Method and system for device security verification based on multi-level power distribution communication network

Abstract

The application relates to the technical field of device security verification, and discloses a device security verification method and system based on a multi-level power distribution communication network, which comprises the following steps: calculating a device fingerprint matching degree according to the device hardware features and communication data of an access device; calculating a communication behavior stability coefficient according to the communication data; calculating a device trust score according to the device fingerprint matching degree and the communication behavior stability coefficient to obtain a device authentication state; generating a trust verification request according to the device authentication state; calculating a verification priority according to the trust verification request; allocating a verification node to the trust verification request to enable verification nodes at all levels to perform trust verification on the trust verification request; and updating a multi-level trust list stored at present according to the verification result. Through the multi-level collaborative trust verification architecture, the application realizes real-time synchronization and dynamic updating of the multi-level trust state, and guarantees the safety and stability of the operation of the power distribution communication network.

Description

Technical Field

[0001] This invention relates to the field of equipment security verification technology, and in particular to a method and system for equipment security verification based on a multi-level power distribution communication network. Background Technology

[0002] With the digital development of power systems, distribution communication networks have become a core infrastructure supporting the coordinated operation of provincial, municipal, and county-level power grids and the large-scale integration of new energy sources. They not only bear the tasks of monitoring the status of traditional power equipment and transmitting control commands, but also need to be compatible with the high-frequency access and dynamic interaction of distributed energy devices such as photovoltaic inverters and energy storage devices, resulting in an exponential increase in equipment scale. However, the issues of identity management and reliable verification for heterogeneous equipment from multiple manufacturers have become a key bottleneck restricting the safe and stable operation of distribution networks.

[0003] Currently, identity authentication in power distribution communication networks is mainly divided into two types: centralized identity authentication and hierarchical management authentication. Centralized identity authentication refers to the unified trusted verification completed by a high-level master station when all devices are connected. However, this method has the problems of high single-point failure risk and serious lack of scalability in scenarios with massive device access. Although hierarchical management authentication has delegated some authentication permissions, the trusted status between different levels of authentication centers needs to be synchronized periodically. This results in lower-level authentication centers not being able to obtain the trusted endorsement of higher-level centers in real time, and there is a problem of lagging trust transfer across levels. Furthermore, in the face of the high-frequency access and exit characteristics of new energy power grid equipment, hierarchical management authentication adopts a static authentication strategy with fixed authentication cycles and fixed permission allocation, which cannot match the rapid changes in device status, and is prone to authentication delays and misjudgments, and has insufficient dynamic update capabilities. Summary of the Invention

[0004] To address the aforementioned technical problems, this invention provides a device security verification method and system based on a multi-level power distribution communication network. This method and system can solve the problems of single-point risk and insufficient scalability in existing access device security verification, as well as the failure of multi-level synchronization and dynamic adaptation. It achieves real-time synchronization and dynamic updating of multi-level trusted states, thereby improving the efficiency of trusted verification.

[0005] In a first aspect, the present invention provides a device security verification method based on a multi-level power distribution communication network, the method comprising:

[0006] Based on the hardware characteristics and communication data of each access device connected to the power distribution communication network, device characteristics are generated, the device characteristics are compared with a preset template, and the device fingerprint matching degree is calculated based on the comparison results.

[0007] Based on the communication data, a communication behavior stability coefficient is calculated. Based on the device fingerprint matching degree and the communication behavior stability coefficient, a device trust score is calculated. Based on the device trust score, the device authentication status is obtained.

[0008] Based on the device authentication status, a trusted verification request for the access device is generated. Based on the trusted verification request, the verification priority is calculated. Based on the verification priority, the trusted verification request is assigned a verification node to obtain the node task allocation result.

[0009] Based on the node task allocation results, each trusted verification request is sent to the corresponding verification nodes at each level, so that the verification nodes at each level can perform trusted verification on the received trusted verification requests and update the currently stored multi-level trusted list according to the verification results, thereby obtaining an updated multi-level trusted list.

[0010] Furthermore, the step of generating device characteristics based on the device hardware characteristics and communication data of each access device connected to the power distribution communication network includes:

[0011] The device hardware characteristics and communication data of each access device connected to the power distribution communication network are obtained. The device hardware characteristics include device serial number, hardware version number and firmware identifier. The access devices include power equipment and communication equipment.

[0012] The device hardware features are encoded using a hash algorithm to generate a device hardware feature vector. Communication behavior parameters are extracted from the communication data, and the device hardware feature vector and the communication behavior parameters are used as device features. The communication behavior parameters include frequency distribution, protocol type, and average latency.

[0013] Further, the step of comparing the device features with a preset template and calculating the device fingerprint matching degree based on the comparison result includes:

[0014] Calculate the first similarity between the device hardware feature vector and the standard vector in the preset template, and calculate the deviation between the communication behavior parameters and the standard parameters in the preset template;

[0015] Based on the first similarity and the deviation value, a threshold determination method is used to obtain the device matching result, which includes successful device matching and failed device matching.

[0016] In response to a successful device match, the device fingerprint matching degree is calculated using a weighted summation method based on the first similarity and the deviation value.

[0017] Further, the steps of calculating a communication behavior stability coefficient based on the communication data, calculating a device trust score based on the device fingerprint matching degree and the communication behavior stability coefficient, and obtaining the device authentication status based on the device trust score include:

[0018] Based on the communication data, calculate the frequency variance and the delay standard deviation, and then perform a weighted sum of the reciprocal of the frequency variance and the reciprocal of the delay standard deviation to obtain the communication behavior stability coefficient.

[0019] The communication behavior stability coefficient is normalized, and the normalized communication behavior stability coefficient and the device fingerprint matching degree are weighted and summed to obtain the device trust score.

[0020] The device's trust score is compared with a preset scoring threshold. Based on the comparison result, the device authentication status is obtained, which includes normal authentication status and abnormal authentication status.

[0021] Further, the steps of generating a trusted verification request for the access device based on the device authentication status, calculating a verification priority based on the trusted verification request, and allocating verification nodes to the trusted verification request based on the verification priority to obtain a node task allocation result include:

[0022] Select the access devices with normal authentication status from the various access devices connected to the power distribution communication network, and generate corresponding trusted verification requests. The trusted verification requests include device type, verification type and access timestamp.

[0023] Based on the verification type and the access timestamp, calculate the urgency coefficient, and based on the urgency coefficient and the device type, calculate the verification priority;

[0024] Based on the verification priority and the node load rate of each level of verification node, the trusted verification request is assigned to a verification node to obtain the node task allocation result.

[0025] Further, the step of calculating an urgency coefficient based on the authentication type and the access timestamp, and calculating the authentication priority based on the urgency coefficient and the device type, includes:

[0026] Based on the verification type, an initial urgency coefficient is determined, and based on the access timestamp, the initial urgency coefficient is updated to obtain the urgency coefficient.

[0027] Based on the device type, determine the device weight, and multiply the device weight by the urgency coefficient as the verification priority.

[0028] Furthermore, the step of updating the currently stored multi-level trusted list based on the verification results to obtain an updated multi-level trusted list includes:

[0029] Based on the verification results, the device identifier, region, verification status, trust counter, and latest timestamp in the multi-level trusted list are updated.

[0030] The authentication level in the multi-level trust list is updated based on the device trust score.

[0031] The multi-level trusted list is constructed based on the device access location and device operating status, and includes device identifier, authentication level, region, operating status, verification status, trusted counter and latest timestamp.

[0032] Furthermore, following the step of obtaining the updated multi-level trusted list, the method further includes:

[0033] Based on the real-time communication parameters and corresponding baseline communication parameters of each trusted device in the multi-level trusted list, device anomaly identification is performed to obtain identification results, which include normal devices and abnormal devices.

[0034] In response to the identification result being an abnormal device, an abnormal response mechanism is triggered to perform multi-level verification and collaborative processing on the abnormal device.

[0035] Further, the step of identifying device anomalies and obtaining identification results based on the real-time communication parameters and corresponding baseline communication parameters of each trusted device in the multi-level trusted list includes:

[0036] Obtain the real-time communication parameters of each trusted device in the multi-level trusted list, including communication frequency, data packet size, and usage protocol;

[0037] Based on the deviation between the real-time communication parameters and the corresponding baseline communication parameters, the trusted device is preliminarily identified as having an abnormality, thus obtaining a preliminary abnormal device.

[0038] Based on the real-time communication parameters of the preliminary abnormal device, a real-time feature vector is generated, and a second similarity between the real-time feature vector and a preset benchmark feature vector is calculated.

[0039] The second similarity is compared with a preset threshold, and abnormal devices are selected from the preliminary abnormal devices based on the comparison results.

[0040] Secondly, the present invention provides a device security verification system based on a multi-level power distribution communication network, the system comprising:

[0041] The matching calculation module is used to generate device features based on the device hardware characteristics and communication data of each access device connected to the power distribution communication network, compare the device features with a preset template, and calculate the device fingerprint matching degree based on the comparison results.

[0042] The device authentication module is used to calculate the communication behavior stability coefficient based on the communication data, calculate the device trust score based on the device fingerprint matching degree and the communication behavior stability coefficient, and obtain the device authentication status based on the device trust score.

[0043] The task allocation module is used to generate a trusted verification request for the access device based on the device authentication status, calculate the verification priority based on the trusted verification request, and allocate verification nodes to the trusted verification request based on the verification priority to obtain the node task allocation result.

[0044] The list update module is used to distribute each trusted verification request to the corresponding verification nodes at each level according to the node task allocation result, so that the verification nodes at each level can perform trusted verification on the received trusted verification request and update the currently stored multi-level trusted list according to the verification result to obtain the updated multi-level trusted list.

[0045] This invention provides a device security verification method and system based on a multi-level power distribution communication network. Through a multi-level collaborative trusted verification architecture, this invention can achieve real-time synchronization and dynamic updating of multi-level trusted status. Through a distributed identity authentication mechanism in provincial, municipal, and county-level scenarios, it can ensure that the control services at all levels can still operate efficiently and securely in scenarios where devices are accessed and withdrawn at high frequencies, thus providing a trusted foundation for the digital transformation of high-proportion renewable energy power distribution networks. Attached Figure Description

[0046] Figure 1 This is a flowchart illustrating the equipment security verification method based on a multi-level power distribution communication network according to an embodiment of the present invention.

[0047] Figure 2 This is a schematic diagram of the structure of a device security verification system based on a multi-level power distribution communication network according to an embodiment of the present invention.

[0048] Figure label:

[0049] 10. Matching Calculation Module; 20. Device Authentication Module; 30. Task Allocation Module; 40. List Update Module. Detailed Implementation

[0050] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0051] Please see Figure 1 The first embodiment of the present invention proposes a device security verification method based on a multi-level power distribution communication network, comprising steps S10 to S40:

[0052] Step S10: Based on the hardware characteristics and communication data of each access device connected to the power distribution communication network, generate device characteristics, compare the device characteristics with a preset template, and calculate the device fingerprint matching degree based on the comparison results.

[0053] Step S20: Calculate the communication behavior stability coefficient based on the communication data, calculate the device trust score based on the device fingerprint matching degree and the communication behavior stability coefficient, and obtain the device authentication status based on the device trust score.

[0054] Step S30: Based on the device authentication status, generate a trusted verification request for the access device; based on the trusted verification request, calculate the verification priority; and based on the verification priority, allocate verification nodes to the trusted verification request to obtain the node task allocation result.

[0055] Step S40: Based on the node task allocation result, each trusted verification request is sent to the corresponding verification nodes at each level, so that the verification nodes at each level can perform trusted verification on the received trusted verification request and update the currently stored multi-level trusted list according to the verification result to obtain the updated multi-level trusted list.

[0056] In this invention, the power distribution communication network refers to the communication system between power distribution terminals and the main power distribution station within a provincial region. Its physical architecture consists of both communication equipment and power equipment. Communication equipment refers to network transmission carriers, including switches, communication gateways, and wireless base stations, responsible for building communication links, such as provincial, municipal, and county-level fiber optic private networks, ensuring data transmission within the network. Power equipment refers to the network interaction entities, including power generation equipment (such as photovoltaic inverters), power transformation equipment (such as distribution transformers), and power consumption equipment (such as smart meters), serving as the terminal nodes of the communication network. These devices access the communication network through built-in communication modules, uploading operational data and receiving control commands. For example, a photovoltaic inverter (power equipment) accesses the county-level power distribution communication network via a 4G module, uploading real-time power generation data (voltage, current) to the county-level control center. The county-level center then issues a "power-limited operation" command to the inverter via the communication network. Upon receiving this command, the inverter adjusts its output. In this interaction, the inverter is both a power device and a terminal node of the power distribution communication network.

[0057] When power equipment or communication equipment is connected to the distribution communication network, reliable verification is required to ensure the security of the power system. Considering the high-frequency access and exit characteristics of new energy power grids, this embodiment provides a method for determining the authentication status of equipment based on equipment reliability scores. The equipment reliability score is determined by the device fingerprint matching degree between the access device and the security benchmark device. To calculate the device fingerprint matching degree, it is first necessary to construct device characteristics based on the hardware characteristics and communication data of the access device. Specific steps include:

[0058] The device hardware characteristics and communication data of each access device connected to the power distribution communication network are obtained. The device hardware characteristics include device serial number, hardware version number and firmware identifier. The access devices include power equipment and communication equipment.

[0059] The device hardware features are encoded using a hash algorithm to generate a device hardware feature vector. Communication behavior parameters are extracted from the communication data, and the device hardware feature vector and the communication behavior parameters are used as device features. The communication behavior parameters include frequency distribution, protocol type, and average latency.

[0060] In this embodiment, a hash algorithm is used to encode device hardware features such as device serial number, hardware version number, and firmware identifier, generating a device hardware feature vector. Simultaneously, communication behavior parameters such as the data packet transmission frequency distribution, protocol type, and average communication latency per unit time are extracted to construct a comprehensive feature matrix containing the device hardware feature vector and communication behavior parameters, thus obtaining the device features. Specifically, when processing the device serial number, the hash algorithm converts strings like "SN2024ABC123456" into a fixed-length numeric sequence. Hardware version numbers such as "V2.3.1" and firmware identifiers such as "FW_20240615" are also hashed, and the three together form a 128-bit feature vector. This encoding method ensures that even slight differences in the original information will result in significantly different generated feature vectors, thereby improving the accuracy of device identification.

[0061] Extracting communication behavior parameters involves multi-dimensional data collection. Among these, the data packet frequency distribution reflects the device's communication activity at different times of day; for example, photovoltaic inverters send data at a significantly higher frequency during the day than at night, forming a specific frequency curve. Protocol type identifiers record the communication protocols used by the device, such as Modbus and IEC61850; different types of devices often employ specific protocol combinations. The average communication delay reflects the stability of the device's response speed.

[0062] After obtaining the device characteristics, they are compared with preset templates in the database to obtain the device fingerprint matching degree. The specific steps include:

[0063] Calculate the first similarity between the device hardware feature vector and the standard vector in the preset template, and calculate the deviation between the communication behavior parameters and the standard parameters in the preset template;

[0064] Based on the first similarity and the deviation value, a threshold determination method is used to obtain the device matching result, which includes successful device matching and failed device matching.

[0065] In response to a successful device match, the device fingerprint matching degree is calculated using a weighted summation method based on the first similarity and the deviation value.

[0066] In this embodiment, the database stores the standard feature matrix of all certified devices as a reference benchmark for "normal devices." The standard feature matrix includes standard vectors of hardware features and standard parameters of communication behavior. The standard parameters are the average of historical communication behavior parameters. When comparing device features with a preset template, the similarity between the device's hardware feature vector and the standard vector is calculated. Preferably, Euclidean distance is used as the similarity of hardware features, reflecting the spatial differences between vectors; the smaller the Euclidean distance, the higher the similarity. For communication behavior parameters, the deviation value from the standard parameters is used to reflect parameter differences. For frequency distribution and mean latency, the deviation value is the absolute difference between the actual parameter and the standard parameter divided by the standard parameter. For example, if the device frequency is 60 times / minute and the standard frequency is 50 times / minute, the deviation value is 20%. For distributional parameters such as protocol type, the cosine similarity between the protocol percentage and the benchmark percentage is calculated, and the deviation value is calculated based on the cosine similarity. If the similarity is greater than the similarity threshold and all deviation values ​​are within their corresponding deviation threshold ranges, the access device is considered to have successfully matched the baseline template. At this point, the device fingerprint matching degree can be calculated by weighted summation of the similarity and deviation values. In the formula for calculating the device fingerprint matching degree, the deviation value is the average of the three deviation values. The average deviation value quantifies the degree of deviation between the device's current communication behavior and the normal baseline. The average deviation value and the hardware feature deviation together constitute the core basis of the device fingerprint matching degree. The numerical expression of the device fingerprint matching degree lays the foundation for subsequent reliable scoring calculations.

[0067] Furthermore, the reliability of the access device's operation can be characterized by the stability of its communication behavior. Since operational reliability is directly related to the device's trustworthiness, in this embodiment, in addition to calculating the device fingerprint matching degree, a communication behavior stability coefficient is calculated through the analysis of communication data. Based on the device fingerprint matching degree and the communication behavior stability coefficient, a device trustworthiness score is calculated to determine the device's authentication status. The specific steps include:

[0068] Based on the communication data, calculate the frequency variance and the delay standard deviation, and then perform a weighted sum of the reciprocal of the frequency variance and the reciprocal of the delay standard deviation to obtain the communication behavior stability coefficient.

[0069] The communication behavior stability coefficient is normalized, and the normalized communication behavior stability coefficient and the device fingerprint matching degree are weighted and summed to obtain the device trust score.

[0070] The device's trust score is compared with a preset scoring threshold. Based on the comparison result, the device authentication status is obtained, which includes normal authentication status and abnormal authentication status.

[0071] In this embodiment, the transmission frequency and communication delay are extracted from the communication data of the access device. Then, the frequency variance and delay standard deviation are calculated, and the reciprocal of the frequency variance and the reciprocal of the delay standard deviation are weighted and summed to obtain the communication behavior stability coefficient. Preferably, the weight of the frequency variance is set to 0.4 and the weight of the delay standard deviation is set to 0.6. The frequency variance represents the degree of fluctuation of the data packet frequency. The smaller the variance, the more regular the communication. The delay standard deviation represents the degree of fluctuation of the communication delay. The smaller the standard deviation, the more stable the network connection. Therefore, the communication behavior stability coefficient can reflect the long-term reliability of the device's communication behavior.

[0072] Then, the communication behavior stability coefficient is normalized and weighted and summed with the device fingerprint matching degree to obtain the device trust score. Preferably, the weight of the device fingerprint matching degree is 70%, and the weight of the communication behavior stability coefficient is 30%. Finally, it is determined whether the calculated device trust score exceeds the scoring threshold. If it exceeds the threshold, the authentication status of the access device is considered to be normal; otherwise, it is considered to be abnormal. This embodiment, through a two-dimensional evaluation of static hardware fingerprints and dynamic communication behavior profiles, can effectively prevent the spoofing of access by abnormal devices, providing a data foundation for subsequent task allocation, anomaly detection, and trust management. It is also a key factor affecting the efficiency of secure access control and dynamic management of devices across the entire network.

[0073] In this embodiment, the device authentication status can be understood as a preliminary trusted authentication of the access device. Only devices that pass the preliminary trusted authentication are allowed to enter the subsequent trusted verification stage. In the trusted verification stage, for access devices with a normal authentication status, a trusted verification request is generated. Based on the trusted verification request, the verification priority is calculated and distributed to verification nodes at each level according to the verification priority for node task allocation. The specific steps include:

[0074] Select the access devices with normal authentication status from the various access devices connected to the power distribution communication network, and generate corresponding trusted verification requests. The trusted verification requests include device type, verification type and access timestamp.

[0075] Based on the verification type and the access timestamp, calculate the urgency coefficient, and based on the urgency coefficient and the device type, calculate the verification priority;

[0076] Based on the verification priority and the node load rate of each level of verification node, the trusted verification request is assigned to a verification node to obtain the node task allocation result.

[0077] In this embodiment, for access devices in a normal authentication state, a corresponding trusted verification request is generated based on their device type, verification type, and access timestamp. The device type can be categorized into critical devices and general devices based on their functional importance in the power distribution communication network. For example, devices with important functions, such as main converters and core switches, are critical devices, while sensors and auxiliary controllers are general devices. Verification types include initial access verification, periodic review verification, and abnormal event-triggered verification. For instance, initial access verification is triggered when a device connects to the network for the first time; periodic review verification is triggered at a fixed interval, such as once a week; and abnormal event-triggered verification is triggered when communication is abnormal or permissions change. The access timestamp is the time the device accesses the power distribution communication network.

[0078] This embodiment employs a multi-level verification approach, setting up three levels of verification nodes: provincial, municipal, and county. By distributing different trusted verification requests to each level of verification node for distributed trusted verification, the efficiency of trusted verification can be effectively improved. When allocating requests, the verification priority is first calculated based on the trusted verification request, and then requests are allocated according to the verification priority and the node load rate of each level of verification node. The steps for calculating the verification priority include:

[0079] Based on the verification type, an initial urgency coefficient is determined, and based on the access timestamp, the initial urgency coefficient is updated to obtain the urgency coefficient.

[0080] Based on the device type, determine the device weight, and multiply the device weight by the urgency coefficient as the verification priority.

[0081] In this embodiment, initial urgency coefficients are pre-set for different verification types. For example, the initial urgency coefficient for initial access verification is 5, the initial urgency coefficient for periodic review verification is 3, and the initial urgency coefficient for verification triggered by abnormal events is 7. Therefore, the initial urgency coefficient of a trusted verification request can be determined based on the verification type in the trusted verification request. Furthermore, the time of device access also implies the importance of the device. For example, a large photovoltaic inverter urgently accessed at 2 AM is necessarily far more important than a monitoring sensor accessed normally during the day. Therefore, this embodiment updates the initial urgency coefficient based on the access timestamp. When the access timestamp is within the planned time period, the initial urgency coefficient remains unchanged; when the access timestamp is outside the planned time period, the initial urgency coefficient is increased according to a preset ratio to obtain the urgency coefficient of the accessed device. Simultaneously, the device weight corresponding to the device type of the accessed device is extracted from a preset weight table. Finally, the device weight is multiplied by the urgency coefficient to obtain the verification priority of the trusted verification request for the accessed device.

[0082] All verification requests are sorted from highest to lowest priority to form a queue of verification requests to be assigned. Verification requests in the queue are read sequentially, and then, based on the real-time load rate and verification priority of each node, they are distributed to nodes with matching processing capacity. The core rule is: high-priority requests are prioritized for allocation to nodes with strong processing capacity, while low-priority requests are routed to lower-loaded subordinate nodes. Here, verification nodes refer to the scheduling centers at each level. Specifically, the total number of requests currently being processed by the provincial verification node (i.e., the provincial scheduling center) is first queried in real time. This total number of requests is divided by the node's maximum concurrent processing capacity to obtain the real-time load rate of the provincial node. Then, it is determined whether the provincial node's load rate has reached its load limit. To ensure the efficiency of critical task processing, the provincial node's load rate does not exceed 80%, with the remaining 20% ​​of processing capacity used as a buffer for high-priority tasks. If the provincial node's load rate does not exceed the limit, the verification priority of each verification request is read sequentially, and it is determined whether the verification priority has reached a routing threshold. Requests exceeding this threshold are prioritized for allocation to the provincial verification node until the provincial verification node's node load rate reaches its limit. For high-priority verification requests that are not allocated due to exceeding the load limit of provincial verification nodes, and for medium- and low-priority verification requests below the diversion threshold, they are allocated to city-level verification nodes based on the principles of geographical location matching and maximizing the difference in processing capacity. Geographical location matching prioritizes allocation to city-level verification nodes where the device is located; for example, if the device is located in city A, it is prioritized for allocation to city-level nodes in city A to reduce network latency. Maximizing the difference in processing capacity means that if multiple city-level nodes are available, the node with the largest difference between its current load rate and maximum processing capacity is selected, i.e., the node with the most remaining processing capacity. If the load rate of a city-level verification node also reaches its limit, such as 80%, the remaining requests are allocated to county-level verification nodes according to the same principle as city-level allocation. Furthermore, there are corresponding emergency handling measures for some special scenarios. For example, when the load rate of all third-level verification nodes reaches its limit, a delay queue is triggered to temporarily store low-priority requests, waiting for the nodes to release processing capacity before reallocation. For high-priority requests from critical devices, even if the load rate of provincial verification nodes has exceeded the limit, they are still forcibly allocated to provincial verification nodes to ensure the timeliness of trusted verification of critical devices. After the request task is distributed, the node task allocation result is output, which includes the name of each level of node, the number of tasks allocated, and a list of task numbers.

[0083] This embodiment designs a standardized process for task allocation of verification requests, including priority quantification, dynamic routing, and result output. It achieves load balancing among provincial, municipal, and county-level nodes, ensuring the timeliness of high-priority verification of critical equipment while preventing low-priority tasks from occupying core node resources, thus realizing the efficient operation of the distributed verification mechanism.

[0084] According to the node task allocation results, the device authentication status and corresponding trusted verification requests of each access device are sent to the corresponding verification nodes. Each verification node verifies the identity of the received trusted verification requests. The device authentication status sent here also includes the device trusted score. In a preferred embodiment, identity verification includes certificate verification, signature verification, and timestamp verification. Certificate verification refers to verifying the issuing authority, validity period, and certificate chain integrity of the device's digital certificate; signature verification refers to decrypting the device data signature using a public key and comparing it with the original data hash value to confirm that it has not been tampered with; timestamp verification refers to checking the deviation of the device clock from the standard time, for example, a deviation of less than or equal to 5 minutes is normal. Finally, the verification result is output, which includes three verification statuses (including pass and fail), verification time, and execution node identifier.

[0085] After completing the authentication of the access device and obtaining the authentication result, each authentication node updates its currently stored multi-level trusted list based on the authentication result and the device trust score in the previously received device authentication status, thus obtaining an updated multi-level trusted list. The specific steps include:

[0086] Based on the verification results, the device identifier, region, verification status, trust counter, and latest timestamp in the multi-level trusted list are updated.

[0087] The authentication level in the multi-level trust list is updated based on the device trust score.

[0088] The multi-level trusted list is constructed based on the device access location and device operating status, and includes device identifier, authentication level, region, operating status, verification status, trusted counter and latest timestamp.

[0089] In this embodiment, a multi-level trusted list is pre-established based on the geographical location and operating status of each device in the power distribution communication network. Specifically, the provincial, prefectural, and county-level administrative region codes of the devices are extracted, and an operating status classification table structure containing six fields is created and initialized, including device identifier, authentication level, province, prefecture, county, and current operating status. The device identifier is used to uniquely identify the device and can be represented by a serial number or hardware feature vector. The operating status includes normal, offline, and isolated. The authentication level is determined based on the device trusted score calculated when the device's authentication status was previously determined. Based on the device trusted score... The authentication levels are divided into high-trust and medium-trust levels. Simultaneously, trust counters at each level are initialized, including provincial, municipal, and county-level trust counters. These counters are used to count the online high-trust devices corresponding to each level. Real-time monitoring of the distribution of trust devices in each region facilitates optimized resource scheduling. Each device added to the list requires trusted verification; therefore, the list also records the device's most recent verification status and the last update time of the device entry. During initial list construction, all fields except device identifier, region, operating status, and minimum timestamp can be initialized to zero. In other words, each verification node's storage server stores a globally synchronized multi-level trusted list. The fields for device entries in this multi-level trusted list include device identifier, authentication level, region, operating status, verification status, trusted counter, and latest timestamp.

[0090] Each verification node updates its stored multi-level trusted list based on its latest verification results. For newly connected devices, a device entry is added to the multi-level trusted list. Based on the multi-level trusted list construction process, each field of the newly added device entry is updated according to the verification results and device trust score. For devices already in the list, the verification results and device trust score determine whether the current content of each field needs to be updated. After updating its stored multi-level trusted list, each verification node sends the updated content to the next higher-level verification node using an incremental transmission method. The higher-level verification node integrates the received incremental information from the lower-level verification node with its own incremental information and then sends the integrated incremental information to the provincial verification node. The provincial verification node integrates the received incremental information from each municipal verification node with its own incremental information, updates the multi-level trusted list, and broadcasts the latest additions or modifications in the trusted list globally using an incremental transmission method, thereby achieving global information synchronization of the multi-level trusted list.

[0091] In a preferred embodiment, to improve the security of the power distribution communication network, after obtaining the latest multi-level trusted list, the present invention performs anomaly identification on the trusted devices in the list, and determines whether to trigger an anomaly response mechanism based on the anomaly identification results. Specific steps include:

[0092] Based on the real-time communication parameters and corresponding baseline communication parameters of each trusted device in the multi-level trusted list, device anomaly identification is performed to obtain identification results, which include normal devices and abnormal devices.

[0093] In response to the identification result being an abnormal device, an abnormal response mechanism is triggered to perform multi-level verification and collaborative processing on the abnormal device.

[0094] In this embodiment, the communication parameters of trusted devices in the list are analyzed to determine whether the device is abnormal. Anomaly identification can be understood as a device identity verification process. Its purpose is to identify abnormal communication or spoofing attacks through communication behavior analysis, thereby further ensuring the safe operation of the power distribution network. Specifically, for trusted devices at different levels, anomaly identification adopts a unified framework combined with hierarchical parameters. All devices at all levels follow the same core identification process, but specific parameters (such as thresholds and indicator weights) are progressively tightened according to the importance of the device. By setting hierarchical parameters, the security requirements of devices at different levels are met.

[0095] For trusted devices in the list, their real-time communication parameters are collected, and the results of comparing the real-time communication parameters with preset baseline communication parameters are used to determine whether there are any device anomalies. The specific steps include:

[0096] Obtain the real-time communication parameters of each trusted device in the multi-level trusted list, including communication frequency, data packet size, and usage protocol;

[0097] Based on the deviation between the real-time communication parameters and the corresponding baseline communication parameters, the trusted device is preliminarily identified as having an abnormality, thus obtaining a preliminary abnormal device.

[0098] Based on the real-time communication parameters of the preliminary abnormal device, a real-time feature vector is generated, and a second similarity between the real-time feature vector and a preset benchmark feature vector is calculated.

[0099] The second similarity is compared with a preset threshold, and abnormal devices are selected from the preliminary abnormal devices based on the comparison results.

[0100] In this embodiment, the real-time communication parameters of the trusted device include communication frequency, data packet size, and usage protocol. The differences between each real-time communication parameter and a pre-set baseline communication parameter are then compared. The baseline communication parameter can be the average of the trusted device's communication parameters under normal conditions over a historical period, such as the past 30 days. For devices at different levels, a level adaptation coefficient can be set for their average communication parameters. The product of the average and the coefficient is used as the baseline parameter. Then, it is determined whether the real-time communication parameters exceed the historical baseline parameter. If any parameter exceeds the threshold, the device is considered abnormal and is set as a preliminary abnormal device. This embodiment uses a deviation threshold for initial anomaly screening. However, this initial screening cannot distinguish between data fluctuations in normal scenarios and malicious attacks. The communication parameters of power equipment / communication equipment may fluctuate due to normal operating scenarios, such as environmental changes or changes in task requirements, causing parameters to exceed the threshold. However, this is essentially a reasonable adjustment, not an anomaly. If only the threshold is used for judgment, these scenarios would be misjudged as "abnormal," leading to unnecessary control measures, such as restricting permissions or isolating devices, affecting system operating efficiency. Therefore, secondary verification is required for the initially screened abnormal devices.

[0101] In this embodiment, the secondary verification employs a similarity verification method. For initially identified anomalous devices, a cosine similarity algorithm is used to compare real-time feature vectors with historical feature vectors to determine whether they are genuine anomalies or spoofing attacks. Specifically, real-time communication parameters are constructed as real-time feature vectors, and then the cosine similarity between the real-time feature vectors and a baseline feature vector constructed based on historical baseline parameters is calculated. If the similarity is less than a preset threshold, the anomaly is considered likely to be a spoofing attack; if it is greater than the preset threshold, the anomaly is considered normal fluctuation. This embodiment, through a two-stage judgment process of deviation threshold and similarity verification, can effectively filter normal scene fluctuations, identify hidden attacks, and achieve accurate and efficient anomaly identification. When an abnormal device is detected during identity verification, an anomaly response mechanism is immediately triggered. Based on the correlation of the abnormal device, verification nodes at all relevant levels conduct synchronous verification to jointly confirm the nature of the anomaly. Based on the verification results, the abnormal device is handled collaboratively according to its correlation. For example, if a spoofing attack affects County C in City A and County D in City B, the provincial node organizes city-level nodes in City A and City B, and county-level nodes in County C and County D, to conduct joint verification. Ultimately, the attack source is determined to be a substation in County C, where County C is responsible for physical intervention, while City A and City B simultaneously isolate the affected devices. This hierarchical mechanism in this embodiment ensures both identification efficiency and accurate handling of complex anomalies, further guaranteeing the security and stability of the power distribution communication network.

[0102] This embodiment provides a device security verification method based on a multi-level power distribution communication network. The present invention realizes real-time synchronization and dynamic updating of multi-level trusted status through a multi-level collaborative trusted verification architecture. Through the distributed identity authentication mechanism of provincial, municipal and county-level scenarios, it ensures that the control business at all levels can still operate efficiently and securely in the scenario of high-frequency access and exit of equipment, providing a trusted foundation for the digital transformation of high-proportion new energy power distribution networks.

[0103] Please see Figure 2 Based on the same inventive concept, the second embodiment of this invention proposes a device security verification system based on a multi-level power distribution communication network, comprising:

[0104] The matching calculation module 10 is used to generate device features based on the device hardware features and communication data of each access device connected to the power distribution communication network, compare the device features with a preset template, and calculate the device fingerprint matching degree based on the comparison result.

[0105] The device authentication module 20 is used to calculate the communication behavior stability coefficient based on the communication data, calculate the device trust score based on the device fingerprint matching degree and the communication behavior stability coefficient, and obtain the device authentication status based on the device trust score.

[0106] The task allocation module 30 is used to generate a trusted verification request for the access device based on the device authentication status, calculate the verification priority based on the trusted verification request, and allocate verification nodes to the trusted verification request based on the verification priority to obtain the node task allocation result.

[0107] The list update module 40 is used to send each trusted verification request to the corresponding verification nodes at each level according to the node task allocation result, so that the verification nodes at each level can perform trusted verification on the received trusted verification request and update the currently stored multi-level trusted list according to the verification result to obtain the updated multi-level trusted list.

[0108] The technical features and effects of the equipment security verification system based on a multi-level power distribution communication network proposed in this invention are the same as those of the method proposed in this invention, and will not be repeated here. Each module in the above-mentioned equipment security verification system based on a multi-level power distribution communication network can be implemented entirely or partially through software, hardware, or a combination thereof. Each module can be embedded in or independent of the processor in a computer device in hardware form, or it can be stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0109] In summary, the embodiments of this invention propose a device security verification method and system based on a multi-level power distribution communication network. The method generates device features based on the hardware characteristics and communication data of each access device connected to the power distribution communication network. These features are then compared with a preset template, and a device fingerprint matching degree is calculated based on the comparison results. A communication behavior stability coefficient is calculated based on the communication data. A device trust score is calculated based on the device fingerprint matching degree and the communication behavior stability coefficient, and a device authentication status is obtained based on the device trust score. A trusted verification request for the access device is generated based on the device authentication status. A verification priority is calculated based on the trusted verification request, and verification nodes are allocated to the trusted verification request based on the verification priority, resulting in a node task allocation result. Based on the node task allocation result, each trusted verification request is sent to the corresponding verification nodes at each level, enabling each verification node to perform trusted verification on the received trusted verification request and update the currently stored multi-level trusted list based on the verification results, resulting in an updated multi-level trusted list. This invention achieves real-time synchronization and dynamic updating of multi-level trusted states through a multi-level collaborative trusted verification architecture based on a distributed identity authentication mechanism. This ensures that control services at all levels can still operate efficiently and securely even in scenarios where equipment access is interrupted at high frequencies, guaranteeing the security and stability of the power distribution communication network and providing a trusted foundation for the digital transformation of high-proportion renewable energy power distribution networks.

[0110] The various embodiments in this specification are described in a progressive manner. For directly identical or similar parts of the embodiments, refer to each other. Each embodiment focuses on its differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. It should be noted that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0111] The embodiments described above are merely preferred embodiments of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various improvements and substitutions without departing from the technical principles of this invention, and these improvements and substitutions should also be considered within the scope of protection of this application. Therefore, the scope of protection of this patent application should be determined by the scope of the claims.

Claims

1. A method for equipment security verification based on a multi-level power distribution communication network, characterized in that, include: Based on the hardware characteristics and communication data of each access device connected to the power distribution communication network, device characteristics are generated, the device characteristics are compared with a preset template, and the device fingerprint matching degree is calculated based on the comparison results. Based on the communication data, a communication behavior stability coefficient is calculated. Based on the device fingerprint matching degree and the communication behavior stability coefficient, a device trust score is calculated. Based on the device trust score, the device authentication status is obtained. Based on the device authentication status, a trusted verification request for the access device is generated. Based on the trusted verification request, the verification priority is calculated. Based on the verification priority, the trusted verification request is assigned a verification node to obtain the node task allocation result. Based on the node task allocation result, each trusted verification request is sent to the corresponding verification nodes at each level, so that the verification nodes at each level can perform trusted verification on the received trusted verification request and update the currently stored multi-level trusted list according to the verification result to obtain the updated multi-level trusted list. Based on the real-time communication parameters and corresponding baseline communication parameters of each trusted device in the multi-level trusted list, device anomaly identification is performed to obtain identification results, which include normal devices and abnormal devices. In response to the identification result being an abnormal device, an abnormal response mechanism is triggered to perform multi-level verification and collaborative processing on the abnormal device; The step of identifying device anomalies and obtaining identification results based on the real-time communication parameters and corresponding baseline communication parameters of each trusted device in the multi-level trusted list includes: Obtain the real-time communication parameters of each trusted device in the multi-level trusted list, including communication frequency, data packet size, and usage protocol; Based on the deviation between the real-time communication parameters and the corresponding baseline communication parameters, the trusted device is preliminarily identified as having an abnormality, thus obtaining a preliminary abnormal device. Based on the real-time communication parameters of the preliminary abnormal device, a real-time feature vector is generated, and a second similarity between the real-time feature vector and a preset benchmark feature vector is calculated. The second similarity is compared with a preset threshold, and abnormal devices are selected from the preliminary abnormal devices based on the comparison results.

2. The equipment security verification method based on a multi-level power distribution communication network according to claim 1, characterized in that, The step of generating device characteristics based on the device hardware characteristics and communication data of each access device connected to the power distribution communication network includes: The device hardware characteristics and communication data of each access device connected to the power distribution communication network are obtained. The device hardware characteristics include device serial number, hardware version number and firmware identifier. The access devices include power equipment and communication equipment. The device hardware features are encoded using a hash algorithm to generate a device hardware feature vector. Communication behavior parameters are extracted from the communication data, and the device hardware feature vector and the communication behavior parameters are used as device features. The communication behavior parameters include frequency distribution, protocol type, and average latency.

3. The equipment security verification method based on a multi-level power distribution communication network according to claim 2, characterized in that, The step of comparing the device features with a preset template and calculating the device fingerprint matching degree based on the comparison result includes: Calculate the first similarity between the device hardware feature vector and the standard vector in the preset template, and calculate the deviation between the communication behavior parameters and the standard parameters in the preset template; Based on the first similarity and the deviation value, a threshold determination method is used to obtain the device matching result, which includes successful device matching and failed device matching. In response to a successful device match, the device fingerprint matching degree is calculated using a weighted summation method based on the first similarity and the deviation value.

4. The equipment security verification method based on a multi-level power distribution communication network according to claim 1, characterized in that, The steps of calculating a communication behavior stability coefficient based on the communication data, calculating a device trust score based on the device fingerprint matching degree and the communication behavior stability coefficient, and obtaining the device authentication status based on the device trust score include: Based on the communication data, calculate the frequency variance and the delay standard deviation, and then perform a weighted sum of the reciprocal of the frequency variance and the reciprocal of the delay standard deviation to obtain the communication behavior stability coefficient. The communication behavior stability coefficient is normalized, and the normalized communication behavior stability coefficient and the device fingerprint matching degree are weighted and summed to obtain the device trust score. The device's trust score is compared with a preset scoring threshold. Based on the comparison result, the device authentication status is obtained, which includes normal authentication status and abnormal authentication status.

5. The equipment security verification method based on a multi-level power distribution communication network according to claim 1, characterized in that, The steps of generating a trusted verification request for the access device based on the device authentication status, calculating the verification priority based on the trusted verification request, and allocating verification nodes to the trusted verification request based on the verification priority to obtain the node task allocation result include: Select the access devices with normal authentication status from the various access devices connected to the power distribution communication network, and generate corresponding trusted verification requests. The trusted verification requests include device type, verification type and access timestamp. Based on the verification type and the access timestamp, calculate the urgency coefficient, and based on the urgency coefficient and the device type, calculate the verification priority; Based on the verification priority and the node load rate of each level of verification node, the trusted verification request is assigned to a verification node to obtain the node task allocation result.

6. The equipment security verification method based on a multi-level power distribution communication network according to claim 5, characterized in that, The steps of calculating an urgency coefficient based on the authentication type and the access timestamp, and calculating the authentication priority based on the urgency coefficient and the device type, include: Based on the verification type, an initial urgency coefficient is determined, and based on the access timestamp, the initial urgency coefficient is updated to obtain the urgency coefficient. Based on the device type, determine the device weight, and multiply the device weight by the urgency coefficient as the verification priority.

7. The equipment security verification method based on a multi-level power distribution communication network according to claim 1, characterized in that, The step of updating the currently stored multi-level trusted list based on the verification results to obtain the updated multi-level trusted list includes: Based on the verification results, the device identifier, region, verification status, trust counter, and latest timestamp in the multi-level trusted list are updated. The authentication level in the multi-level trust list is updated based on the device trust score. The multi-level trusted list is constructed based on the device access location and device operating status, and includes device identifier, authentication level, region, operating status, verification status, trusted counter and latest timestamp.

8. A device security verification system based on a multi-level power distribution communication network, characterized in that, The system is applied to the method as described in any one of claims 1 to 7, comprising: The matching calculation module is used to generate device features based on the device hardware characteristics and communication data of each access device connected to the power distribution communication network, compare the device features with a preset template, and calculate the device fingerprint matching degree based on the comparison results. The device authentication module is used to calculate the communication behavior stability coefficient based on the communication data, calculate the device trust score based on the device fingerprint matching degree and the communication behavior stability coefficient, and obtain the device authentication status based on the device trust score. The task allocation module is used to generate a trusted verification request for the access device based on the device authentication status, calculate the verification priority based on the trusted verification request, and allocate verification nodes to the trusted verification request based on the verification priority to obtain the node task allocation result. The list update module is used to distribute each trusted verification request to the corresponding verification nodes at each level according to the node task allocation result, so that the verification nodes at each level can perform trusted verification on the received trusted verification request and update the currently stored multi-level trusted list according to the verification result to obtain the updated multi-level trusted list.

Images