Unified identity authentication and access control method for power multi-service system based on national secret algorithm

Abstract

The invention discloses a unified identity authentication and access control method for a power multi-service system based on a national secret algorithm. According to the invention, through systematic deployment of SM2, SM3 and SM4 cryptographic algorithms, a full-link security protection system from identity authentication to authority management is constructed. The unified identity authentication platform adopts a mode of combining a distributed micro-service architecture and a hardware encryption machine, so that the physical security of key storage and operation is guaranteed, and the stability and response speed of the system are improved through a master-slave synchronization mechanism and interface delay control. A multi-source identity information federation acquisition mechanism realizes real-time integration of static attributes and dynamic behavior data, abnormal characteristics of user operation can be accurately captured by combining a risk assessment matrix of an improved LSTM-attention mechanism, and an SM2 bidirectional dynamic authentication protocol is automatically triggered when a risk score exceeds a dynamic threshold. Closed-loop protection of collection-evaluation-authentication-auditing is formed, and security threats such as identity counterfeiting and authority crossing are effectively resisted.

Description

Technical Field

[0001] This invention belongs to the field of power business system technology, specifically a unified identity authentication and access control method for power multi-business systems based on national cryptographic algorithms. Background Technology

[0002] Power business system security certification is a technical means and management mechanism used to ensure the secure operation of information systems in the power industry. It is widely applied in key business areas such as power grid dispatching, generation control, transmission and distribution management, and power marketing. Power business system security certification typically includes core components such as identity authentication, access control, data encryption, and security auditing. By employing national cryptographic algorithms, digital certificates, and multi-factor authentication, it ensures the authenticity of system users' identities, the traceability of operational behaviors, and the protection against tampering or leakage of data transmission. Furthermore, power business systems must comply with relevant policies and regulations, and undergo security assessments and certifications by national power regulatory agencies or third-party certification bodies to ensure compliance with national graded protection requirements and industry security standards. Security certification not only enhances the overall protection capabilities of power business systems but also provides solid technical support for achieving intelligent, digital, and secure controllable power systems.

[0003] However, existing technologies in power multi-service system identity authentication and access control have problems such as fragmented security protection, insufficient architectural stability, and static risk assessment. For example, the use of non-national cryptographic algorithms leads to insufficient compliance, centralized architecture is prone to single point of failure, fixed threshold risk judgment mechanism is difficult to adapt to complex operation scenarios, single dimension of permission control, and lack of dynamic adjustment capability throughout the key management lifecycle, making it impossible to form a closed-loop protection system from identity authentication to permission auditing. Summary of the Invention

[0004] The purpose of this invention is to provide a unified identity authentication and access control method for a power multi-service system based on national cryptographic algorithms in order to solve the problems mentioned above.

[0005] The technical solution adopted in this invention is as follows: A unified identity authentication and access control method for a power multi-service system based on national cryptographic algorithms, the method comprising the following steps:

[0006] S1: The design encompasses a distributed architecture that includes interfaces with multiple business systems, including the authentication server, key management center, and authentication server. The key management center will provide algorithmic support for subsequent steps.

[0007] S2: The SM2 algorithm is selected for identity signature, the SM3 algorithm is used for data digest, and the SM4 algorithm is used for transmission encryption. The key management center generates the root key according to the S1 architecture and stores it through a hardware encryption machine to provide an encryption basis for the identity information collection of S3.

[0008] S3: The user database that connects to the power dispatching, marketing and distribution business systems uses the SM4 algorithm to encrypt and transmit identity metadata, which is then integrated to form a unified user profile. This profile will serve as the core basis for S5 permission assessment.

[0009] S4: The user signs the random challenge value using their private key. The server verifies the signature using the public key deployed in S2. At the same time, the server generates an authentication token with a timestamp, hashes it using SM3, and returns it to the user to complete the two-way authentication. The authentication result is synchronized in real time to the permission evaluation module in S5.

[0010] S5: Integrates user profiles from S3 with real-time operational behavior, and uses deep learning algorithms to construct a risk assessment matrix. When abnormal operations are detected, it automatically triggers the secondary authentication process of S4 and pushes the assessment results to the access control module of S7.

[0011] S6: After authentication, both parties use SM2 key exchange to generate a session master key and then derive the SM4 session key through the KDF function. The key validity period is linked to the risk level of S5. In high-risk scenarios, the key lifespan is automatically shortened.

[0012] S7: Based on the dynamic permission evaluation results of S5, the ABAC model is used to bind user attributes with resource access rules. After the access request is hashed by SM3, it is compared with the policy library. The decision result is returned to the business system through the encrypted session channel of S6.

[0013] S8: All access behaviors generate tamper-proof audit logs via SM3, which, combined with the risk assessment model of S5, establish an abnormal behavior baseline. When a suspicious operation is detected, the key update process of S9 is automatically triggered.

[0014] S9: Integrate the S2 key to generate the S6 session key and the S8 audit data to establish a key health assessment model. When the audit system detects a security threat or the key is about to expire, it automatically starts the SM2 key pair rotation and synchronously updates the encryption configuration of each business system.

[0015] In a preferred embodiment, in step S1, the unified identity authentication platform architecture must adopt a distributed microservice deployment mode, the authentication server cluster is configured with at least 3 physical nodes, each node is equipped with an 8-core CPU and 32GB of memory, and a master-slave synchronization mechanism is used to achieve data consistency; the key management center is deployed with an independent hardware encryption machine, which supports SM2 / SM3 / SM4 algorithm acceleration operation, and the key storage capacity of a single device is not less than 1 million records; the multi-business system interface adopts RESTful API design.

[0016] In a preferred embodiment, in step S2, the SM2 algorithm uses a 256-bit key length, adopts the elliptic curve parameter specification GB / T32918.2-2016, and uses the SHA-256 hash function in the signature process; the SM3 algorithm is implemented according to the GB / T32905-2016 standard and outputs a 256-bit message digest; the SM4 algorithm uses a 128-bit key and CBC working mode, and the IV vector is randomly generated and transmitted with the ciphertext.

[0017] In a preferred embodiment, in step S3, establishing a multi-source identity information federated collection mechanism requires connecting to at least 12 power business system databases and adopting a data update strategy that combines timed synchronization and real-time triggering; static attribute data is fully synchronized at 3:00 AM every day, and the real-time push delay of dynamic operation data does not exceed 5 seconds; identity metadata data transmission is encrypted using the SM4 algorithm, and the size of the transmitted data packet is limited to within 1MB; a role-based access control model is used to filter the collection fields, and each user profile contains three major categories of 42 attributes: basic information, permission information, and behavior records.

[0018] In a preferred embodiment, in step S4, the server-side public key library is synchronously updated from the key management center every hour. The challenge value is generated using the CTR_DRBG algorithm of the NISTSP800-90A standard to generate a 128-bit random number. The signature verification timeout is set to 3 seconds. The authentication token generated by the server contains three elements: user ID, timestamp, and random number. After being hashed by SM3, a 256-bit digest value is generated.

[0019] In a preferred embodiment, in step S5, a risk assessment matrix is ​​constructed using a dual-channel deep learning model that integrates temporal attention and attribute attention. First, static attributes and real-time operation behavior sequences from the user profile are obtained from S3. The static attributes are transformed into attribute vectors of dimension d through an embedding layer, and the operation behavior sequences are transformed into temporal vectors of dimension d through word embedding and positional encoding. Next, parallel attribute attention and temporal attention branches are constructed: the attribute attention branch calculates the contribution weight of each static attribute to risk assessment through a self-attention mechanism, and the temporal attention branch uses an LSTM network to capture the temporal dependencies of the operation sequences and uses a gated recurrent unit. The system dynamically adjusts the weight allocation of long-term dependencies; after concatenating the output features of the two branches, it inputs them into the fully connected layer to obtain the risk probability vector of the user's current operation. Then, it combines the historical audit data of the S8 module to construct a dynamic risk assessment matrix. The row vector of the matrix represents the user attribute feature dimension, the column vector represents the real-time operation feature dimension, and the matrix element value is the risk contribution of the corresponding dimension. The risk probability vector is transformed into a risk score R between 0 and 1 through the softmax function. When R exceeds the preset threshold θ, the system automatically calls the SM2 two-way dynamic authentication protocol of S4 to trigger the secondary identity verification process. At the same time, the abnormal operation features are fed back to the model training module of S5 to update the risk assessment matrix parameters.

[0020] The formula for calculating the risk score is as follows:

[0021] R = α·Att attr (V attr )+(1-α)·Att time (V seq )·σ(W·GRU(V seq )+b);

[0022] in:

[0023] R represents the overall risk score of the user's current operation, with a value range of [0,1].

[0024] α represents the attribute attention weight coefficient, which is dynamically adjusted by the user profile importance in the S3 module, and its value ranges from [0.3, 0.7].

[0025] Att attr (V attr ) represents the output of the attribute attention branch, which calculates the static attribute vector V through a self-attention mechanism. attr ∈R d Risk contribution;

[0026] Att time (V seq The ) represents the output of the temporal attention branch, which is processed by an LSTM network on the operation sequence vector V. seq∈R t×d Weighted summation of temporal risk features (where t is the sequence length);

[0027] σ represents the Sigmoid activation function, which is used to compress the temporal dependency features of the GRU output to [0,1].

[0028] W represents the weight matrix of the GRU output layer, with a dimension of 1×d;

[0029] b represents the bias term, with an initial value of 0.1;

[0030] The dynamic threshold adjustment formula is:

[0031]

[0032] in:

[0033] θ represents the current risk score threshold; a score below this value is considered normal operation.

[0034] θ0 represents the initial threshold, with a default value of 0.6;

[0035] β represents the threshold adjustment coefficient, which is determined by the deviation of the audit data and has a value range of [0.5, 2.0].

[0036] N anomaly This indicates the number of abnormal operations detected by the system in the past 30 days;

[0037] Nt otal This indicates the total number of system operations in the past 30 days;

[0038] The formula for calculating attribute attention weights is:

[0039]

[0040] in:

[0041] q represents the query vector, which is obtained by training the risk assessment model of the S5 module and has a dimension of 1×d;

[0042] k represents the total number of dimensions of the user's static attributes;

[0043] Vattr,i is the embedding vector of the i-th static attribute, with a dimension of 1×d.

[0044] In a preferred embodiment, in step S6, the dynamic negotiation mechanism for the session key requires the SM2 elliptic curve key exchange protocol as its foundation. Both parties generate and exchange temporary public keys using their respective SM2 key pairs, obtain a shared secret value through dot multiplication, and then derive a 128-bit SM4 session key using the KDF function specified in GB / T32918.4-2016. During the key derivation process, the identities of both parties and a random number are added as salt values ​​to ensure the uniqueness of each negotiation result. The session key validity period adopts a hierarchical management mechanism, which is linked in real time with the risk level output in S5. When the risk level is high, the key validity period is automatically adjusted to 30 minutes; the medium risk level corresponds to a 2-hour validity period; and the low risk level maintains an 8-hour baseline value. The validity period countdown is synchronized to the client via the server's heartbeat packet.

[0045] In a preferred embodiment, in step S7, the user attributes include 8 items such as job level, professional qualification, and historical risk score; the resource attributes include 12 items such as device type, data sensitivity, and operation type; and the environmental attributes include 8 items such as access time, IP address, and terminal security level.

[0046] In a preferred embodiment, in step S8, each log entry generates a 256-bit hash value using the SM3 algorithm, which is stored together with the log content. A chained storage structure is used to ensure log integrity. The audit data retention period is no less than 180 days, and the abnormal behavior baseline is generated through training on historical data, including 15 indicators such as operation frequency, resource access distribution, and time period characteristics.

[0047] In a preferred embodiment, in step S9, the root key is distributed using an M-of-N threshold scheme, requiring at least three administrators to be present simultaneously for activation; the session key lifecycle is linked to the risk level of S5, with a lifespan of 30 minutes for high-risk scenarios, 2 hours for medium-risk scenarios, and 8 hours for low-risk scenarios; the key health assessment model includes three dimensions: usage frequency, survival time, and number of anomalies, triggering a rotation process when the assessment score is below 60; the SM2 key pair rotation adopts a dual-track system, with new keys generated 7 days in advance and synchronized to all systems, and old keys destroyed 24 hours after the switch.

[0048] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0049] 1. This invention constructs a comprehensive security protection system from identity authentication to access control by systematically deploying the SM2, SM3, and SM4 national cryptographic algorithms. The unified identity authentication platform adopts a distributed microservice architecture combined with a hardware encryption machine, ensuring the physical security of key storage and computation while improving system stability and response speed through master-slave synchronization mechanisms and interface latency control. The multi-source identity information federated collection mechanism achieves real-time integration of static attributes and dynamic behavioral data. Combined with an improved LSTM-attention mechanism risk assessment matrix, it can accurately capture abnormal characteristics of user operations. When the risk score exceeds the dynamic threshold, the SM2 bidirectional dynamic authentication protocol is automatically triggered, forming a closed-loop protection of "collection-assessment-authentication-audit," effectively resisting security threats such as identity forgery and access violations.

[0050] 2. This invention significantly enhances the flexibility of access control and risk response capabilities of power business systems through dynamic and intelligent design. The attribute attention and time attention branches in the risk assessment matrix work collaboratively to achieve deep integration of user static attributes and operation timing characteristics. The dynamic threshold adjustment formula adaptively optimizes the judgment criteria based on historical anomaly frequencies, avoiding misjudgments or omissions caused by fixed thresholds. Fine-grained attribute access control strategies achieve precise matching of multi-dimensional conditions based on a three-dimensional permission matrix. The key lifecycle management mechanism ensures the security of keys in all stages of generation, use, rotation, and destruction through state machines and health assessment models. The linkage mechanism between session keys and risk levels further shortens the key exposure window in high-risk scenarios. The overall solution not only meets the compliance requirements of national information security level protection and commercial cryptography standards but also provides a scalable and easily maintainable identity security system for power multi-business systems through the integrated application of deep learning algorithms and national cryptographic technologies. Attached Figure Description

[0051] Figure 1 This is a schematic diagram illustrating the process principle of the present invention. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0053] Example:

[0054] Reference Figure 1 A unified identity authentication and access control method for a power multi-service system based on national cryptographic algorithms, the method comprising the following steps:

[0055] S1: The design encompasses a distributed architecture that includes interfaces with multiple business systems, including the authentication server, key management center, and authentication server. The key management center will provide algorithmic support for subsequent steps.

[0056] S2: The SM2 algorithm is selected for identity signature, the SM3 algorithm is used for data digest, and the SM4 algorithm is used for transmission encryption. The key management center generates the root key according to the S1 architecture and stores it through a hardware encryption machine to provide an encryption basis for the identity information collection of S3.

[0057] S3: The user database that connects to the power dispatching, marketing and distribution business systems uses the SM4 algorithm to encrypt and transmit identity metadata, which is then integrated to form a unified user profile. This profile will serve as the core basis for S5 permission assessment.

[0058] S4: The user signs the random challenge value using their private key. The server verifies the signature using the public key deployed in S2. At the same time, the server generates an authentication token with a timestamp, hashes it using SM3, and returns it to the user to complete the two-way authentication. The authentication result is synchronized in real time to the permission evaluation module in S5.

[0059] S5: Integrates user profiles from S3 with real-time operational behavior, and uses deep learning algorithms to construct a risk assessment matrix. When abnormal operations are detected, it automatically triggers the secondary authentication process of S4 and pushes the assessment results to the access control module of S7.

[0060] S6: After authentication, both parties use SM2 key exchange to generate a session master key and then derive the SM4 session key through the KDF function. The key validity period is linked to the risk level of S5. In high-risk scenarios, the key lifespan is automatically shortened.

[0061] S7: Based on the dynamic permission evaluation results of S5, the ABAC model is used to bind user attributes with resource access rules. After the access request is hashed by SM3, it is compared with the policy library. The decision result is returned to the business system through the encrypted session channel of S6.

[0062] S8: All access behaviors generate tamper-proof audit logs via SM3, which, combined with the risk assessment model of S5, establish an abnormal behavior baseline. When a suspicious operation is detected, the key update process of S9 is automatically triggered.

[0063] S9: Integrate the S2 key to generate the S6 session key and the S8 audit data to establish a key health assessment model. When the audit system detects a security threat or the key is about to expire, it automatically starts the SM2 key pair rotation and synchronously updates the encryption configuration of each business system.

[0064] In step S1, the unified identity authentication platform architecture must adopt a distributed microservice deployment mode. The authentication server cluster should be configured with at least 3 physical nodes, each equipped with an 8-core CPU and 32GB of memory, and a master-slave synchronization mechanism should be used to achieve data consistency. The key management center should deploy an independent hardware encryption machine, supporting accelerated computation of SM2 / SM3 / SM4 algorithms, with a single device key storage capacity of no less than 1 million records. The multi-business system interfaces should adopt a RESTful API design, using port 443 for communication, and the interface response latency should be controlled within 200ms. The platform architecture must pass the Level 3 certification of the National Information Security Protection System and reserve a key synchronization interface with the S2 algorithm deployment module.

[0065] In step S2, the SM2 algorithm uses a 256-bit key length, adopts the elliptic curve parameter specification GB / T32918.2-2016, and uses the SHA-256 hash function in the signature process. The SM3 algorithm is implemented according to the GB / T32905-2016 standard, outputting a 256-bit message digest. The SM4 algorithm uses a 128-bit key and CBC working mode, with the IV vector randomly generated and transmitted with the ciphertext. The key management center generates the root key through a hardware encryption machine, with the key generation entropy source strength not less than 256 bits. The root key backup uses off-site disaster recovery storage, and key availability is verified quarterly. Algorithm deployment must be certified by a commercial cryptography testing and certification center and provide an encryption service interface to the data acquisition module in S3.

[0066] In step S3, establishing a multi-source identity information federated collection mechanism requires interfacing with at least 12 power business system databases, employing a data update strategy combining scheduled synchronization and real-time triggering. Static attribute data is fully synchronized daily at 3 AM, while dynamic operation data is pushed in real-time with a delay of no more than 5 seconds. Identity metadata data transmission uses the SM4 algorithm for encryption, and the data packet size is limited to within 1MB. A role-based access control model is used to filter the collection fields, with each user profile containing 42 attributes across three categories: basic information, permission information, and behavior records. During data integration, conflict detection rules are executed, and attributes with the same name are overwritten according to the priority of the business system. The integrated user profile is stored in an encrypted database, with field-level encryption using the SM4 algorithm, and a real-time query interface is provided to the permission evaluation module in S5.

[0067] In step S4, the server-side public key repository is updated hourly from the key management center. The challenge value is generated using the CTR_DRBG algorithm of the NISTSP800-90A standard, producing a 128-bit random number. The signature verification timeout is set to 3 seconds. The authentication token generated by the server contains three elements: user ID, timestamp, and random number, which are hashed using SM3 to generate a 256-bit digest value. The token validity period is set to 15 minutes, supporting a sliding window renewal mechanism. Detailed logs are recorded during the two-way authentication process, including information such as the authentication time and results of the participants. The authentication results are synchronized in real-time to the permission evaluation module in S5 via an in-memory database.

[0068] In step S5, a risk assessment matrix is ​​constructed using a dual-channel deep learning model that integrates temporal attention and attribute attention. First, static attributes (such as job level, operation permissions, and historical risk records) and real-time operation behavior sequences (such as access resource type, operation frequency, and instruction codes) from the user profile are obtained from module S3. The static attributes are transformed into attribute vectors of dimension d through an embedding layer, and the operation behavior sequences are transformed into temporal vectors of dimension d through word embedding and positional encoding. Next, parallel attribute attention and temporal attention branches are constructed: the attribute attention branch calculates the contribution weight of each static attribute to risk assessment using a self-attention mechanism (e.g., the weight of administrator positions is higher than that of ordinary users), and the temporal attention branch uses an LSTM network to capture the temporal dependencies of operation sequences (e.g., high-frequency sensitive operations during abnormal periods), and dynamically adjusts the weight allocation of long-term dependencies through a gated recurrent unit (GRU). The output features of the two branches are concatenated and input into a fully connected layer to obtain the risk probability vector of the user's current operation. This vector is then combined with historical audit data from module S8 to construct a dynamic risk assessment matrix. The matrix's row vectors represent the user attribute feature dimensions, the column vectors represent the real-time operation feature dimensions, and the matrix element values ​​are the risk contribution of the corresponding dimension. The risk probability vector is transformed into a risk score R between 0 and 1 by using the softmax function. When R exceeds the preset threshold θ, the system automatically calls the SM2 two-way dynamic authentication protocol of the S4 module to trigger the secondary identity verification process. At the same time, the abnormal operation features are fed back to the model training module of S5 to update the risk assessment matrix parameters.

[0069] The formula for calculating the risk score is as follows:

[0070] R = α·Att attr (V attr )+(1-α)·Att time (V seq )·σ(W·GRU(V seq )+b);

[0071] in:

[0072] R represents the overall risk score of the user's current operation, with a value range of [0,1].

[0073] α represents the attribute attention weight coefficient, which is dynamically adjusted by the user profile importance in the S3 module, and its value ranges from [0.3, 0.7].

[0074] Att attr (V attr ) represents the output of the attribute attention branch, which calculates the static attribute vector V through a self-attention mechanism. attr ∈R d Risk contribution;

[0075] Att time (V seq The ) represents the output of the temporal attention branch, which is processed by an LSTM network on the operation sequence vector V. seq ∈R t×d Weighted summation of temporal risk features (where t is the sequence length);

[0076] σ represents the Sigmoid activation function, which is used to compress the temporal dependency features of the GRU output to [0,1].

[0077] W represents the weight matrix of the GRU output layer, with a dimension of 1×d;

[0078] b represents the bias term, with an initial value of 0.1;

[0079] The dynamic threshold adjustment formula is:

[0080]

[0081] in:

[0082] θ represents the current risk score threshold; a score below this value is considered normal operation.

[0083] θ0 represents the initial threshold, with a default value of 0.6;

[0084] β represents the threshold adjustment coefficient, which is determined by the deviation of the audit data and has a value range of [0.5, 2.0].

[0085] N anomaly This indicates the number of abnormal operations detected by the system in the past 30 days;

[0086] Nt otal This indicates the total number of system operations in the past 30 days;

[0087] The formula for calculating attribute attention weights is:

[0088]

[0089] in:

[0090] q represents the query vector, which is obtained by training the risk assessment model of the S5 module and has a dimension of 1×d;

[0091] k represents the total number of dimensions of the user's static attributes (such as job permission history, etc.);

[0092] Vattr,i is the embedding vector of the i-th static attribute, with a dimension of 1×d.

[0093] In step S6, the dynamic negotiation mechanism for the session key uses the SM2 elliptic curve key exchange protocol as its foundation. Both parties generate and exchange temporary public keys using their respective SM2 key pairs, obtain a shared secret value through dot multiplication, and then derive a 128-bit SM4 session key using the KDF function specified in GB / T32918.4-2016. During key derivation, both parties' identities and a random number are added as salt to ensure the uniqueness of each negotiation result. The session key validity period employs a tiered management mechanism, linked in real-time with the risk level output by the S5 module. When the risk level is high, the key validity period automatically adjusts to 30 minutes; medium risk level corresponds to a 2-hour validity period; and low risk level maintains an 8-hour baseline value. The validity countdown is synchronized to the client via a server-side heartbeat packet. Key updates utilize a seamless switching mode, automatically triggering a new negotiation process when the current key has 20% of its lifespan remaining. After the new key is generated, it is transmitted encrypted using the old key to ensure business continuity. The negotiation process requires two-way authentication verification through the S4 module. The generated session key is stored only in memory and protected by a hardware encryption machine. After the key is used a total of 1,000 times, a forced rotation is triggered. All negotiation logs are synchronized to the S8 audit system and an SM3 hash digest is generated.

[0094] In step S7, user attributes include 8 items such as job level, professional qualification, and historical risk score; resource attributes include 12 items such as device type, data sensitivity, and operation type; and environmental attributes include 8 items such as access time, IP address, and terminal security level. The policy library is stored in XML format and contains over 1000 predefined access rules. The rule matching engine uses the Rete algorithm, with a single match taking no more than 50ms. Access requests are hashed using SM3 to generate a unique request identifier. The result of this comparison with the policy library is returned through an encrypted session channel established in S6, encapsulating the decision result in JSON format, including the three elements of allow / deny identifier, policy ID, and risk level. The policy library is fully updated every 24 hours, and emergency rules support real-time push updates.

[0095] In step S8, each log entry is hashed using the SM3 algorithm to generate a 256-bit hash value, which is stored along with the log content. A chained storage structure is used to ensure log integrity. Audit data is retained for at least 180 days. Anomaly behavior baselines are generated through training on historical data and include 15 indicators such as operation frequency, resource access distribution, and time period characteristics. The baseline is updated weekly. Anomaly detection uses a threshold-based statistical analysis method; an alarm is generated when the same indicator threshold is triggered three consecutive times. Alarm information is pushed to the key management module in S9 in real time, and anomaly characteristics are recorded for model optimization.

[0096] In step S9, the root key is distributed using an M-of-N threshold scheme, requiring at least three administrators to be present simultaneously for activation. The session key lifecycle is linked to the risk level in S5: 30 minutes for high-risk scenarios, 2 hours for medium-risk scenarios, and 8 hours for low-risk scenarios. The key health assessment model includes three dimensions: usage frequency, survival time, and number of anomalies. A rotation process is triggered when the assessment score falls below 60. SM2 key pair rotation uses a dual-track system: new keys are generated and synchronized to all systems 7 days in advance, while old keys are destroyed 24 hours after the switch. Key updates are pushed to business systems via an encrypted channel, supporting both batch updates and canary updates. Critical operations require the generation of audit logs and synchronization to S8.

[0097] As can be seen from the above, this invention constructs a full-link security protection system from identity authentication to access control by systematically deploying the SM2, SM3, and SM4 national cryptographic algorithms. The unified identity authentication platform adopts a distributed microservice architecture combined with a hardware encryption machine, which not only ensures the physical security of key storage and computation, but also improves the system's stability and response speed through master-slave synchronization mechanisms and interface latency control. The multi-source identity information federated collection mechanism realizes the real-time integration of static attributes and dynamic behavioral data. Combined with the improved LSTM-attention mechanism risk assessment matrix, it can accurately capture abnormal characteristics of user operations. When the risk score exceeds the dynamic threshold, the SM2 bidirectional dynamic authentication protocol is automatically triggered, forming a closed-loop protection of "collection-assessment-authentication-audit," effectively resisting security threats such as identity forgery and access violations.

[0098] This invention significantly enhances the flexibility of access control and risk response capabilities of power business systems through dynamic and intelligent design. The attribute attention and time attention branches in the risk assessment matrix work collaboratively to achieve deep integration of user static attributes and operation timing characteristics. The dynamic threshold adjustment formula adaptively optimizes the judgment criteria based on historical anomaly frequencies, avoiding misjudgments or omissions caused by fixed thresholds. Fine-grained attribute access control strategies achieve precise matching of multi-dimensional conditions based on a three-dimensional permission matrix. The key lifecycle management mechanism ensures key security in all stages of generation, use, rotation, and destruction through a state machine and health assessment model. The linkage mechanism between session keys and risk levels further shortens the key exposure window in high-risk scenarios. The overall solution not only meets the compliance requirements of national information security level protection and commercial cryptography standards but also provides a scalable and easily maintainable identity security system for power multi-business systems through the integrated application of deep learning algorithms and national cryptographic technologies.

[0099] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the term "comprising" or any other variations thereof is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0100] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A unified identity authentication and access control method for a power multi-service system based on national cryptographic algorithms, characterized in that: The method includes the following steps: S1: The design encompasses a distributed architecture that includes interfaces with multiple business systems, including the authentication server, key management center, and authentication server. The key management center will provide algorithmic support for subsequent steps. S2: The SM2 algorithm is selected for identity signature, the SM3 algorithm is used for data digest, and the SM4 algorithm is used for transmission encryption. The key management center generates the root key according to the S1 architecture and stores it through a hardware encryption machine to provide an encryption basis for the identity information collection of S3. S3: The user database that connects to the power dispatching, marketing and distribution business systems uses the SM4 algorithm to encrypt and transmit identity metadata, which is then integrated to form a unified user profile. This profile will serve as the core basis for S5 permission assessment. S4: The user signs the random challenge value using their private key. The server verifies the signature using the public key deployed in S2. At the same time, the server generates an authentication token with a timestamp, hashes it using SM3, and returns it to the user to complete the two-way authentication. The authentication result is synchronized in real time to the permission evaluation module in S5. S5: Integrates user profiles from S3 with real-time operational behavior, and uses deep learning algorithms to construct a risk assessment matrix. When abnormal operations are detected, it automatically triggers the secondary authentication process of S4 and pushes the assessment results to the access control module of S7. S6: After authentication, both parties use SM2 key exchange to generate a session master key and then derive the SM4 session key through the KDF function. The key validity period is linked to the risk level of S5. In high-risk scenarios, the key lifespan is automatically shortened. S7: Based on the dynamic permission evaluation results of S5, the ABAC model is used to bind user attributes with resource access rules. After the access request is hashed by SM3, it is compared with the policy library. The decision result is returned to the business system through the encrypted session channel of S6. S8: All access behaviors generate tamper-proof audit logs via SM3, which, combined with the risk assessment model of S5, establish an abnormal behavior baseline. When a suspicious operation is detected, the key update process of S9 is automatically triggered. S9: Integrate the S2 key to generate the S6 session key and the S8 audit data to establish a key health assessment model. When the audit system detects a security threat or the key is about to expire, it automatically starts the SM2 key pair rotation and synchronously updates the encryption configuration of each business system.

2. The unified identity authentication and access control method for a power multi-service system based on national cryptographic algorithms as described in claim 1, characterized in that: In step S1, the unified identity authentication platform architecture must adopt a distributed microservice deployment mode. The authentication server cluster is configured with at least 3 physical nodes, each node is equipped with an 8-core CPU and 32GB of memory, and a master-slave synchronization mechanism is used to achieve data consistency. The key management center is deployed with an independent hardware encryption machine that supports SM2 / SM3 / SM4 algorithm acceleration and has a single device key storage capacity of no less than 1 million records. The multi-business system interfaces adopt a RESTful API design.

3. The unified identity authentication and access control method for a power multi-service system based on national cryptographic algorithms as described in claim 1, characterized in that: In step S2, the SM2 algorithm uses a 256-bit key length and adopts the elliptic curve parameter specification GB / T32918.2-2016. The signature process uses the SHA-256 hash function. The SM3 algorithm is implemented according to the GB / T32905-2016 standard and outputs a 256-bit message digest. The SM4 algorithm uses a 128-bit key and CBC working mode. The IV vector is randomly generated and transmitted with the ciphertext.

4. The unified identity authentication and access control method for a power multi-service system based on national cryptographic algorithms as described in claim 1, characterized in that: In step S3, establishing a multi-source identity information federation collection mechanism requires connecting to at least 12 power business system databases and adopting a data update strategy that combines timed synchronization and real-time triggering. Static attribute data is fully synchronized at 3:00 AM daily, and dynamic operation data is pushed in real time with a delay of no more than 5 seconds; identity metadata data transmission is encrypted using the SM4 algorithm, and the size of the transmitted data packet is limited to within 1MB; a role-based access control model is used to filter the collected fields, and each user profile contains three categories of 42 attributes: basic information, permission information, and behavior records.

5. The unified identity authentication and access control method for a power multi-service system based on national cryptographic algorithms as described in claim 1, characterized in that: In step S4, the server-side public key library is updated synchronously from the key management center every hour. The challenge value is generated using the CTR_DRBG algorithm of the NISTSP800-90A standard to generate a 128-bit random number. The signature verification timeout is set to 3 seconds. The authentication token generated by the server contains three elements: user ID, timestamp, and random number. After being hashed by SM3, a 256-bit digest value is generated.

6. The unified identity authentication and access control method for a power multi-service system based on national cryptographic algorithms as described in claim 1, characterized in that: In step S5, a risk assessment matrix is ​​constructed using a dual-channel deep learning model that integrates temporal attention and attribute attention. First, static attributes and real-time operation behavior sequences from the user profile are obtained from S3. The static attributes are transformed into attribute vectors of dimension d through an embedding layer, and the operation behavior sequences are transformed into temporal vectors of dimension d through word embedding and positional encoding. Next, parallel attribute attention and temporal attention branches are constructed: the attribute attention branch calculates the contribution weight of each static attribute to risk assessment through a self-attention mechanism, and the temporal attention branch uses an LSTM network to capture the temporal dependencies of the operation sequences and dynamically adjusts the length of the recurrent unit. The system performs period-dependent weight allocation; after concatenating the output features of the two branches, it inputs them into the fully connected layer to obtain the risk probability vector of the user's current operation. Then, it combines the historical audit data of the S8 module to construct a dynamic risk assessment matrix. The row vector of the matrix represents the user attribute feature dimension, the column vector represents the real-time operation feature dimension, and the matrix element value is the risk contribution of the corresponding dimension. The risk probability vector is transformed into a risk score R between 0 and 1 through the softmax function. When R exceeds the preset threshold θ, the system automatically calls the SM2 two-way dynamic authentication protocol of S4 to trigger the secondary identity verification process. At the same time, the abnormal operation features are fed back to the model training module of S5 to update the risk assessment matrix parameters. The formula for calculating the risk score is as follows: R=α·Att attr (V attr )+(1-a)·Att time (V seq )·σ(W·GRU(V seq )+b); in: R represents the overall risk score of the user's current operation, with a value range of [0,1]. α represents the attribute attention weight coefficient, which is dynamically adjusted by the user profile importance in the S3 module, and its value ranges from [0.3, 0.7]. Att attr (V attr ) represents the output of the attribute attention branch, which calculates the static attribute vector V through a self-attention mechanism. attr ∈R d Risk contribution; Att time (V seq The ) represents the output of the temporal attention branch, which is processed by an LSTM network on the operation sequence vector V. seq ∈R t×d Weighted summation of temporal risk features (where t is the sequence length); σ represents the Sigmoid activation function, which is used to compress the temporal dependency features of the GRU output to [0,1]. W represents the weight matrix of the GRU output layer, with a dimension of 1×d; b represents the bias term, with an initial value of 0.1; The dynamic threshold adjustment formula is: in: θ represents the current risk score threshold; a score below this value is considered normal operation. θ0 represents the initial threshold, with a default value of 0.6; β represents the threshold adjustment coefficient, which is determined by the deviation of the audit data and has a value range of [0.5, 2.0]. N anomaly This indicates the number of abnormal operations detected by the system in the past 30 days; Nt otal This indicates the total number of system operations in the past 30 days; The formula for calculating attribute attention weights is: in: q represents the query vector, which is obtained by training the risk assessment model of the S5 module and has a dimension of 1×d; k represents the total number of dimensions of the user's static attributes; Vattr,i is the embedding vector of the i-th static attribute, with a dimension of 1×d.

7. The unified identity authentication and access control method for a power multi-service system based on national cryptographic algorithms as described in claim 1, characterized in that: In step S6, the dynamic negotiation mechanism for the session key requires the SM2 elliptic curve key exchange protocol as its foundation. Both parties generate and exchange temporary public keys using their respective SM2 key pairs, obtain a shared secret value through dot multiplication, and then derive a 128-bit SM4 session key using the KDF function specified in GB / T32918.4-2016. During the key derivation process, the identity identifiers of both parties and a random number are added as salt values ​​to ensure the uniqueness of each negotiation result. The session key validity period adopts a hierarchical management mechanism, which is linked in real time with the risk level output in S5. When the risk level is high, the key validity period is automatically adjusted to 30 minutes, the medium risk level corresponds to a 2-hour validity period, and the low risk level maintains an 8-hour baseline value. The validity period countdown is synchronized to the client via the server's heartbeat packet.

8. The unified identity authentication and access control method for a power multi-service system based on national cryptographic algorithms as described in claim 1, characterized in that: In step S7, the user attributes include 8 items such as job level, professional qualification, and historical risk score; the resource attributes include 12 items such as device type, data sensitivity, and operation type; and the environment attributes include 8 items such as access time, IP address, and terminal security level.

9. The unified identity authentication and access control method for a power multi-service system based on national cryptographic algorithms as described in claim 1, characterized in that: In step S8, each log entry generates a 256-bit hash value using the SM3 algorithm, which is stored together with the log content. A chained storage structure is used to ensure log integrity. The audit data is retained for no less than 180 days. The abnormal behavior baseline is generated through training on historical data and includes 15 indicators such as operation frequency, resource access distribution, and time period characteristics.

10. The unified identity authentication and access control method for a power multi-service system based on national cryptographic algorithms as described in claim 1, characterized in that: In step S9, the root key is distributed using an M-of-N threshold scheme, requiring at least three administrators to be present simultaneously for activation; the session key lifecycle is linked to the risk level of S5, with a lifespan of 30 minutes for high-risk scenarios, 2 hours for medium-risk scenarios, and 8 hours for low-risk scenarios; the key health assessment model includes three dimensions: usage frequency, survival time, and number of anomalies, triggering a rotation process when the assessment score is below 60; the SM2 key pair rotation adopts a dual-track system, with new keys generated 7 days in advance and synchronized to all systems, and old keys destroyed 24 hours after the switch.

Images