Power terminal adaptive security authentication method and related device

Abstract

The invention belongs to an authentication method, and provides a power terminal adaptive security authentication method and a related device aiming at the technical problems that the adaptive security authentication capability is insufficient and the application depth of an AI (Artificial Intelligence) technology is insufficient in an existing power business scene. Then enhancement verification is carried out by means of a large language model and generative retrieval enhancement, a security authentication strategy of a terminal to be accessed to the network is generated, simulation test and multi-level auditing are carried out on the generated security authentication strategy, deployment is carried out after all the security authentication strategies pass, continuous security monitoring is carried out after deployment, and the security authentication strategy is adjusted in time according to a monitoring result. And if necessary, regenerating the device fingerprint for the terminal and re-authenticating. And a technical support is provided for safe access and full-life-cycle safe management and control of massive terminals of a novel electric power system.

Description

Technical Field

[0001] This application pertains to an authentication method, specifically relating to an adaptive security authentication method and related apparatus for power terminals. Background Technology

[0002] The power system encompasses multiple stages, including power generation, transmission, distribution, and consumption. The security requirements of terminals in each stage vary significantly. Existing solutions often employ a unified authentication strategy, failing to dynamically adjust authentication strength and processes for different business scenarios, thus failing to adapt to fluctuating security needs across different stages. Power terminals also frequently face dynamic risks such as grid network attacks and untimely vulnerability patching. Existing solutions cannot adaptively adjust authentication methods based on changes in terminal risk. Furthermore, the power system has multiple levels of dispatch centers, and terminals in different regions may use authentication systems from different vendors. Existing solutions lack cross-domain authentication data interfaces and a unified adaptive authentication decision standard, resulting in a lack of coordinated adjustment of authentication strategies when terminals connect across regions.

[0003] Furthermore, existing solutions, when applying AI technology, often employ general-purpose AI models. These models are unable to accurately identify anomalies specific to the power sector, only general network anomalies, resulting in significant application limitations. Power terminals also contain numerous edge devices with limited computing power, storage capacity, and power consumption. High-performance AI demands substantial hardware resources, making it difficult to deploy AI technology across massive numbers of edge terminals and hindering intelligent authentication and monitoring of all terminals. AI models also require iterative optimization based on massive amounts of power terminal operational data. However, power data involves grid security and is sensitive information; therefore, insufficient training data or compromised data security often restricts the iteration and in-depth application of AI technology. Summary of the Invention

[0004] This application addresses the technical problems of insufficient adaptive security authentication capabilities and lack of depth in the application of AI technology in existing power business scenarios by proposing an adaptive security authentication method and related device for power terminals.

[0005] To achieve the above objectives, this application adopts the following technical solution: Firstly, this application proposes an adaptive security authentication method for power terminals, comprising: Based on the current multimodal information of the terminal to be connected to the network, generate the device fingerprint of the terminal to be connected to the network, and store the current multimodal information and the device fingerprint; Access authentication is performed using the multimodal information and device fingerprint of the terminal to be connected to the network; The system enables the terminal waiting to join the network to initiate an access request to the large language model, performs authentication and verification on the terminal waiting to join the network, and allocates access control resources to the large language model within a preset time period when the large language model needs to call generative retrieval enhancement, and performs enhanced verification in combination with the current environmental attributes of the terminal waiting to join the network. Based on the existing security authentication policy library that matches the terminal to be connected to the network; or, by combining the current multimodal information, large language model and generative retrieval enhancement of the terminal to be connected to the network, generate the security authentication policy for the terminal to be connected to the network. The security authentication policy is simulated and audited at multiple levels. If the simulation test and multi-level audit are passed, the final security authentication policy is obtained. Otherwise, the reason for failure is used as a new constraint to regenerate the security authentication policy of the terminal to be connected to the network until the final security authentication policy is obtained. The final security authentication policy will be deployed to the terminal to be connected to the network, and continuous security monitoring will be implemented.

[0006] Furthermore, the implementation of continuous security monitoring includes: Trustworthy benchmarks are constructed based on static and dynamic metrics, and the trustworthy benchmarks are verified in real time.

[0007] Furthermore, after implementing continuous security monitoring, it also includes: When updating the final security authentication policy according to business needs, the terminal is taken offline, and the device fingerprint of the terminal to be connected to the network is regenerated based on the current multimodal information of the terminal to be connected to the network. Alternatively, when a passive scenario with adaptive security authentication policy is triggered, the terminal is taken offline and the cause of the terminal abnormality is investigated. After the cause of the abnormality is ruled out, the device fingerprint of the terminal to be connected to the network is regenerated based on the current multimodal information of the terminal to be connected to the network.

[0008] Furthermore, after implementing continuous security monitoring, it also includes: A performance evaluation is conducted. If the performance evaluation results meet the preset requirements, the weight parameters in the final security authentication strategy are adjusted; otherwise, the terminal's security authentication strategy is regenerated.

[0009] Furthermore, after implementing continuous security monitoring, it also includes: By tracing the version of security authentication policies and conducting audit trails, records of changes to security authentication policies are preserved.

[0010] Furthermore, the method for access authentication of the multimodal information and device fingerprint of the terminal to be connected to the network includes: If the terminal to be connected to the network is accessing the network for the first time, the multimodal information and device fingerprint of the terminal device to be connected to the network will be collected and compared with the preset registration information. If they match, the terminal to be connected to the network will be connected. If the terminal to be connected to the network is not accessing for the first time, after updating the multimodal information and device fingerprint, the terminal to be connected to the network will be treated as the first access terminal for access authentication.

[0011] Furthermore, the method for generating the security authentication policy for the terminal to be connected to the network includes: Based on the business scenario information of the terminal to be connected to the network, describe the security authentication requirements of the terminal to be connected to the network, and combine the current multimodal information of the terminal to be connected to the network, and use a large language model to obtain the basis for the authentication strategy of the terminal to be connected to the network. Based on the authentication strategy of the terminal to be connected to the network, generate key constraint triples; Generative retrieval enhancements are employed to expand key constraint triples; Based on the expanded key constraint triples, select the corresponding authentication strategy from the existing authentication strategy library; if there is no corresponding authentication strategy in the existing authentication strategy library, generate a new authentication strategy by combining the expanded key constraint triples and the large language model.

[0012] Furthermore, the method for simulating and multi-level auditing the security authentication strategy includes: Simulate the operating environment of the terminal to be connected to the network, conduct resource consumption tests, and establish a performance quantification model to evaluate the performance of the terminal when executing security authentication policies. A security assessment is conducted by combining the vulnerability exposure and anti-attack capabilities of the terminal to be connected to the network when executing the security authentication policy.

[0013] In a first aspect, this application proposes an adaptive security authentication system for power terminals, comprising: The identity module is used to generate a device fingerprint for the terminal to be connected to the network based on its current multimodal information, and to store the current multimodal information and the device fingerprint. The access authentication module is used to authenticate the multimodal information and device fingerprint of the terminal to be connected to the network. The enhanced verification module is used to enable the terminal to be connected to the network to initiate an access request to the large language model, to perform authentication and verification of the terminal to be connected to the network, and to allocate access control resources to the large language model within a preset time period when the large language model needs to call generative retrieval enhancement, and to perform enhanced verification in combination with the current environmental attributes of the terminal to be connected to the network. The security authentication module is used to generate a security authentication strategy for the terminal to be connected to the network based on the security authentication strategy matching the existing security authentication strategy library; or, by combining the current multimodal information, large language model and generative retrieval enhancement of the terminal to be connected to the network. The verification module is used to perform simulation tests and multi-level audits on the security authentication policy. If the simulation test and multi-level audit are passed, the final security authentication policy is obtained. Otherwise, the reason for failure is used as a new constraint to regenerate the security authentication policy of the terminal to be connected to the network until the final security authentication policy is obtained. The deployment module is used to deploy the final security authentication policy to the terminal to be connected to the network and to implement continuous security monitoring.

[0014] Furthermore, in the deployment module, the implementation of continuous security monitoring includes: Trustworthy benchmarks are constructed based on static and dynamic metrics, and the trustworthy benchmarks are verified in real time.

[0015] Furthermore, in the deployment module, after implementing continuous security monitoring, it also includes: When updating the final security authentication policy according to business needs, the terminal is taken offline, and the device fingerprint of the terminal to be connected to the network is regenerated based on the current multimodal information of the terminal to be connected to the network. Alternatively, when a passive scenario with adaptive security authentication policy is triggered, the terminal is taken offline and the cause of the terminal abnormality is investigated. After the cause of the abnormality is ruled out, the device fingerprint of the terminal to be connected to the network is regenerated based on the current multimodal information of the terminal to be connected to the network.

[0016] Furthermore, in the deployment module, after implementing continuous security monitoring, it also includes: A performance evaluation is conducted. If the performance evaluation results meet the preset requirements, the weight parameters in the final security authentication strategy are adjusted; otherwise, the terminal's security authentication strategy is regenerated.

[0017] Furthermore, in the deployment module, after implementing continuous security monitoring, it also includes: By tracing the version of security authentication policies and conducting audit trails, records of changes to security authentication policies are preserved.

[0018] Furthermore, in the access authentication module, the method for access authentication of the multimodal information and device fingerprint of the terminal to be connected to the network includes: If the terminal to be connected to the network is accessing the network for the first time, the multimodal information and device fingerprint of the terminal device to be connected to the network will be collected and compared with the preset registration information. If they match, the terminal to be connected to the network will be connected. If the terminal to be connected to the network is not accessing for the first time, after updating the multimodal information and device fingerprint, the terminal to be connected to the network will be treated as the first access terminal for access authentication.

[0019] Furthermore, the method for generating the security authentication policy for the terminal to be connected to the network includes: Based on the business scenario information of the terminal to be connected to the network, describe the security authentication requirements of the terminal to be connected to the network, and combine the current multimodal information of the terminal to be connected to the network, and use a large language model to obtain the basis for the authentication strategy of the terminal to be connected to the network. Based on the authentication strategy of the terminal to be connected to the network, generate key constraint triples; Generative retrieval enhancements are employed to expand key constraint triples; Based on the expanded key constraint triples, select the corresponding authentication strategy from the existing authentication strategy library; if there is no corresponding authentication strategy in the existing authentication strategy library, generate a new authentication strategy by combining the expanded key constraint triples and the large language model.

[0020] Furthermore, in the verification module, the method for simulating and multi-level auditing the security authentication strategy includes: Simulate the operating environment of the terminal to be connected to the network, conduct resource consumption tests, and establish a performance quantification model to evaluate the performance of the terminal when executing security authentication policies. A security assessment is conducted by combining the vulnerability exposure and anti-attack capabilities of the terminal to be connected to the network when executing the security authentication policy.

[0021] Thirdly, this application proposes an electronic device, including: a memory and one or more processors; the memory is coupled to the processors; wherein the memory stores computer program code, the computer program code including computer instructions, and when the computer instructions are executed by the processor, the electronic device performs the steps of the above-described adaptive security authentication method for power terminals.

[0022] Fourthly, this application proposes a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described adaptive security authentication method for power terminals.

[0023] Compared with the prior art, this application has the following beneficial effects: This application proposes an adaptive security authentication method for power terminals. After generating a device fingerprint of the terminal to be connected to the network, it combines multimodal information for access authentication. Enhanced verification is then performed using a large language model and generative retrieval enhancement to generate a security authentication policy for the terminal. The generated security authentication policy undergoes simulation testing and multi-level auditing. Deployment only occurs after all levels pass, and continuous security monitoring is implemented after deployment to promptly identify different types of security risks. This application employs device fingerprint-based security authentication, significantly reducing terminal memory and CPU resource consumption. It is compatible with existing cryptographic systems such as PKI / IBC, supports the high concurrency and flexible authentication needs of large-scale terminals, and its dynamic trusted verification and full lifecycle security management meet the requirements of the Cybersecurity Law 2.0, providing technical support for the secure access of massive numbers of terminals in new power systems.

[0024] This application also proposes an adaptive security authentication system for power terminals, an electronic device, and a computer-readable storage medium, which possess all the advantages of the aforementioned adaptive security authentication methods for power terminals. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a schematic diagram of the first process of the adaptive security authentication method for power terminals in this application; Figure 2 This is a schematic diagram of the second process of the adaptive security authentication method for power terminals in this application; Figure 3 This is a schematic diagram of the power terminal adaptive security authentication system of this application. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0028] Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of the application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0029] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0030] In the description of the embodiments of this application, it should be noted that if terms such as "upper," "lower," "horizontal," or "inner" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship commonly used when the product of the invention is in use, they are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation on this application. In addition, terms such as "first" and "second" are only used to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0031] Furthermore, the use of the term "horizontal" does not imply that the component must be absolutely horizontal, but rather that it can be slightly tilted. For example, "horizontal" simply means that its direction is more horizontal than "vertical," and does not mean that the structure must be completely horizontal, but can be slightly tilted.

[0032] In the description of the embodiments of this application, it should also be noted that, unless otherwise explicitly specified and limited, the terms "set," "install," "connect," and "link" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances.

[0033] Chinese invention patent application CN117896074A proposes a secure access authentication system based on device fingerprints, as well as a device fingerprint monitoring and update system that combines terminal security and trust status with business models. However, this solution still suffers from problems such as a lack of adaptive security authentication capabilities in power business scenarios and insufficient application of AI technology.

[0034] For terminals, their main ID and digital certificate are the power grid asset physical ID and equipment certificate. The power grid asset physical ID is generated during the equipment procurement or operation monitoring phase, using a QR code or Radio Frequency Identification (RFID) electronic tag as its carrier. It is a unique and permanent identification number for power grid assets, consisting of a 24-digit decimal number containing a company code segment (range 001-099), an identification code, a serial number, and a check code. If a terminal does not have a power grid asset physical ID, its ID is set to its terminal name. The equipment certificate refers to the certificate required by network devices, server hosts, etc., when accessing the local network system and communicating with other entities.

[0035] End-to-end authentication processes typically rely on usernames and passwords. Without proper authentication, hackers can easily connect to these sensors, access data, or conduct widespread malicious activities. Given that most of these are power-constrained nodes with limited computing and memory resources, current mainstream solutions for device authentication primarily include PKI (Public Key Infrastructure), PKI / CLA (Public Key Infrastructure / Certificate Less Authentication), certificateless cryptography, and lightweight authentication technologies.

[0036] PKI-based security authentication schemes in power monitoring systems treat each device as an entity, requiring it to apply for its own device certificate before commencing operations. This certificate is then used for authentication during interactions with external systems. While PKI provides relatively good assurance of trustworthy identities between communicating parties, it is relatively time-consuming due to the numerous computations involved in public-key cryptography algorithms. Furthermore, since all device certificates require review, issuance, and retrieval by the same CA system, and certificate storage consumes considerable device space, system performance can be significantly impacted if the number of devices reaches tens or even hundreds of millions. Therefore, PKI is more suitable for power monitoring systems with a relatively small number of devices and primarily involving end-to-cloud communication.

[0037] Based on PKI / CLA certificateless cryptographic authentication, this technology addresses the application needs of asymmetric key distribution and management, and is used to generate, distribute, and manage user entity keys. CLA certificateless cryptography employs a novel certificateless public-key cryptosystem with dual keys, based on SM2 elliptic curve cryptography, and without bilinear pairing operations. It utilizes existing SM2 elliptic curve cryptography algorithms to achieve efficient distribution and management of user keys. It features high security and high authentication efficiency because the public key identifier is short and the key storage cost is low. It supports low-latency, high-connectivity authentication applications in power monitoring systems, and the certificateless cryptographic system possesses decentralized and offline device verification capabilities, meeting the practical needs of cross-domain authentication in power monitoring systems and supporting integration with PKI / CA.

[0038] Identifier-based authentication schemes can use information such as PAID (Packet Arrival Interval Distribution Fingerprint) and CSI (Channel State Information Fingerprint) as public keys for identification. PAID fingerprints are generated using packet arrival interval distributions independent of external factors, while CSI fingerprints, based on channel state information, provide fine-grained channel characteristics and can be easily obtained from OFDM wireless devices. CSI fingerprints reflect the device's wireless channel characteristics, while PAID fingerprints reflect the device's hardware characteristics. Device authentication schemes are still in a rapid development phase, requiring continuous efforts to find a balance between security and lightweight design; currently, there is no unified standard solution.

[0039] Furthermore, there is currently no universally accepted definition for Large Language Models (LLMs). Generally, the academic community believes that LLMs consist of neural networks with at least billions of parameters, trained on massive amounts of unlabeled text using self-supervised or semi-supervised learning. They possess powerful processing capabilities and can perform diverse natural language processing tasks, including text generation, machine translation, and sentiment analysis, such as GPT4, ChatGPT, and LLaMA. Thanks to the advent of LLMs, question-answering technology based on LLMs has developed rapidly. The emergence of ChatGPT marks a new era for dialogue-based LLMs. This technology obtains a large language model through pre-training on massive amounts of data, constructs question-answering datasets according to different tasks, learns to understand natural human dialogue, and thus accurately understands complex semantic questions posed by humans, providing corresponding answers. In addition, integrating knowledge graphs and threat intelligence into large language models enhances their ability to understand and align with human preferences. However, the operational logic of LLMs is difficult to trace and interpret. On the one hand, because the reliability of the data cannot be assessed, it is prone to generating harmful illusory facts. On the other hand, when faced with problems in specialized fields, the results generated by large language models may lack authenticity and accuracy, and may even produce illusory facts. Fine-tuning techniques based on model parameter modifications are widely used to enhance the ability of large language models to solve specialized problems, but many research results show that such fine-tuning methods can lead to catastrophic forgetting.

[0040] Knowledge graphs have garnered widespread attention as a structured representation of knowledge. They explicitly present a vast amount of factual knowledge and the relationships between it. This structured approach allows people to more intuitively see the coherence and richness of knowledge, thus achieving higher interpretability in tasks such as reasoning and question answering. Corresponding knowledge graph question answering systems, by parsing questions and searching for answers within the knowledge graph, can leverage rich entity relationships for multi-hop reasoning. Key technologies include entity linking, relation extraction, and semantic parsing, with representative systems such as Google Knowledge Graph. However, knowledge graphs are massive in scale, requiring significant effort to create and maintain, and inherently cannot be used for question answering and querying using natural language, undoubtedly increasing the difficulty of their practical applications.

[0041] The lack of interpretability and reasoning processes and basis in large language models is precisely where knowledge graphs excel. Conversely, the complexity of knowledge graphs and their unfamiliarity with natural language are problems that large language models aim to solve. Combining knowledge graphs with large language models can achieve a complementary effect. Furthermore, if domain knowledge bases are integrated, Retrieval Augmented Generation (RAG) can be implemented. RAG assists large language models in generating more accurate and richer text content by retrieving relevant information from external knowledge bases. Integrating autonomous AI agents into the RAG framework allows these agents to dynamically adjust retrieval strategies, iteratively optimize contextual understanding, and adjust workflows through clearly defined operational structures, from sequential steps to adaptive collaboration. This integration enables the RAG system to exhibit excellent flexibility, scalability, and context-awareness in various application scenarios.

[0042] To address the shortcomings of existing power system network security authentication technologies, such as the susceptibility of device fingerprint attributes to interference, the rigidity of PKI systems making them difficult to adapt to multiple service scenarios and massive numbers of terminals, the lack of AI-driven dynamic policy generation capabilities, and the absence of end-to-end monitoring from the terminal itself to operation, this application proposes an adaptive security authentication method and related apparatus for power terminals. The following detailed description, in conjunction with embodiments and accompanying drawings, further illustrates this application.

[0043] like Figure 1 The diagram shown is a flowchart of a first embodiment of the adaptive security authentication method for power terminals according to this application, which may include: S101, Based on the current multimodal information of the terminal to be connected to the network, generate the device fingerprint of the terminal to be connected to the network, and store the current multimodal information and the device fingerprint.

[0044] It should be noted that the current multimodal information of the terminal to be connected to the network can include its hardware parameters, software configuration, and network environment information, etc. A device fingerprint, on the other hand, is a set of information that uniquely identifies the terminal. This application establishes a unique identity for the terminal to be connected to the network, facilitating subsequent authentication work, and the stored information also provides data support for possible subsequent verification and traceability.

[0045] S102 performs access authentication on the multimodal information and device fingerprint of the terminal to be connected to the network.

[0046] It should be noted that access authentication refers to verifying the identity of terminals entering the network to confirm their access rights. This involves comparing the multimodal information and device fingerprint currently provided by the terminal with previously stored information to determine if the terminal is legitimate and whether its network access is permitted. This process prevents unauthorized terminals from accessing the network, ensuring network security and serving as the first line of defense for terminals entering the network.

[0047] S103 enables the terminal waiting to join the network to initiate an access request to the large language model after passing access authentication, performs authentication and verification on the terminal waiting to join the network, and allocates access control resources to the large language model within a preset time period when the large language model needs to call generative retrieval enhancement, and performs enhanced verification in combination with the current environmental attributes of the terminal waiting to join the network.

[0048] After successful access authentication, the terminal sends an access request containing its own identifier and other information to the large language model. The large language model verifies the terminal based on its built-in verification logic. When generative retrieval enhancement is deemed necessary, the system automatically allocates access control resources, such as computing and storage resources, to the terminal within a preset time period. Simultaneously, it collects the terminal's current environmental attributes, such as whether its location is within an allowed area and whether the network is secure. This information is incorporated into the verification process to comprehensively determine whether verification is successful. Through intelligent verification by the large language model and enhanced verification combined with environmental attributes, the security and accuracy of terminal authentication are further improved. At the same time, the rational allocation of resources ensures the efficient operation of the large language model when invoking generative retrieval enhancement.

[0049] S104. Combine the current multimodal information of the terminal to be connected to the network to obtain the basis for the authentication strategy of the terminal to be connected to the network. Then, combine the basis for the authentication strategy of the terminal to be connected to the network, the large language model and generative retrieval enhancement to generate the security authentication strategy of the terminal to be connected to the network.

[0050] The system collects current multimodal information from terminals, extracting data such as terminal type, importance, and historical authentication records as the basis for strategy formulation. This data is input into a large language model, which simultaneously utilizes generative retrieval to acquire relevant security authentication knowledge and case studies. The large language model then integrates this information to generate a preliminary security authentication strategy, including authentication frequency, methods, and required verification information. The generated security authentication strategy is more targeted and adaptable, and can be customized according to the specific circumstances of the terminal, improving the effectiveness and flexibility of security authentication.

[0051] S105: Perform simulation testing and multi-level auditing on the security authentication policy. If the simulation test and multi-level auditing pass, the final security authentication policy is obtained. Otherwise, the reason for failure is used as a new constraint to regenerate the security authentication policy of the terminal to be connected to the network until the final security authentication policy is obtained.

[0052] This application simulates a real-world access scenario for terminals seeking network access, performing comprehensive verification of the generated security authentication policy. In practical applications, it can verify performance adaptability, i.e., whether the security authentication policy is compatible with the terminal's capabilities, and security effectiveness, i.e., whether the security authentication policy can intercept risks. Multi-level verification can cover both automated and manual verification, avoiding oversights in single verification stages.

[0053] S106 deploys the final security authentication policy to the terminal to be connected to the network and implements continuous security monitoring.

[0054] The final security authentication policy confirmed in step S105 is implemented in each terminal waiting to access the network through a standardized deployment method, ensuring that the terminal strictly follows the authentication process required by the policy when accessing the network, and performs self-protection in accordance with the security rules defined by the policy during operation.

[0055] This application addresses the limitations of traditional single-dimensional and static terminal authentication, significantly enhancing the uniqueness and anti-counterfeiting capabilities of terminal identification, effectively preventing unauthorized terminals from impersonating and accessing the network. The introduction of large language models and generative retrieval enhancements not only improves the efficiency of security authentication strategy generation but also allows strategies to fully integrate power industry standards and experience from similar cases, avoiding oversights or poor adaptability caused by manually formulated strategies, and reducing the time and manpower costs of strategy iteration. Secondly, it adopts a closed-loop management process, filtering risky terminals in advance during access authentication, using simulation testing and multi-level audits to prevent the implementation of unqualified strategies, and continuously monitoring to dynamically capture security risks during operation, reducing major risks such as power grid data leakage and abnormal dispatch instructions caused by security vulnerabilities in power terminals. Finally, the security authentication in this application can be flexibly adjusted according to changes in terminal status and evolving environmental risks, without frequent manual intervention. This ensures the long-term safe and stable operation of the power network and provides a feasible path for the intelligent and automated upgrading of power industry terminal security management.

[0056] This application targets massive numbers of terminals and resource-constrained terminals in typical power business scenarios such as next-generation dispatch control, distribution automation, electricity consumption information collection, and new power load management. It employs device fingerprint-based identity authentication to achieve secure authentication and full lifecycle management of power hardware and software. Figure 2 The diagram shown is another schematic of the adaptive security authentication method for power terminals in this application. The following steps can also be used: S201, Terminal Identity Generation and Registration.

[0057] (1) When a terminal to be connected to the network submits a registration application, it can use fingerprint management tools to collect its static attribute information, dynamic behavior data and contextual environment information, generate a device fingerprint that can uniquely identify its identity and security status based on multimodal information, and embed a security chip or UKey to ensure that it is not easily tampered with.

[0058] This embodiment takes the scenario of power distribution automation terminal access as an example. First, when the power distribution automation terminal registers, data from the power distribution automation terminal is collected from the following three dimensions, as shown in Table 1: Table 1. Examples of Registration Information for Distribution Automation Terminals

[0059] Then, according to the device fingerprint generation template, based on the obtained terminal information, an initial device fingerprint is generated using feature selection and hashing algorithms (e.g., SM3), and embedded into the ROM of the security chip (e.g., SC1041 security chip).

[0060] (2) If the terminal is successfully registered, its device fingerprint and various collected information are securely stored and encrypted together with the chip PUF fingerprint in the fingerprint database.

[0061] (3) If the terminal registration information changes, a combination of active and passive monitoring should be used to monitor the changes. If the fingerprint generation elements change, the terminal is at risk of intrusion or forgery, and services should be stopped to that terminal. The authenticity of its identity should be further verified. When the operating system is upgraded or the security status changes, the fingerprint can be regenerated using the device fingerprint generation algorithm based on the collected information and stored in the chip's secure area. Simultaneously, the initial device fingerprint will always be retained as an identity backup.

[0062] (4) If the terminal is offline or abandoned, cancel the terminal.

[0063] S202, Terminal Access Security Authentication Application.

[0064] (1) A single or batch of terminals submit an access authentication application and provide their own trusted credentials. In this embodiment, the device fingerprint, static attribute information, behavioral characteristics, business context, etc. are required. The system verifies the matching of static attribute information, detects that the dynamic behavior is not abnormal, and allows access only after the business context is reviewed and approved to ensure compliance, thereby preventing illegal devices from accessing and intruding.

[0065] (2) If the terminal is accessing for the first time, the system collects its multidimensional information (fingerprint generation element information) and compares it with the registration information. If they match, the application can be approved.

[0066] (3) If the terminal is not accessing for the first time, and it needs to re-access and authenticate due to changes in the terminal environment or upgrades in terminal capabilities, then proceed to step (3) in S201, update the terminal identity identifier, and use the new identifier for security authentication (step (1) in S202).

[0067] S203, strong authentication and authorization reduce the threat surface.

[0068] (1) When accessing a large language model, the large language model can be made to undergo strict authentication verification before performing tasks. By using short access tokens or one-time tokens, the authorization can be made more time-sensitive and traceable.

[0069] This embodiment describes the use of short-term tokens when calling a large language model to generate an access authentication policy for a distribution automation terminal. The generated instance is:

[0070] In practical applications, this can be further verified. The validity of the validation result is verified, and access to the large language model is granted.

[0071] When the large language model calls RAG, it obtains access control resources through the effective time period mode and performs enhanced authentication through environment attributes (running environment, geographical location, etc.).

[0072] This embodiment provides an example of enhanced authentication when the large language model calls RAG to generate an access authentication policy for a distribution automation terminal: Will Bind it to the GPS of its deployment terminal, verify its operating environment, such as the consistency between the Docker container hash and the whitelist, and grant it data resource access permissions within the valid time period through the backend.

[0073] S204, Recommended initialization of endpoint security authentication policy.

[0074] (1) Upon receiving the application, the administrator can describe the security authentication requirements through two methods: natural language input and document upload (including business scenario information such as business type, application area, and access location). Combining the dynamic and static information of the terminal itself, the administrator can further extract information such as the business scenario information, authentication strength, security requirements, and time requirements for access authentication using a large language model. The multimodal input parsing submodule is called to generate a key constraint triple <business scenario, terminal capability, security objective>.

[0075] (1.1) Design a user requirement description template, and users can input or select requirements using natural language based on the template.

[0076] This embodiment provides an example of a requirement description template, as shown in Table 2: Table 2

[0077] (2) Initially construct key constraint triples, process natural language input based on large language model, and use fine-tuning to perform coarse text category classification. The coarse classification is divided into three categories: business scenario (scenario category -> sub-scenario), terminal capability, and security goal.

[0078] This embodiment provides a specific example: This process employs keyword matching, table parsing, and machine learning to extract information such as scenario name, attributes, geographical location, and scale. Utilizing a large language model, it extracts key information such as terminal parameters and performance from technical and design documents to construct a terminal capability map. Terms positioning and regular expression matching are used to clarify security objectives such as threat level and compliance requirements. Finally, it generates key constraint triples <business scenario, terminal capability, security objective>. To accommodate various data types, including unstructured data (text, etc.) and structured data (graphs, documents, etc.), the generated key constraint triples are reconstructed. This involves converting queries to another query language to access alternative data sources; common methods include text-to-SQL or text-to-Cypher. The specific implementation method is as follows: SceneFeatureVector=BiLSTM([e_system_type;e_device_type; e_operation_ model]) Among them, e_system_type represents the business system type, e_device_type represents the device type, and e_operation_model represents the operation mode (single point addition or batch access).

[0079] (2) The key constraint triplet can be extended using the modular tool FlashRAG with RAG technology. It contains 13 components and 12 RAG algorithms. Based on the implementation of scenario extension retrieval, capability verification retrieval and security target enhancement, the key constraint triplet is extended. Then, from the existing security authentication policy library, appropriate security access authentication policies that meet the dynamic security requirements of the terminals are selected and recommended for the terminals that need to be authenticated in batches.

[0080] (2.1) This embodiment provides an example of using RAG technology to extend critical constraint triples: The first step in the RAG process is retrieval: Employing a multi-strategy retrieval collaborative mechanism and intelligent retrieval optimization mechanism, information relevant to the problem is retrieved from a pre-established knowledge base to expand the key constraint triples, providing useful contextual information and knowledge support for the subsequent generation process. Specifically: The collaborative mechanism of multi-strategy retrieval: combining fuzzy character matching and semantic similarity matching to achieve entity linking; calculating the shortest path based on full path search to achieve path retrieval; and solving complex problems such as statistical analysis, aggregation operations, or complex logical judgments based on scoring-assisted human thinking simulation to achieve graph query retrieval.

[0081] To standardize the measurement of the matching degree between queries and target entity / path / graph information, a comprehensive similarity formula is introduced:

[0082] Here, α represents the character matching weight coefficient (ranging from 0 to 1), which controls the relative importance of character matching and semantic matching. char_match_rate represents the character matching rate, used to indicate the degree of exact keyword matching (ranging from 0 to 1). Represents the query vector With the target vector Cosine similarity reflects the degree of semantic closeness.

[0083] Then, α is dynamically adjusted based on the results of entity linking, path retrieval, and graph query, and finally, based on the results of entity linking, path retrieval, and graph query.

[0084] The intelligent retrieval optimization mechanism involves expanding the original retrieval based on scenarios, terminals, and security targets into diverse retrieval branches using a large model. Then, it employs Reciprocal Rank Fusion (RRF) technology with dynamic weight allocation and weighted integration based on the weighted values ​​of different labels generated from multiple branches. This achieves a comprehensive selection of the final output, broadening the retrieval scope or increasing diversity. This can be implemented using the LangChain framework.

[0085] The calculation method is as follows:

[0086] in, For the key constraint triple field to be expanded, To retrieve the number of branches, for exist The ranking in This is the smoothing constant.

[0087] The second step in the RAG process is enhancement: Power-related knowledge, such as standard clauses, threat intelligence, and historical scenarios, is incorporated into the RAG through enhancement. Key constraint triples are compressed and filtered, then used as contextual input to the generative model (i.e., the large language model). This enhances the generation process of the large language model, improving subsequent authentication policy recommendation and generation capabilities, resulting in richer, more accurate, and more user-relevant security authentication policies. A noise filtering mechanism is employed to effectively avoid noise and / or contradictions affecting the final generated results.

[0088] The compression weight is calculated based on a weighted fusion of three dimensions: compliance importance, risk urgency, and business priority, as shown in the following formula: Compression weight = α • Compliance importance + β • Risk urgency + γ • Business priority Where α is the standard citation frequency × timeliness coefficient. β is the CVSS score × historical event frequency. γ is the business scenario weight × device criticality.

[0089] Based on the compression weight score, a pre-set threshold is used to select a compression strategy, including retaining all fields, simplifying non-core fields, and retaining only key fields. Noise is filtered based on metrics such as relevance and confidence, and a contradiction coefficient is defined using the following formula:

[0090] The conflict index includes detecting logical contradictions (e.g., security protocol computational overhead > CPU limit), identifying resource conflicts (e.g., CPU limit), and discovering standard conflicts (e.g., differences in requirements for the same parameter across different standards). The total attribute count includes business scenario attributes, terminal capability attributes, and security target attributes. The exponential decay term is calculated based on the reliability of the data source, with a confidence level (0-1). A decay coefficient of 0.5 is used to control the sensitivity to contradictions.

[0091] (2.2) Prioritize the use of the extended triplet retrieval knowledge base to select and recommend appropriate security access authentication strategies that meet the dynamic security requirements of terminals for batch security authentication. This step is applicable to resource-constrained scenarios.

[0092] This embodiment provides an example of multi-dimensional decision-making based on a policy execution matrix: using business scenarios, terminal capabilities, and security objectives as three-dimensional coordinate axes, and achieving precise policy matching through a weight calculation engine.

[0093] The strategy execution matrix is ​​as follows:

[0094] The business scenario weight represents the importance of the scenario. The terminal capability score is: ∑(actual capability value / baseline value) × weight. The security target level is: *Compliance requirements + (1- *CVSS score.

[0095] Finally, a security authentication strategy is recommended based on the strategy recommendation scoring formula, as follows:

[0096] (3) If there is no existing security authentication strategy, a new strategy is generated by combining extended triples and LLM.

[0097] By leveraging a large language model and knowledge of the power industry, and selecting an appropriate model, this approach employs LoRA parameter fine-tuning and other domain-specific fine-tuning techniques. A knowledge-guided scheduling method is used, utilizing knowledge graphs to extract problem-related information and constructing a reasoning chain composed of logically connected nodes, each containing key information in the problem-solving process. Based on the information at each node in this reasoning chain, the knowledge graph guides information retrieval and subsequent reasoning at each step, improving both efficiency and accuracy in problem-solving and providing clearer and more understandable explanations.

[0098] This embodiment provides an example of selecting a security authentication strategy under multiple constraints, which can be expressed by the following multi-objective optimization formula for power security authentication strategy:

[0099] in, This is a policy parameter vector, including key length, authentication rounds, signature algorithm, etc. This represents the protocol delay function, and an example of its calculation is as follows: =2.5×(key length)+50×(authentication rounds))(ms. The calculation example for the security risk function is as follows: . and These are all weighting coefficients, which can be dynamically adjusted according to the scenario. Let be the resource constraint matrix, and be the parameter's resource consumption coefficient. For resource constraint vectors, such as [CPU utilization ≤ 30%, memory ≤ 50MB, bandwidth ≤ 10Mbps].

[0100] The specific process can be as follows: Initialize based on the business's sensitivity to latency. Initialize based on the level of security required by the business. Delay function Embedded device communication characteristics, risk function By integrating power threat models and calculating other core parameters, a multi-objective optimization function for power security authentication strategies is constructed. Resource constraint modeling is performed, and appropriate solvers, such as gradient descent and genetic algorithms, are selected to dynamically adjust strategy parameters. According to a pre-set template, a security authentication strategy is output in real time, including necessary elements such as strategy summary (applicable objects, strategy ID, etc.), technical solutions (authentication methods, authentication protocols, protocol parameters, etc.), decision-making basis (security design, performance balance, compliance, etc.), and implementation guidelines (preconditions, deployment process, emergency plans).

[0101] S205, Endpoint Security Authentication Simulation Test and Policy Audit.

[0102] (1) Establish an automated policy testing sandbox, run the generated security authentication policy in an isolated environment, and test the performance and security of the terminal executing the security authentication policy.

[0103] This embodiment provides a feasible example of a terminal security authentication policy auditing and simulation testing method, including evaluating the performance of the terminal running policy in a simulated environment, and assessing the security of each stage of terminal access, policy transmission, and policy execution.

[0104] (1.1) Simulate the terminal operating environment, conduct resource consumption tests, establish a performance quantification model, and evaluate the terminal's performance when executing security authentication policies, covering system performance-related factors. The formula is as follows:

[0105] in, These are the weights of each factor, and they satisfy the following conditions: + + + + + =1. As a time efficiency factor, This represents the actual latency required for the task. This represents the maximum permissible response time. This is the memory utilization factor. This represents the available memory capacity. This represents the total memory capacity. This is the time stability factor. This refers to the range of fluctuations in response time. This is the time stability threshold. This is the CPU utilization factor. This represents the actual CPU utilization. This is the maximum allowed CPU utilization. This represents the task success rate, with a value ranging from 0 to 1. This is the bandwidth utilization factor. This represents the actual data throughput. The minimum requirement is accompanied by a lower requirement.

[0106] (1.2) The security is evaluated from two aspects: the vulnerability exposure of the three links of terminal access, policy transmission and policy execution, and the anti-attack capability.

[0107] First, the security of the policy enforcement environment is assessed, namely, endpoint security, and vulnerability exposure surface assessment metrics are defined. Based on the general scoring system CVSS, power scenario correction parameters are added:

[0108] in, To set the incremental value based on the impact type of the power business, the impact type and incremental value can be set as follows: SCADA control command tampering -> causing power outage (+2), power consumption data theft -> data leakage (+1), equipment data acquisition delay -> service degradation (+0.5). The power impact coefficient is calculated by multiplying the vulnerability type weight by the device role coefficient. Statistics show that the vulnerabilities exploited in attacks on power terminals are typically protocol vulnerabilities, firmware backdoors, authentication flaws, and data injection. Based on their location and importance within the business scenario, power terminals can be categorized as: data collection, monitoring, and management. This represents the vulnerability's timeliness coefficient, which is the coefficient of impact of the vulnerability's survival time on the risk. It is the number of days the vulnerability has been exposed. It is the decay constant of the vulnerability. This represents the maturity of the attack methods / tools. For example: There is a disclosed Proof of Concept (POC) and a mature tool (+1), there is a disclosed POC but no mature tool (+0.7), and there is neither a disclosed POC nor a mature tool (+0.4).

[0109] Then, the security of the security authentication policy distribution and execution was tested and evaluated. Typical attack types in the transmission protocol and terminal operating environment were identified, and power-specific attack vectors (such as man-in-the-middle attacks, identity forgery attacks, password cracking, and protocol vulnerability exploitation) were integrated. Simulated attacks were conducted to test the anti-attack capability of the security policy. The anti-attack capability index SecurityScore was defined as follows: SecurityScore = 0.7 × AttackCoverage + 0.3 × DetectTime Among them, attack coverage metrics for:

[0110] Finally, a simulation test report is generated, including basic test information (object, environment, tools, etc.), as well as the test items and results in (1.1) and (1.2) of step S205 (1).

[0111] (2) A multi-level review mechanism is adopted, and automatic review, manual review, key review and other steps are carried out in a targeted manner. This embodiment provides a feasible example of a multi-level review mechanism.

[0112] (2.1) First, the machine interprets the simulation test report and automatically reviews the simulation test results. If the simulation test fails, it returns to step S204 and uses a semantic-machine bidirectional conversion mechanism to convert the reasons for failure into constraints. This embodiment provides a specific example of a failure reason: performance does not meet requirements, there is a security vulnerability, or the deployment environment is incompatible, and a security authentication policy is regenerated accordingly.

[0113] (2.2) If the simulation test passes, then administrator review is required (especially for high-risk strategies, core equipment strategies, and strategies generated for the first time). If the administrator review fails, return to step S204, and use the administrator's acceptance / modification decision to fine-tune the large language model, employing the DPO loss function. The definition is as follows:

[0114] in, The strategy model is to be optimized. The reference policy model is the pre-trained model before fine-tuning. The policy selected for the administrator. This is a strategy for administrators to veto. The penalty coefficient for strategy deviation can be dynamically adjusted. This is the Sigmoid function.

[0115] By using the DPO loss function, the reward model training is bypassed directly, thereby optimizing the policy generation model, regenerating the security authentication policy, and executing step S205.

[0116] (2.3) After manual review and approval, standardized API services can be provided, supporting secure integration with business platforms such as IoT management platforms and situational awareness systems. A two-way authentication mechanism is used to ensure the legitimacy of the calls. The output format is standardized (JSON) for easy integration into automated deployment processes.

[0117] S206, Endpoint security authentication policies are continuously optimized.

[0118] (1) Automatically distribute terminal security authentication policies and continuously monitor the terminal for security. Construct a trusted benchmark value based on static and dynamic metrics, and verify the trusted benchmark value in real time to ensure the terminal remains trustworthy. This invention provides a method for constructing a trusted benchmark value, as shown in the following formula:

[0119] in, and You can refer to the Chinese invention patent application with application number CN202311703534.6. and These are all weighting coefficients, which are dynamically adjusted based on the administrator's security score.

[0120] When safety When the value is less than the preset baseline, the cause of the change in the trust metric is determined, and different security authentication policy update mechanisms are triggered accordingly.

[0121] (2) When the terminal is detected to be actively triggered by the following terminal security authentication policy update and optimization scenario, the terminal goes offline, jumps to step (3) in step S201 to update the verification information, and continues to execute the subsequent steps.

[0122] This embodiment provides some examples of proactively triggered scenarios: proactive business scenario reconstruction, proactive terminal capability upgrade, dynamic adjustment of security objectives, network architecture reconstruction, and key system rotation, as shown in Table 3.

[0123] The corresponding action is executed by driving the policy update mechanism through the decision matrix, and then the process jumps to step S204 to perform a full policy update or parameter fine-tuning as needed.

[0124] Table 3. Decision Matrix-Driven Strategy Update Table for Actively Triggered Scenarios

[0125] (3) When a passive scenario that triggers adaptive authentication policy adjustment is detected, the terminal goes offline and the cause of the terminal abnormality is investigated. If the abnormality is resolved, the process jumps to step (3) of S201 to update the verification information and continues to execute subsequent steps; otherwise, the terminal is blocked.

[0126] This embodiment provides some passively triggered scenarios: business scenario migration, terminal capability fluctuation, security situation deterioration, and policy execution anomaly, as shown in Table 4.

[0127] The corresponding action is executed by driving the policy update mechanism through the decision matrix, and then the process jumps to step S204 to perform a full policy update or parameter fine-tuning as needed.

[0128] Table 4. Decision Matrix-Driven Strategy Update Table in Passively Triggered Scenarios

[0129] Meanwhile, for two special scenarios, attack and defense analysis and emergency authentication logic are added based on threat intelligence.

[0130] Network attack scenario: Identify network attacks by matching attack features, forcibly isolate high-risk terminals, and if the threat is resolved, adjust the security authentication policy weight to enhance authentication strength and terminal security monitoring.

[0131] Post-disaster recovery scenario optimization: By simplifying the authentication process, adopting a lightweight authentication protocol, and relaxing authentication latency requirements, critical business operations can be restored quickly.

[0132] (4) After the security authentication strategy is implemented, its effectiveness is evaluated. If it meets the standard, the weights are fine-tuned and the parameters are updated; if it does not meet the standard, the security authentication strategy is regenerated. By calculating the actual effect and the expected effect, the dynamic optimization of the strategy allocation weight matrix is ​​achieved.

[0133] The model quantifies the effectiveness of the strategy in real time through dynamic evaluation. It integrates three core indicators: authentication success rate, performance speedup ratio, and security risk index. The calculation formula is as follows:

[0134] in, To improve the success rate of authentication and ensure the reliability of security authentication strategies. To improve performance and enhance the effectiveness of authentication policy execution. It is a safety risk index that integrates CVSS scores and quantitative scores of behavioral abnormalities.

[0135] Finally, based on Score closed-loop decision logic: When When the threshold is reached, it is marked as an efficient strategy, automatically stored in the knowledge base template, and its RAG retrieval priority is increased; when When the threshold is reached, analyze the triggering cause (performance bottleneck / security flaw / compatibility issue), generate constraints (such as "disable two-factor authentication when latency > 200ms"), proceed to step S204 to regenerate the security authentication policy, and continue to execute subsequent steps.

[0136] (5) By using strategy version tracing and audit tracking technology, record each strategy change, including key fields such as operator, reason for change, and performance score, to meet the audit requirements of power grid security level 2.0 and realize full-track visualization and traceability of strategy iteration.

[0137] This application addresses the massive terminal access scenario in new power systems, involving technologies such as multimodal device fingerprint generation and full lifecycle management, device fingerprint-based security authentication, and adaptive recommendation and optimization of security authentication strategies driven by large language models. It designs an adaptive security authentication system for power business scenarios, deeply integrating large language models with power knowledge graphs and RAG retrieval enhancement technology. A scenario-adaptive intelligent recommendation method for security authentication strategies is designed to achieve scenario-based real-time optimization of authentication strength and latency requirements. By integrating static features, dynamic behaviors, and business context of software and hardware, a fingerprint uniquely identifying the device's identity and trusted status is created, and secure access authentication is performed based on this fingerprint, achieving trusted identity management throughout the terminal's lifecycle. Simultaneously, a security monitoring mechanism is established across the entire access-transmission-execution link to dynamically identify abnormal states of the terminal itself and throughout its entire operational lifecycle, overcoming the management rigidity of the PKI system and ultimately meeting the requirements for real-time performance, security, and business flexibility.

[0138] Corresponding to the above method, this application designs a power terminal end-to-end trusted authentication system that integrates a large language model, which may include the following modules: (1) Power knowledge base construction and real-time enhancement module.

[0139] This module forms the foundation for customized solutions for power scenarios. It collects and analyzes multi-source heterogeneous data, establishes a power-specific knowledge graph, and constructs a structured power security knowledge base through entity extraction, relationship building, and dynamic update mechanisms. This base serves as the decision support center for generating security authentication strategies. Specifically, it may include: Data Acquisition Submodule: Utilizes various active and passive acquisition technologies to collect multiple types of data from different levels, including regulations / standards, technical manuals / white papers, security threat models for the general / power industry, CVE / CWE, etc.

[0140] The power entity and relationship extraction submodule identifies power entities based on a pre-trained language model and establishes an entity relationship network. It also builds and dynamically optimizes various templates based on actual business and security requirements, including security authentication requirement description templates, security authentication strategy recommendation templates, and simulation test report templates.

[0141] The dynamic knowledge update submodule acquires new external data such as CVEs in real time / on a scheduled basis, as well as new data after the generation and execution of security authentication policies. It adaptively learns based on pre-trained models in the power field and combines manual adjustments to form a closed-loop reinforcement of knowledge.

[0142] The constraint generation and optimization submodule employs a semantic-machine bidirectional conversion mechanism to convert descriptions related to security authentication, such as terminal performance, cryptographic algorithms, and security authentication strategies, from various texts including extracted relations, user input requirements, and reports into symbolic representations that can be recognized by machines.

[0143] (2) Multimodal fingerprint generation and dynamic identity management module (which can be provided by the device fingerprint management tool, such as the Chinese invention patent application with application number CN202311703534.6).

[0144] This module constructs unique identifiers for power system hardware and software. By integrating static characteristics, dynamic behavior patterns, and business scenario context, it generates an immutable device fingerprint that uniquely identifies the device and its security status. When the terminal environment changes or its capabilities are upgraded (which can be provided by the terminal-side component of the device fingerprint management tool or other components with terminal security status monitoring functions), the system automatically triggers identity re-authentication, achieving dynamic identity management throughout the entire lifecycle. This module provides a trusted identity foundation for the entire system, ensuring the accurate execution of subsequent authentication policies.

[0145] (3) Multi-dimensional security authentication module.

[0146] This module establishes a unified authentication framework for multiple entities, covering five types of entities: terminal devices, business systems, Large Language Models (LLMs), API interfaces, and administrators, achieving trusted identity verification across the entire domain. This module achieves adaptive authentication through dynamic trusted credentials and knowledge-driven approaches. Building upon identity authentication for Large Language Models (LLMs) and API interfaces, it continuously and flexibly authenticates key entities by invoking the LLM model, meeting the security authentication needs of different scenarios.

[0147] (4) The reasoning module that integrates large language model and knowledge retrieval (hereinafter referred to as LLM reasoning module).

[0148] This module generates lightweight authentication policies in real time based on a large language model, meeting the real-time and security requirements of different business scenarios. It features both automated and manual input reasoning capabilities. It supports the uploading of natural language authentication requirement descriptions and structured documents. This module provides support for deep natural language parsing, security policy reasoning generation, and security status assessment. Specifically, it may include: Multimodal input parsing submodule: It can perform deep parsing of natural language input or uploaded structured documents, extract key information for generating authentication policies, and generate key constraint triples <business scenario, terminal capabilities, security objectives>.

[0149] The knowledge-driven dynamic reasoning submodule introduces real-time threat intelligence based on key constraint triples and the power safety knowledge base, selects an appropriate LLM model (e.g., GPT-4, Claude-3, etc.), fine-tunes BERT or its derivative models, uses CoT (mind chain) hint technology to improve the clarity of reasoning logic, and iteratively generates a draft security authentication strategy.

[0150] (5) Strategy review and simulation test module.

[0151] This module utilizes an automated testing sandbox and a multi-level auditing mechanism to pre-simulate policy execution effects in an isolated environment. It assesses the vulnerability exposure surface and attack resistance of the policy execution environment and employs a dual auditing mechanism combining machine and human review to enhance the effectiveness of security authentication policies, ensuring that policies meet performance, security, and compliance requirements before deployment. This module acts as a quality inspector for security authentication policies.

[0152] This application integrates multimodal fingerprinting technology (static hardware features, dynamic behavioral patterns, and business scenario context) to generate an immutable device fingerprint that uniquely identifies the device's identity and security status. This achieves unique terminal identity identification and dynamic closed-loop management, effectively solving the problems of traditional static fingerprints being easily counterfeited and difficult to track terminal status changes. When the terminal environment changes or its capabilities are upgraded, the system automatically triggers a re-authentication mechanism to ensure that the identity trustworthiness continues to meet the needs of power business scenarios, effectively addressing the issues of traditional static fingerprints being easily counterfeited and difficult to represent multimodal terminal features. Furthermore, based on the deep coupling of large language models and RAG technology, the system achieves intelligent generation and dynamic optimization of security authentication strategies. By parsing natural language requirements to generate key constraint triples (business scenario, terminal capability, and security objective), and utilizing Retrieval Augmentation (RAG) technology to retrieve information from the power knowledge base in real time, the triples are expanded and noise is compressed. Then, a multi-objective optimization function is used to dynamically generate authentication strategies, optimizing authentication strength and latency requirements in real time. This improves the AI-driven dynamic security authentication strategy generation capability across multiple business scenarios. It combines real-time retrieval of expanded information from the power knowledge graph with a multi-objective optimization algorithm to dynamically balance authentication strength and latency requirements. This method supports personalized strategy adaptation for typical power scenarios such as distribution automation and load management, significantly reducing authentication overhead for resource-constrained terminals while ensuring compliance. Finally, a full-link security monitoring mechanism of "access-transmission-execution" is established. Strategy risks are pre-tested through a sandbox simulation test, and the reliability of the strategy is ensured by a combination of machine scoring and manual review. During terminal operation, trusted benchmark values ​​are continuously verified, abnormal states are dynamically identified, and strategies are updated in real time based on a decision matrix. This mechanism effectively reduces the vulnerability exposure surface of terminals and improves the response speed to threats such as protocol attacks and identity forgery.

[0153] like Figure 3 The diagram shown is a schematic of an adaptive security authentication system for power terminals according to this application, which may include: The identity module is used to generate a device fingerprint for the terminal to be connected to the network based on its current multimodal information, and to store the current multimodal information and the device fingerprint. The access authentication module is used to authenticate the multimodal information and device fingerprint of the terminal to be connected to the network. The enhanced verification module is used to enable the terminal to be connected to the network to initiate an access request to the large language model, to perform authentication and verification of the terminal to be connected to the network, and to allocate access control resources to the large language model within a preset time period when the large language model needs to call generative retrieval enhancement, and to perform enhanced verification in combination with the current environmental attributes of the terminal to be connected to the network. The security authentication module is used to combine the current multimodal information of the terminal to be connected to the network to obtain the basis for the authentication strategy of the terminal to be connected to the network, and then combine the basis for the authentication strategy of the terminal to be connected to the network, the large language model and generative retrieval enhancement to generate the security authentication strategy of the terminal to be connected to the network. The verification module is used to perform simulation tests and multi-level audits on the security authentication policy. If the simulation test and multi-level audit are passed, the final security authentication policy is obtained. Otherwise, the reason for failure is used as a new constraint to regenerate the security authentication policy of the terminal to be connected to the network until the final security authentication policy is obtained. The deployment module is used to deploy the final security authentication policy to the terminal to be connected to the network and to implement continuous security monitoring.

[0154] It should be noted that, in the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For instance, the division of each module is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another device, or some features may be ignored or not executed. The modules described as separate components may or may not be physically separated. The components shown as modules may be one or more physical units, that is, they may be located in one place or distributed in multiple different places. Some or all of the modules can be selected to achieve the purpose of the solution in this embodiment according to actual needs.

[0155] Furthermore, in the various embodiments of the present invention, the modules can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The integrated unit described above can be implemented in hardware or as a software functional unit.

[0156] This application also provides an electronic device, which may include one or more processors, memory and communication interfaces.

[0157] The memory, communication interface, and processor are coupled together. For example, the memory, communication interface, and processor can be coupled together via a bus.

[0158] The communication interface is used for data transmission with other devices. The memory stores computer program code. This computer program code includes computer instructions, which, when executed by the processor, cause the electronic device to perform the steps of the aforementioned power terminal adaptive security authentication method.

[0159] The processor can be a processor or controller, such as a Central Processing Unit (CPU), a general-purpose processor, a Digital Signal Processor (DSP), an Application-Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. It can implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with this disclosure. The processor can also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc. The processor can be used to support an electronic device in performing the method steps provided in the above embodiments.

[0160] The bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. These buses can be categorized as address buses, data buses, control buses, etc.

[0161] This application provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the steps of the above-described adaptive security authentication method for power terminals.

[0162] The computer-readable storage media involved in this application include random access memory (RAM), memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage media known in the art.

[0163] The above are merely preferred embodiments of this application and are not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A power terminal adaptive security authentication method, characterized in that, include: Based on the current multimodal information of the terminal to be connected to the network, generate the device fingerprint of the terminal to be connected to the network, and store the current multimodal information and the device fingerprint; Access authentication is performed using the multimodal information and device fingerprint of the terminal to be connected to the network; The system enables the terminal waiting to join the network to initiate an access request to the large language model, performs authentication and verification on the terminal waiting to join the network, and allocates access control resources to the large language model within a preset time period when the large language model needs to call generative retrieval enhancement, and performs enhanced verification in combination with the current environmental attributes of the terminal waiting to join the network. Based on the security authentication policy that matches the terminal to be connected to the network from the existing security authentication policy library; Alternatively, by combining the current multimodal information of the terminal to be connected to the network, the large language model, and generative retrieval enhancements, a security authentication strategy for the terminal to be connected to the network can be generated. The security authentication policy is simulated and audited at multiple levels. If the simulation test and multi-level audit are passed, the final security authentication policy is obtained. Otherwise, the reason for failure is used as a new constraint to regenerate the security authentication policy of the terminal to be connected to the network until the final security authentication policy is obtained. The final security authentication policy will be deployed to the terminal to be connected to the network, and continuous security monitoring will be implemented.

2. The adaptive security authentication method for power terminals according to claim 1, characterized in that, The implementation of continuous security monitoring includes: Trustworthy benchmarks are constructed based on static and dynamic metrics, and the trustworthy benchmarks are verified in real time.

3. The adaptive security authentication method for power terminals according to claim 1, characterized in that, Following the implementation of continuous security monitoring, the following is also included: When updating the final security authentication policy according to business needs, the terminal is taken offline, and the device fingerprint of the terminal to be connected to the network is regenerated based on the current multimodal information of the terminal to be connected to the network. Alternatively, when a passive scenario with adaptive security authentication policy is triggered, the terminal is taken offline and the cause of the terminal abnormality is investigated. After the cause of the abnormality is ruled out, the device fingerprint of the terminal to be connected to the network is regenerated based on the current multimodal information of the terminal to be connected to the network.

4. The adaptive security authentication method for power terminals according to claim 1, characterized in that, Following the implementation of continuous security monitoring, the following is also included: A performance evaluation is conducted. If the performance evaluation results meet the preset requirements, the weight parameters in the final security authentication strategy are adjusted; otherwise, the terminal's security authentication strategy is regenerated.

5. The adaptive security authentication method for power terminals according to any one of claims 1 to 4, characterized in that, Following the implementation of continuous security monitoring, the following is also included: By tracing the version of security authentication policies and conducting audit trails, records of changes to security authentication policies are preserved.

6. The adaptive security authentication method for power terminals according to claim 1, characterized in that, The method for access authentication of the multimodal information and device fingerprint of the terminal to be connected to the network includes: If the terminal to be connected to the network is accessing the network for the first time, the multimodal information and device fingerprint of the terminal device to be connected to the network will be collected and compared with the preset registration information. If they match, the terminal to be connected to the network will be connected. If the terminal to be connected to the network is not accessing for the first time, after updating the multimodal information and device fingerprint, the terminal to be connected to the network will be treated as the first access terminal for access authentication.

7. The adaptive security authentication method for power terminals according to claim 1, characterized in that, The method for generating a security authentication policy for a terminal to be connected to the network includes: Based on the business scenario information of the terminal to be connected to the network, describe the security authentication requirements of the terminal to be connected to the network, and combine the current multimodal information of the terminal to be connected to the network, and use a large language model to obtain the basis for the authentication strategy of the terminal to be connected to the network. Based on the authentication strategy of the terminal to be connected to the network, generate key constraint triples; Generative retrieval enhancements are employed to expand key constraint triples; Based on the expanded key constraint triples, select the corresponding authentication strategy from the existing authentication strategy library; if there is no corresponding authentication strategy in the existing authentication strategy library, generate a new authentication strategy by combining the expanded key constraint triples and the large language model.

8. The adaptive security authentication method for power terminals according to claim 1, characterized in that, The method for simulating and multi-level auditing security authentication policies includes: Simulate the operating environment of the terminal to be connected to the network, conduct resource consumption tests, and establish a performance quantification model to evaluate the performance of the terminal when executing security authentication policies. A security assessment is conducted by combining the vulnerability exposure and anti-attack capabilities of the terminal to be connected to the network when executing the security authentication policy.

9. A power terminal adaptive security authentication system, characterized in that, include: The identity module is used to generate a device fingerprint for the terminal to be connected to the network based on its current multimodal information, and to store the current multimodal information and the device fingerprint. The access authentication module is used to authenticate the multimodal information and device fingerprint of the terminal to be connected to the network. The enhanced verification module is used to enable the terminal to be connected to the network to initiate an access request to the large language model, to perform authentication and verification of the terminal to be connected to the network, and to allocate access control resources to the large language model within a preset time period when the large language model needs to call generative retrieval enhancement, and to perform enhanced verification in combination with the current environmental attributes of the terminal to be connected to the network. The security authentication module is used to match the security authentication policy of the terminal to be connected to the network from the existing security authentication policy library. Alternatively, by combining the current multimodal information of the terminal to be connected to the network, the large language model, and generative retrieval enhancements, a security authentication strategy for the terminal to be connected to the network can be generated. The verification module is used to perform simulation tests and multi-level audits on the security authentication policy. If the simulation test and multi-level audit are passed, the final security authentication policy is obtained. Otherwise, the reason for failure is used as a new constraint to regenerate the security authentication policy of the terminal to be connected to the network until the final security authentication policy is obtained. The deployment module is used to deploy the final security authentication policy to the terminal to be connected to the network and to implement continuous security monitoring.

10. The adaptive security authentication system for power terminals according to claim 9, characterized in that, In the deployment module, the implementation of continuous security monitoring includes: Trustworthy benchmarks are constructed based on static and dynamic metrics, and the trustworthy benchmarks are verified in real time.

11. The adaptive security authentication system for power terminals according to claim 9, characterized in that, In the deployment module, after implementing continuous security monitoring, it also includes: When updating the final security authentication policy according to business needs, the terminal is taken offline, and the device fingerprint of the terminal to be connected to the network is regenerated based on the current multimodal information of the terminal to be connected to the network. Alternatively, when a passive scenario with adaptive security authentication policy is triggered, the terminal is taken offline and the cause of the terminal abnormality is investigated. After the cause of the abnormality is ruled out, the device fingerprint of the terminal to be connected to the network is regenerated based on the current multimodal information of the terminal to be connected to the network.

12. The power terminal adaptive security authentication system according to claim 9, characterized in that, In the deployment module, after implementing continuous security monitoring, it also includes: A performance evaluation is conducted. If the performance evaluation results meet the preset requirements, the weight parameters in the final security authentication strategy are adjusted; otherwise, the terminal's security authentication strategy is regenerated.

13. The power terminal adaptive security authentication system according to any one of claims 9 to 12, characterized in that, In the deployment module, after implementing continuous security monitoring, it also includes: By tracing the version of security authentication policies and conducting audit trails, records of changes to security authentication policies are preserved.

14. The power terminal adaptive security authentication system according to claim 9, characterized in that, In the access authentication module, the method for access authentication of the multimodal information and device fingerprint of the terminal to be connected to the network includes: If the terminal to be connected to the network is accessing the network for the first time, the multimodal information and device fingerprint of the terminal device to be connected to the network will be collected and compared with the preset registration information. If they match, the terminal to be connected to the network will be connected. If the terminal to be connected to the network is not accessing for the first time, after updating the multimodal information and device fingerprint, the terminal to be connected to the network will be treated as the first access terminal for access authentication.

15. The power terminal adaptive security authentication system according to claim 9, characterized in that, The method for generating a security authentication policy for a terminal to be connected to the network includes: Based on the business scenario information of the terminal to be connected to the network, describe the security authentication requirements of the terminal to be connected to the network, and combine the current multimodal information of the terminal to be connected to the network, and use a large language model to obtain the basis for the authentication strategy of the terminal to be connected to the network. Based on the authentication strategy of the terminal to be connected to the network, generate key constraint triples; Generative retrieval enhancements are employed to expand key constraint triples; Based on the expanded key constraint triples, select the corresponding authentication strategy from the existing authentication strategy library; if there is no corresponding authentication strategy in the existing authentication strategy library, generate a new authentication strategy by combining the expanded key constraint triples and the large language model.

16. The adaptive security authentication system for power terminals according to claim 9, characterized in that, In the verification module, the method for simulating and multi-level auditing the security authentication strategy includes: Simulate the operating environment of the terminal to be connected to the network, conduct resource consumption tests, and establish a performance quantification model to evaluate the performance of the terminal when executing security authentication policies. A security assessment is conducted by combining the vulnerability exposure and anti-attack capabilities of the terminal to be connected to the network when executing the security authentication policy.

17. An electronic device, characterized in that, include: A memory, one or more processors; the memory is coupled to the processors; wherein the memory stores computer program code, the computer program code including computer instructions, and when the computer instructions are executed by the processor, the electronic device performs the steps of the power terminal adaptive security authentication method as described in any one of claims 1-8.

18. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the power terminal adaptive security authentication method as described in any one of claims 1-8.

Images