjustment features of node permissions and static constraint features of node permissions. The dynamic adjustment features include at least one of the following: access frequency fluctuation features of node permissions and cross-level operation features of node permissions. The static constraint features include at least one of the following: hierarchical binding features of node permissions and resource configuration constraint features of node permissions. Dynamic weight allocation is performed on the dynamic adjustment features and static constraint features in the permission feature set to generate dynamic permission adjustment instructions for the node permission configuration sequence; According to the dynamic permission adjustment instruction, the node permission configuration sequence is dynamically adjusted to generate an updated node permission configuration data set, and the updated node permission configuration data set is synchronized to multiple edge computing nodes of the smart grid system. Real-time access behavior monitoring is performed across the multiple edge computing nodes. An access behavior feature set is generated based on the updated node permission configuration data set, and an access control decision instruction is generated based on the access behavior feature set to trigger a permission update operation. Specifically, this includes: deploying an access behavior monitoring agent in each edge computing node to capture real-time access request data streams of the target node corresponding to the edge computing node; performing behavior feature extraction processing on the real-time access request data streams to generate a real-time behavior feature set for the target node, the real-time behavior feature set including at least one of the following: access request frequency features, access resource type distribution features, and cross-node operation association features; dynamically matching the real-time behavior feature set with the permission constraints in the updated node permission configuration data set to generate a permission matching degree index set; if there is an abnormal matching degree index below a preset threshold in the permission matching degree index set, an access control decision instruction containing the identifier of the target node is generated, and the access control decision instruction triggers a permission level re-evaluation operation for the target node.

2. The method as described in claim 1, characterized in that, The step of performing permission feature analysis on the node permission configuration data set to generate a permission feature set associated with each node permission configuration sequence includes: Obtain a set of historical access records for the smart grid system, the set of historical access records including a sequence of historical access timestamps and a sequence of historical access operation types corresponding to the permission configuration sequence of each node; Extract a set of node permission status data that is time-related to the set of historical access records from the set of node permission configuration data. The set of node permission status data includes multiple node permission status parameters. Perform joint feature mapping processing on the historical access record data set and the node permission status data set to generate the dynamic adjustment feature and the static constraint feature.

3. The method as described in claim 2, characterized in that, The step of dynamically weighting the dynamic adjustment features and static constraint features in the permission feature set to generate dynamic permission adjustment instructions for the node permission configuration sequence includes: Obtain a pre-configured dynamic weight allocation strategy, which includes multiple weight allocation modes, each corresponding to a node permission adjustment scenario; The dynamic adjustment features and the static constraint features are subjected to feature dimension matching processing to generate feature matching results associated with the dynamic weight allocation strategy; Based on the feature matching results, a target weight allocation mode is determined among the multiple weight allocation modes, and a weighted fusion process is performed on the dynamic adjustment feature and the static constraint feature based on the target weight allocation mode to generate the dynamic permission adjustment instruction; The dynamic permission adjustment instructions include at least one of the following: instructions to elevate node permission levels, instructions to demote node permission levels, and instructions to reallocate node permission resources.

4. The method as described in claim 3, characterized in that, The step of performing dynamic permission adjustment processing on the node permission configuration sequence according to the dynamic permission adjustment instruction to generate an updated node permission configuration data set includes: In the central management node of the smart grid system, a permission adjustment transaction associated with the dynamic permission adjustment instruction is created, and the set of permission change operations and transaction log data generated during the execution of the permission adjustment transaction are captured. Extract permission status snapshot data that is operationally related to the permission change operation set from the transaction log data, and generate a transaction execution trajectory feature set based on the permission status snapshot data; Based on the transaction execution trajectory feature set, perform transaction atomicity verification processing on the permission change operation set to generate a transaction verification result set containing operation execution order verification results and permission status consistency verification results; If the operation execution order verification result in the transaction verification result set meets the preset timing constraint rules and the permission status consistency verification result meets the preset permission level mapping rules, then incremental update processing is performed on the node permission configuration data set to generate an incremental update dataset containing newly added permission configuration data and modified permission configuration data. The incremental update dataset is divided into a set of data shards that match the node distribution topology of the multiple edge computing nodes. Each data shard in the set is then transmitted sequentially to the corresponding edge computing node according to the hierarchical order of the node distribution topology through a two-way authentication channel between the central management node and the multiple edge computing nodes.

5. The method as described in claim 1, characterized in that, The step of performing behavioral feature extraction processing on the real-time access request data stream to generate a set of real-time behavioral features for the target node includes: The real-time access request data stream is divided into time windows to generate multiple access request sub-streams corresponding to the time windows; Perform multidimensional feature statistical processing on each access request substream to generate the access request frequency feature and the access resource type distribution feature; Perform feature difference calculation processing on the access request sub-streams of adjacent time windows to generate the cross-node operation association features; The access request frequency characteristics, access resource type distribution characteristics, and cross-node operation association characteristics are processed into feature vectors to generate the real-time behavior feature set. The step of dynamically matching the real-time behavior feature set with the permission constraints in the updated node permission configuration data set to generate a permission matching degree index set includes: Extract the set of permission constraints corresponding to the target node from the updated node permission configuration data set, wherein the set of permission constraints includes multiple constraint parameters; Perform feature normalization processing on each real-time behavior feature in the real-time behavior feature set to generate a standardized behavior feature set; The similarity between each standardized behavioral feature in the standardized behavioral feature set and the corresponding constraint parameter in the permission constraint set is calculated to generate the permission matching index set; wherein, the similarity calculation includes at least one of the following algorithms: cosine similarity algorithm, Euclidean distance similarity algorithm, and dynamic time warping similarity algorithm.

6. The method as described in claim 1, characterized in that, If there is an abnormal matching index below a preset threshold in the set of permission matching indicators, an access control decision instruction containing the identifier of the target node is generated, and the access control decision instruction triggers a permission level reassessment operation for the target node, including: When the abnormal matching degree index is detected, the abnormal behavior feature identifier corresponding to the abnormal matching degree index is obtained; Based on the abnormal behavior feature identifier, locate the abnormal behavior feature data segment in the real-time behavior feature set; Perform behavior pattern recognition processing on the abnormal behavior feature data segment to generate an abnormal behavior pattern type identifier; The access control decision instruction is generated based on the abnormal behavior pattern type identifier, and the access control decision instruction is sent to the central management node to trigger the permission level re-evaluation operation.

7. The method as described in claim 6, characterized in that, The step of performing behavior pattern recognition processing on the abnormal behavior feature data segment to generate an abnormal behavior pattern type identifier includes: Obtain a historical abnormal behavior pattern database, which contains multiple predefined abnormal behavior pattern templates; The abnormal behavior feature data segment is subjected to feature dimension expansion processing to generate an expanded abnormal behavior feature vector; The expanded abnormal behavior feature vector is matched with the multiple abnormal behavior pattern templates to generate a pattern matching degree set. The target abnormal behavior pattern template corresponding to the maximum pattern matching degree is selected from the pattern matching degree set, and the pattern identifier of the target abnormal behavior pattern template is determined as the abnormal behavior pattern type identifier.

8. The method as described in claim 6, characterized in that, The step of generating the access control decision instruction based on the abnormal behavior pattern type identifier and sending the access control decision instruction to the central management node to trigger the permission level reassessment operation includes: Based on the abnormal behavior pattern type identifier, search for the corresponding permission adjustment action instruction in the preset permission adjustment policy library; If the permission adjustment action instruction is found, the permission adjustment action instruction and the identifier of the target node are encapsulated into the access control decision instruction; The access control decision instruction is transmitted to the central management node through a secure communication channel, and a permission level reassessment transaction for the target node is triggered in the central management node. The permission level reassessment transaction includes at least one of the following operations: temporary permission freeze operation, permanent permission revocation operation, and permission level downgrade operation.

9. A computer system, characterized in that, include: A memory, wherein a computer program is stored; A processor is configured to load the computer program to implement the smart grid access control method based on dynamic node permission management as described in any one of claims 1-8.

Images