Wireless terminal security control method and system

Abstract

The invention discloses a wireless terminal security management and control method and system, and relates to the technical field of power system communication security. The method comprises the following steps: in a communication connection establishment stage, establishing a shared key through WAPI bidirectional authentication and post quantum key encapsulation, and initializing a physical layer waveform parameter synchronization mechanism; in the security situation assessment stage, collected equipment characteristics, near field communication and electromagnetic environment data are fused, quantitative analysis is performed through a neural network and an attack graph model, and a dynamic security threat level is obtained; in the security policy execution stage, the security policy and physical layer parameters are adaptively adjusted according to the threat level and the channel assessment result to form closed-loop management and control. According to the method, the problems of single protection means, response lag and lack of quantum safety capability of a traditional scheme in complex environments such as a new energy station are solved, and active, accurate and self-adaptive wireless terminal safety protection is realized.

Description

Technical Field

[0001] This application relates to the field of power system communication security technology, specifically a wireless terminal security management method and system; it is used in complex industrial wireless communication scenarios such as new energy power plants, by constructing a closed-loop dynamic management and control system of "authentication-evaluation-protection". Background Technology

[0002] With the increasing intelligence of new energy power plants, wireless terminals are being deployed more and more widely in power monitoring systems. New energy power plant environments are complex, characterized by variable electromagnetic interference, diverse terminal types, and high service reliability requirements. Existing wireless security solutions mostly focus on traditional identity authentication and communication encryption, which are insufficient to address the complex security threats arising from the interplay of complex electromagnetic environments and network attacks. Furthermore, traditional static security strategies cannot dynamically adjust based on the real-time security status of terminals and the communication environment, resulting in lagging protective measures and making it difficult to achieve precise and effective security control while ensuring business continuity.

[0003] Therefore, there is an urgent need for a more reliable wireless terminal communication security management technology;

[0004] In the prior art, Chinese Patent Publication No. CN115333729A discloses a quantum key distribution method and system for power terminals. The key distribution method includes a key distribution server encrypting a quantum key QKey using a distribution key, and simultaneously sending the encrypted quantum key QKey to power terminal A and power terminal B via 5G communication. Power terminals A and B receive the encrypted quantum key QKey sent by the key distribution server, decrypt the encrypted quantum key QKey using the same distribution key as the key distribution server, and obtain the quantum key QKey distributed by the key distribution server. Power terminals A and B communicate based on the quantum key QKey. The quantum key distribution method and system of this invention, for power terminals, distributes quantum keys based on a 5G wireless communication network, making quantum key distribution in power services more economical and faster. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to address the shortcomings of the prior art by disclosing a wireless terminal security management method and system, which solves the problems of single protection methods, slow response and lack of adaptive capability in traditional solutions when dealing with quantum computing threats, complex electromagnetic environments and dynamic network attacks.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a wireless terminal security management method and system, comprising: a communication connection establishment phase, a security situation assessment phase, and a security policy execution phase;

[0007] The communication connection establishment phase includes: the wireless terminal and the network access point performing two-way authentication based on WAPI certificates; after successful authentication, a one-time post-quantum key encapsulation is performed to establish a shared session key seed, and through a physical layer security enhancement mechanism, the wireless terminal and the network access point periodically and synchronously update communication waveform parameters based on the shared session key seed;

[0008] The security situation assessment phase includes: collecting device characteristic information, near-field communication data, and electromagnetic environment data of the operating frequency band of the wireless terminal; matching and analyzing the device characteristic information and near-field communication data with a preset vulnerability feature database to identify security vulnerabilities; and inputting the electromagnetic environment data into a pre-trained neural network model for analysis to obtain channel quality assessment results and interference type classification results; based on the identified security vulnerabilities, predefined asset importance, and the channel quality assessment results, joint analysis is performed using an attack graph model to calculate the comprehensive security threat level of the wireless terminal.

[0009] The security policy execution phase includes: the network access point dynamically generates a security policy based on the comprehensive security threat level, the channel quality assessment result, and the interference type classification result, and then sends the security policy to the wireless terminal;

[0010] The physical layer security enhancement mechanism is initialized during the communication connection establishment phase and remains operational during the secure communication session between the network access point and the wireless terminal. The update cycle of the communication waveform parameters is positively correlated with the overall security threat level.

[0011] Furthermore:

[0012] The one-time post-quantum key encapsulation includes:

[0013] The network access point uses the public key of the wireless terminal to encrypt the shared session key seed, generating key-encapsulated ciphertext;

[0014] The wireless terminal uses its private key to decrypt the key-encapsulated ciphertext and recover the shared session key seed.

[0015] Furthermore:

[0016] The process of generating the key-encapsulated ciphertext includes:

[0017] The network access point uses the public key of the wireless terminal to generate a random secret vector. The public key is a publicly available set of multivariate polynomials on a polynomial ring. ,

[0018] , To define in a finite field polynomial variables on, Is the coefficient in Multivariate polynomials on the surface , From a finite field The elements are randomly selected from the input; and the key encapsulation ciphertext is calculated. ,in , , For the shared key derived from the secret vector, , Derived function for key. This refers to the key information obtained after encoding the shared session key seed. For hash functions, Indicates the XOR operation;

[0019] The recovery process of the shared session key seed includes:

[0020] The wireless terminal uses its private key, which is trapdoor information corresponding to the public key, to... The random secret vector can be effectively recovered from the middle. ;calculate and through Recover the key information ; regarding the key information Decoding is performed to obtain the shared session key seed.

[0021] Furthermore:

[0022] The security policy execution phase also includes:

[0023] Continuously monitor the MAC layer timing traffic of the wireless terminal, extract the MAC layer frame interval time sequence and frame length sequence to form a device behavior sequence;

[0024] The device behavior sequence is extracted using a temporal convolutional network to obtain a fixed-dimensional device behavior feature vector.

[0025] Calculate the deviation between the device behavior feature vector and the pre-registered standard behavior template;

[0026] The deviation is compared with a dynamic threshold. If the deviation exceeds the dynamic threshold, the communication connection establishment phase or the wireless terminal network isolation operation is triggered. The dynamic threshold is determined based on the feature vector distribution statistics of the standard behavior template in the historical monitoring period.

[0027] Furthermore:

[0028] The process of obtaining the device behavior feature vector includes:

[0029] The frame interval time sequence and frame length sequence of the MAC layer are standardized to generate a standardized input sequence;

[0030] The input sequence is fed into the temporal convolutional network, which scans the input sequence through causal convolutional layers and dilated convolutional layers with increasing dilation coefficients to capture long-range dependencies in the device behavior sequence and outputs a high-level feature sequence.

[0031] The high-level feature sequence is compressed in the time dimension by the global pooling layer at the end of the temporal convolutional network, its global statistics are calculated, and the high-level feature sequence is aggregated into the device behavior feature vector.

[0032] Furthermore:

[0033] The communication waveform parameters include the roll-off factor of the baseband filter, the pilot pattern distribution used in OFDM modulation, and the dynamic range of the signal's transmit power.

[0034] Furthermore:

[0035] The step of inputting electromagnetic environment data into a pre-trained neural network model for analysis includes:

[0036] The raw electromagnetic environment data is filtered and normalized before preprocessing to generate model input data;

[0037] The input data of the model is input into the trained CNN neural network model, and the CNN neural network model outputs the interference type classification result corresponding to the current channel interference type and the channel quality assessment result corresponding to the channel quality score result.

[0038] Furthermore:

[0039] The joint analysis is performed using an attack graph model.

[0040] include:

[0041] The identified security vulnerabilities, the asset importance level of the wireless terminal, the available network resources, and the channel quality assessment results are used as nodes in the attack graph;

[0042] Using potential attack behaviors as edges connecting the nodes, an attack path is constructed from the initial vulnerability to critical assets;

[0043] Based on the impact of vulnerability exploitation difficulty, asset importance, and current channel quality on attack success rate, a weight value is calculated for each attack path.

[0044] The weight values ​​of all attack paths are divided into multiple consecutive intervals according to their numerical values. The interval containing the path with the largest numerical weight value is determined as the overall security threat level of the wireless terminal.

[0045] Furthermore:

[0046] The weight value is calculated using the following formula:

[0047] ;

[0048] in, This represents the weight value of a single attack path; This indicates the critical score of the terminal asset targeted by the attack path; This represents the base probability that the i-th vulnerability on the attack path is successfully exploited. The function representing the channel quality impact has the following inputs: The normalized value of the channel quality assessment result is output as a coefficient between [0,1].

[0049] A wireless terminal security management system, the system comprising:

[0050] The communication connection establishment module, located in the wireless terminal and the network access point, is configured to: perform bidirectional authentication between the wireless terminal and the network access point based on WAPI certificates; after successful authentication, perform a one-time post-quantum key encapsulation to establish a shared session key seed, and initialize the physical layer security enhancement mechanism so that the wireless terminal and the network access point periodically and synchronously update communication waveform parameters based on the shared session key seed;

[0051] The security situation assessment module, located in the network access point or a security server communicatively connected to the network access point, is configured to: collect device characteristic information, near-field communication data, and electromagnetic environment data of the operating frequency band of the wireless terminal; match and analyze the device characteristic information and near-field communication data with a preset vulnerability feature database to identify security vulnerabilities; simultaneously, input the electromagnetic environment data into a pre-trained neural network model for analysis to obtain channel quality assessment results and interference type classification results; and, based on the identified security vulnerabilities, predefined asset importance, and the channel quality assessment results, perform joint analysis through an attack graph model to calculate the comprehensive security threat level of the wireless terminal.

[0052] A security policy execution module, located at the network access point, is configured to: dynamically generate a security policy based on the comprehensive security threat level, the channel quality assessment result, and the interference type classification result, and then distribute the security policy to the wireless terminal.

[0053] The physical layer security enhancement mechanism, after initialization, continues to operate during the secure communication session between the network access point and the wireless terminal, and the update cycle of the communication waveform parameters is positively correlated with the overall security threat level.

[0054] Compared with the prior art, the present invention has the following advantages:

[0055] This invention, through its proposed wireless terminal security management method and system, achieves significant multi-faceted benefits by constructing a three-stage closed-loop dynamic management system encompassing communication connection establishment, security situation assessment, and security policy execution. First, the method constructs a future-oriented, multi-layered, integrated proactive security defense system. By deeply integrating anti-quantum key encapsulation with physical layer security enhancement mechanisms in the initial connection stage, it extends the protection dimension from the traditional network layer to the physical signal layer. Based on dynamic assessment results, it forms a closed-loop feedback loop, achieving a fundamental shift from passive response to risk-driven, adaptive protection, and establishing a defense-in-depth capability across the protocol stack. Second, the method achieves accurate, quantifiable, and dynamic perception of security threats in complex industrial environments. It innovatively incorporates electromagnetic environment data obtained from CNN intelligent analysis as a key variable into the attack graph quantification assessment model, accurately modeling the impact of channel conditions on the actual attack success rate. This ensures that the output comprehensive security threat level truly reflects the dynamic risks under specific operating conditions, solving the problems of inaccurate assessment and high false alarm rates in traditional solutions. Furthermore, this method successfully achieves an adaptive optimal balance between security strength, business efficiency, and resource consumption. By establishing a positive correlation mechanism between security policies (especially the physical layer parameter update cycle) and real-time threat levels, it realizes "on-demand supply" of protection strength, automatically strengthening defenses during high-risk periods and intelligently reducing overhead during low-risk periods. This ensures the continuity of core business while avoiding the rigidity and resource waste of traditional static strategies. Finally, this solution demonstrates high flexibility, scalability, and scenario adaptability. Its modular design supports the smooth evolution and flexible integration of post-quantum cryptography algorithms, evaluation architectures, and enhanced functions (such as predictive protection and operational auditing). It can also adapt to various terminals, from high-performance to resource-constrained, through simplified processes, providing a reliable, efficient, and future-oriented comprehensive security solution for complex industrial wireless communication scenarios such as new energy power plants. Attached Figure Description

[0056] Figure 1 A flowchart illustrating the wireless terminal security management method provided in an embodiment of the present invention;

[0057] Figure 2 This invention provides a physical layer parameter configuration table for different threat levels in its embodiments.

[0058] Figure 3 This is a schematic diagram of a four-layer architecture for security situation assessment provided in an embodiment of the present invention;

[0059] Figure 4 This is a flowchart of the MAC layer device behavior feature extraction and deviation determination process of the present invention;

[0060] Figure 5 This is a flowchart illustrating the interaction between modules in the wireless terminal security management system of the present invention.

[0061] Figure 6 This is a topology diagram of the application scenario of the present invention. Detailed Implementation

[0062] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present application. Secondly, in this document, the term "comprising" is intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements, but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0063] Example 1

[0064] This embodiment provides a wireless terminal security management method in the first aspect, such as... Figure 1 As shown, it includes the communication connection establishment phase, the security situation assessment phase, and the security policy execution phase, which are detailed below.

[0065] The communication connection establishment phase includes: the wireless terminal and the network access point performing two-way authentication based on WAPI certificates; after successful authentication, a one-time post-quantum key encapsulation is performed to establish a shared session key seed, and through a physical layer security enhancement mechanism, the wireless terminal and the network access point periodically and synchronously update communication waveform parameters based on the shared session key seed.

[0066] WAPI is a wireless LAN security standard. Two-way authentication refers to the mutual verification of identity between the terminal and the access point. The certificate used is issued by an authoritative CA institution in the power industry (such as the State Grid Electricity Certification Center). The certificate contains the unique identifier of the terminal / access point, public key and other information. The authentication process follows the identity authentication protocol in the WAPI standard to ensure the legitimacy of both parties accessing the network.

[0067] Post-quantum key encapsulation is an encryption technique that resists quantum computing attacks. Unlike traditional algorithms such as RSA and ECC, which are easily cracked by quantum computers, the shared session key seed is a 256-bit random string, generated by a cryptographically secure random number generator (such as the CTR_DRBG algorithm conforming to NISTSP800-90A), and used for subsequent physical layer parameter updates.

[0068] Physical layer security enhancement mechanisms refer to improving security at the signal transmission level by dynamically adjusting communication waveform parameters to make it difficult for eavesdroppers to detect stable signal characteristics.

[0069] In practical implementation, the update cycle for communication waveform parameters is initially set to a default value, and subsequently correlated with the overall security threat level; the higher the level, the more frequent the updates. Specific parameter configurations correspond to... Figure 2 ,like Figure 2 The table shown is a configuration table for physical layer communication waveform parameters under different comprehensive security threat levels. It clarifies the roll-off factor, pilot pattern distribution, dynamic range of signal transmission power, and parameter update cycle corresponding to low, medium, and high threat levels, respectively.

[0070] The security situation assessment phase includes: collecting device characteristic information, near-field communication data, and electromagnetic environment data of the operating frequency band of the wireless terminal;

[0071] The device's characteristic information and near-field communication data are matched and analyzed with a pre-set vulnerability feature database to identify security vulnerabilities. Electromagnetic environment data is then input into a pre-trained neural network model for analysis to obtain channel quality assessment results and interference type classification results.

[0072] Based on the identified security vulnerabilities, predefined asset importance, and channel quality assessment results, a joint analysis is performed using an attack graph model to calculate the overall security threat level of the wireless terminal.

[0073] In practice, equipment characteristic information may include terminal hardware model, firmware version, and operating system type, which can be obtained through active reporting by the terminal or device scanning function of the access point, and comply with the equipment management specifications of the power monitoring system.

[0074] Near-field communication data can be communication messages such as those from Bluetooth or ZigBee protocols, which are captured by the near-field signal acquisition module of the access point.

[0075] Electromagnetic environment data can be collected using an electromagnetic spectrum analyzer (such as Keysight N9040B, with a sampling rate ≥100MS / s and a frequency coverage of 2.4-5.8GHz), and includes parameters such as spectral power density and signal bandwidth.

[0076] The vulnerability signature database can include known vulnerabilities in power terminals (such as power monitoring terminal vulnerabilities collected by CNVD) and wireless protocol vulnerabilities (such as the KRACK vulnerability in 802.11). The BM algorithm is used for matching to achieve fast feature comparison.

[0077] The neural network model adopts a CNN architecture, and the training samples include common interference types of new energy power plants, such as narrowband interference and impulse interference, with a total of 1000+ samples. The generalization ability is ensured by 5-fold cross-validation.

[0078] Channel quality assessment results can be a score of 1-10 based on indicators such as signal-to-noise ratio and bit error rate.

[0079] The interference type classification results can be non-malicious, such as interference from industrial equipment, or malicious, such as interference from malicious jammers.

[0080] The predefined asset importance can be pre-set by the site security department, such as being divided into 3 levels according to business importance: high (control terminals, score 3), medium (monitoring terminals, score 2), and low (maintenance terminals, score 1).

[0081] An attack graph can be constructed using vulnerabilities, assets, and channel quality as nodes, and potential attack behaviors as edges, with the DFS algorithm used to build the attack path.

[0082] like Figure 3 As shown, this is a complete hierarchical architecture and data processing flowchart for security situation assessment. Figure 3 The diagram shows the four-layer architecture for security situation assessment, consisting of the data acquisition layer, data preprocessing layer, intelligent analysis layer, and threat quantification layer, clearly defining the core functions and data flow logic of each layer.

[0083] The security policy execution phase includes: the network access point dynamically generates security policies based on the comprehensive security threat level, channel quality assessment results, and interference type classification results, and then distributes the security policies to the wireless terminals.

[0084] In practice, security policies may include adjustments to encryption algorithms (AES-256 for high threats, AES-128 for low threats), channel switching recommendations, and terminal isolation commands. Security policies are issued via WAPI security control frames, the content of which is encrypted.

[0085] Secondly, when the interference type classification result is identified as malicious communication interference, a security policy is generated regardless of the overall security threat level, which includes activating the anti-interference communication mode and executing the WAPI communication channel switching command; when the interference type classification result is non-malicious background noise interference, a security policy is generated according to the overall security threat level: communication encryption rules are generated when the threat level is low, and access control rules are generated when the threat level is high.

[0086] In addition, the physical layer security enhancement mechanism is initialized during the communication connection establishment phase and continues to operate during the secure communication session between the network access point and the wireless terminal. The update cycle of the communication waveform parameters is positively correlated with the overall security threat level, such as 10 minutes for low threat level, 5 minutes for medium threat level, and 1 minute for high threat level.

[0087] The method in this embodiment is applicable to complex industrial wireless communication scenarios such as new energy power stations, and its application scenario topology is as follows: Figure 6 As shown, Figure 6 This is a topology diagram of the application scenario for the security management of wireless terminals in new energy power plants. It includes various wireless terminals such as wind turbine control terminals, photovoltaic inverter terminals, handheld maintenance terminals, and sensor terminals, as well as network and security equipment such as industrial-grade APs, edge computing nodes, security servers, and maintenance platforms. It also marks interference sources such as industrial interference and malicious jammers that exist in the scenario.

[0088] Example 2

[0089] As an optional implementation of this embodiment, performing a one-time post-quantum key encapsulation includes:

[0090] The network access point uses the public key of the wireless terminal to encrypt the shared session key seed and generate a key-encapsulated ciphertext.

[0091] The wireless terminal uses its private key to decrypt the key-encapsulated ciphertext and recover the shared session key seed.

[0092] In practice, the terminal public key is a post-quantum public key based on multivariate polynomials (in line with the NIST post-quantum cryptography candidate algorithm direction). During the WAPI two-way authentication phase, the terminal actively sends the public key to the access point. The public key is stored in the access point's temporary key buffer. The encryption process is asymmetric encryption, which can only be decrypted by the terminal's private key.

[0093] Secondly, the terminal private key is a trapdoor information that is paired with the public key and is pre-stored in the terminal security chip (such as the national cryptographic SM4 security chip). The private key can only be accessed through local authentication on the terminal (such as a hardware PIN code) to prevent the private key from being stolen.

[0094] Based on the above, the wireless terminal security management method of this embodiment, at the technical principle level, employs asymmetric encryption logic in post-quantum key encapsulation. The one-way nature of public-key encryption and private-key decryption ensures that only legitimate terminals can recover the shared session key seed. Even if the ciphertext is intercepted by an attacker, the seed cannot be cracked due to the lack of the terminal's private key. The one-time encapsulation design means that encryption / decryption is performed only once per connection establishment, avoiding the terminal's computing power consumption caused by repeated calculations (some terminals in new energy power stations have limited computing power, and one-time operation can reduce energy consumption). At the technical effect level, this process first addresses the shortcomings of traditional key mechanisms in resisting quantum attacks. Compared with RSA and ECC, it can resist quantum computers from cracking the key, ensuring the absolute security of the shared session key seed during transmission. Second, the private key is stored in a hardware security chip and requires local verification, preventing the private key from being stolen at the software level, further improving key security. Finally, the one-time encapsulation balances security and efficiency, providing a secure source for subsequent physical layer waveform parameter updates, preventing seed leakage from causing the entire physical layer security mechanism to fail, and ensuring the security of the key foundation for wireless communication in new energy power stations.

[0095] Example 3

[0096] Based on the aforementioned post-quantum key encapsulation process, as a further optional implementation of this embodiment, the key-encapsulated ciphertext generation process includes:

[0097] The network access point uses the public key of the wireless terminal to generate a random secret vector. The public key is a publicly available set of multivariate polynomials on a polynomial ring. ,

[0098] , To define in a finite field polynomial variables on, Is the coefficient in Multivariate polynomials on the surface , From a finite field The elements are randomly selected from the input; and the key encapsulation ciphertext is calculated. ,in , , For a shared key derived from a secret vector, , Derived function for key. This refers to the key information obtained after encoding the shared session key seed. For hash functions, This indicates the XOR operation.

[0099] In practical implementation, for finite fields , Take 256 (a prime power, which meets the requirements of cryptographic hardware implementation). Choose 8 (to balance security and computational complexity). Take 16, and Ensure the difficulty of solving multivariable equation systems. Secondly, finite fields. The randomly selected elements are chosen using the CTR_DRBG random number generator to ensure randomness. This refers to Substituting the values ​​into the multivariate polynomial equations yields the solution to the system of multivariate equations. The key derivation function uses the HKDF algorithm, conforming to the RFC5869 standard. The input... Output 256 bits The shared session key seed is encoded using Base64 for easy ciphertext transmission. The hash function uses SHA-256, conforming to the NISTFIPS 180-4 standard, ensuring collision resistance. An XOR operation achieves a one-time password effect, ensuring that only the person who knows the key knows it. Only then can it be restored .

[0100] Secondly, the process of restoring the shared session key seed includes:

[0101] The wireless terminal uses its private key, which is a trapdoor information corresponding to the public key, to... Effective recovery of the random secret vector ;calculate and through Recover key information ; regarding key information Decode to obtain the shared session key seed.

[0102] In practical implementation, the trapdoor information is constructed based on a polynomial linear transformation, hiding the correlation between polynomial coefficients to facilitate rapid solution of the equation system by the terminal. When recovering the random secret vector, the terminal quickly solves the problem using the trapdoor. The system of multivariable equations avoids the high complexity of brute-force attacks. Key information recovery is achieved through the inverse XOR operation, i.e., given... You can pass Reverse push Decoding uses the same decoding method as when encoding the shared session key seed, which is Base64 decoding.

[0103] Example 4

[0104] As an optional implementation of this embodiment, the communication waveform parameters include the roll-off factor of the baseband filter, the pilot pattern distribution used in OFDM modulation, and the dynamic range of the signal's transmit power.

[0105] In practical implementation, the roll-off factor ranges from 0 to 1. A smaller value results in higher spectrum utilization, while a larger value provides stronger resistance to inter-symbol interference. A feasible approach is to use 0.25 when channel interference is low and 0.5 when interference is high. OFDM is a commonly used modulation method in wireless communication. Pilots are used for channel estimation. Patterns are divided into sparse pilots (one pilot is inserted every four subcarriers, resulting in high spectrum utilization) and dense pilots (one pilot is inserted every two subcarriers, resulting in more accurate channel estimation). Sparse pilots are used when channel quality is good, and dense pilots are used when it is poor. The dynamic range of the signal's transmit power is the adjustable power range of the terminal, such as -10dBm to 20dBm, with an adjustment step of 1dBm. Long-distance terminals use 20dBm, and short-distance terminals use -5dBm to avoid interference.

[0106] Example 6

[0107] As an optional implementation of this embodiment, electromagnetic environment data is input into a pre-trained neural network model for analysis, including:

[0108] The raw electromagnetic environment data is filtered and normalized before preprocessing to generate model input data;

[0109] The model input data is fed into the trained CNN neural network model, which outputs the interference type classification result corresponding to the current channel interference type and the channel quality assessment result corresponding to the channel quality score result.

[0110] When the interference type classification result identifies a specific type of persistent interference (such as narrowband interference detected for 5 consecutive monitoring cycles) or the score result is lower than a preset threshold (such as a threshold set to 3 points), a WAPI communication channel switching suggestion is generated.

[0111] In practice, the electromagnetic environment data is filtered using a bandpass filter, with the passband being the terminal's operating frequency band. Normalization employs Min-Max normalization, mapping the data to the [0,1] interval to eliminate the influence of differences in the data acquisition equipment.

[0112] Secondly, the network structure of the CNN neural network model is as follows: input layer (256×256 spectrogram, frequency on the horizontal axis and time on the vertical axis) → 3 convolutional layers (3×3 convolutional kernels, ReLU activation) → 2 max pooling layers (2×2 pooling kernels) → 2 fully connected layers → output layer (interference type (3 types: narrowband, wideband, impulse) + channel quality score (1-10 points)). During training, the cross-entropy loss function and Adam optimizer are used, and the iteration is performed for 100 rounds until the loss converges.

[0113] Furthermore, as previously stated, the channel quality assessment results are based on a fusion of signal-to-noise ratio (SNR), bit error rate (BER), and signal strength index (RSSI), such as SNR ≥ 20 dB and BER ≤ 10 dB. -6Time → 9-10 minutes; SNR≤5dB, BER≥10 -3 Time → 1-2 minutes. The handover recommendation is based on the channel scan results, selecting a channel with no interference and a quality score ≥ 7, such as switching from channel 6 to channel 11. The handover follows the WAPI channel handover protocol to ensure uninterrupted service.

[0114] Example 7

[0115] As an optional implementation of this embodiment, joint analysis is performed using an attack graph model, including:

[0116] The identified security vulnerabilities, the asset importance level of the wireless terminal, the available network resources, and the channel quality assessment results are used as nodes in the attack graph.

[0117] Using potential attack behaviors as edges connecting nodes, construct an attack path from the initial vulnerability to critical assets;

[0118] Based on the impact of vulnerability exploitation difficulty, asset importance, and current channel quality on attack success rate, a weight value is calculated for each attack path.

[0119] The weight values ​​of all attack paths are divided into multiple consecutive intervals according to their numerical values. The interval containing the path with the largest numerical weight value is determined as the overall security threat level of the wireless terminal.

[0120] In practical implementation, identified security vulnerabilities can be such as terminal buffer overflow vulnerabilities or access point authentication bypass vulnerabilities, and each vulnerability is associated with a Common Vulnerability Scoring System (CVSS) score. The asset importance level of the wireless terminal can be three levels: high (3 points), medium (2 points), and low (1 point). Available network resources can be bandwidth and computing resources, and if the bandwidth is <1Mbps, it is marked as resource-limited, indicating that it will reduce the success rate of the attack. The channel quality assessment results used in the joint analysis are normalized values ​​of 0 to 1, with a value of 1 being optimal. The nodes of the attack graph include: initial node: vulnerability; intermediate node: attack intermediate state, such as obtaining ordinary terminal privileges; target node: core assets, such as control command module. The edges of the nodes can be such as "exploit buffer overflow vulnerability → obtain ordinary privileges" or "privilege escalation → obtain administrator privileges", and each attack behavior corresponds to a known attack method, such as a vulnerability exploitation module based on Metasploit. The attack path uses the BFS algorithm to traverse all nodes and generate all possible paths, such as "buffer overflow → ordinary privileges → privilege escalation → steal control commands".

[0121] Secondly, the difficulty of exploiting the vulnerability ( Mapped from CVSS scores: e.g., CVSS score of 10 → 7 points → 4 points → .

[0122] In addition, the weighting intervals are set based on the site security requirements. High threat corresponds to core assets facing a high success rate of attack. An example interval could be: [0,0.3) → low threat, [0.3,0.7) → medium threat, [0.7,1.0] → high threat.

[0123] Example 8

[0124] Based on the attack graph model described above, as a further optional implementation method of this embodiment, the weight value is calculated using the following formula:

[0125] ;

[0126] in, This represents the weight value of a single attack path (range 0~). ); This indicates the criticality score of the terminal asset targeted by the attack path (preset by the site security department, core control terminal). Ordinary monitoring terminal (Values ​​are continuous to accurately reflect differences). This represents the base probability that the i-th vulnerability on the attack path is successfully exploited. This base probability is obtained by mapping the vulnerability's score based on a general vulnerability scoring system. The mapping formula is: ; The function representing the channel quality impact has the following inputs: The normalized values ​​of the channel quality assessment results are output as coefficients between [0,1], used to characterize the amplification or reduction effect of channel quality on the success rate of vulnerability exploitation, and are expressed as linear functions: , hour (Good channel, no impact) hour (Poor channel performance reduces success rate); the function has been tested and calibrated at the field station. This represents the actual conditional probability that the i-th vulnerability will be successfully exploited after correction based on the output value of the channel quality influence function; This represents the probability that none of the vulnerabilities along the attack path are successfully exploited (based on the multiplication formula of independent event probabilities, assuming that the exploitation of each vulnerability is independent of each other). This represents the overall probability that the attack path is successfully exploited; the success probability of this path is related to the asset criticality score. Multiplying them together yields the final path weight value that reflects the expected loss. For example: The attack path contains two vulnerabilities, vulnerability 1 CVSS=10 → Vulnerability 2CVSS=8→ Channel quality score 8 → → ; (Core terminal); Computation: The overall probability is ,fall into Range → High Threat Level.

[0127] Example 9

[0128] As an optional implementation of this embodiment, the security policy execution phase further includes:

[0129] Continuously monitor the MAC layer timing traffic of wireless terminals, extract the MAC layer frame interval time sequence and frame length sequence to form a device behavior sequence;

[0130] Temporal convolutional networks are used to extract features from device behavior sequences to obtain fixed-dimensional device behavior feature vectors.

[0131] Calculate the deviation between the device behavior feature vector and the pre-registered standard behavior template;

[0132] The deviation is compared with a dynamic threshold. If the deviation exceeds the dynamic threshold, a communication connection establishment phase or a wireless terminal network isolation operation is triggered. The dynamic threshold is determined based on the feature vector distribution statistics of a standard behavior template within a historical monitoring period. The complete process is as follows: Figure 4 , Figure 4 A flowchart for extracting MAC layer device behavior features and determining deviation is provided, clarifying the entire link from AP traffic capture to the final triggering of security operations.

[0133] In practical implementation, MAC layer timing traffic is captured by the access point's traffic capture module (developed based on the libpcap library), capturing MAC layer frames of the IEEE 802.11 protocol. The monitoring period can be set to 10 seconds to ensure real-time performance. The frame interval time sequence refers to the time difference between the transmission of adjacent MAC frames, and the frame length sequence refers to the number of bytes in each MAC frame, ranging from 100 to 2346 bytes. The device behavior sequence refers to the sequence of 100 data points generated in each cycle, such as [10ms, 15ms, ...] or [512B, 1024B, ...].

[0134] Secondly, Temporal Convolutional Networks (TCNs) are specifically designed for temporal data and are better at capturing long-range dependencies compared to RNNs. The feature vector dimension is set to 64 dimensions to ensure a suitable dimensionality while containing sufficient behavioral information. The standard behavioral template can be obtained by extracting features from 100 behavioral sequences collected during normal terminal operation and then clustering them using TCN. The deviation is calculated using cosine similarity, with a similarity range of [-1, 1], where a smaller value indicates a higher deviation.

[0135] Furthermore, dynamic thresholds can be set based on statistics of the standard template feature vectors from the past 24 hours, using the 3σ principle: threshold = mean - 2 × standard deviation, to reduce false alarms. Network isolation operations refer to assigning terminals to independent isolated VLANs, prohibiting them from accessing core business network segments. Feature vector distribution statistics include mean and standard deviation.

[0136] Example 10

[0137] Based on the aforementioned security policy execution phase, as a further optional implementation method of this embodiment, the process of obtaining the device behavior feature vector includes:

[0138] The frame interval time series and frame length series of the MAC layer are standardized to generate a standardized input sequence;

[0139] The input sequence is fed into a temporal convolutional network, which scans the input sequence through causal convolutional layers and dilated convolutional layers with increasing dilation coefficients to capture long-range dependencies in the device behavior sequence and outputs a high-level feature sequence.

[0140] The high-level feature sequence is compressed in the time dimension by the global pooling layer at the end of the temporal convolutional network, and its global statistics are calculated. The high-level feature sequence is then aggregated into a device behavior feature vector.

[0141] In practical implementation, Z-score normalization is used to eliminate differences in numerical ranges across different terminals, such as unifying frame intervals of 10ms and 50ms to the same scale. Causal convolutional layers ensure that the output at time t depends only on data up to and including time t, preventing data leakage. The kernel size is 3, and the activation function is ReLU. The dilation coefficient of the dilated convolutional layers increases incrementally, initially at 1, then 2, 4, 8… covering long sequences through interval sampling without increasing the number of layers. An exemplary long-range dependency could be a long-period pattern such as a terminal sending a control frame every 500ms. The number of output channels in the temporal convolutional network can be 64, representing 64 feature sequences of different behavioral patterns.

[0142] Secondly, compression in the time dimension is achieved using global average pooling, which calculates the time dimension mean of each high-level feature sequence.

[0143] Example 11

[0144] In summary, the wireless terminal security management method of this embodiment, during the communication connection establishment phase, adds a security dimension against quantum computing attacks to traditional authentication by combining two-way WAPI certificate authentication with one-time post-quantum key encapsulation. Simultaneously, it utilizes the established shared session key seed to drive a physical layer security enhancement mechanism, achieving periodic synchronous updates of communication waveform parameters. This design extends security protection beyond the network layer to the physical layer, significantly improving initial authentication strength and establishing a continuously updated physical layer security barrier, effectively resisting man-in-the-middle attacks and physical layer eavesdropping.

[0145] During the security situation assessment phase, a precise quantitative assessment of security threats was achieved through the synergy of multi-dimensional data fusion analysis (equipment characteristics, communication data, electromagnetic environment) and intelligent algorithms (neural networks, attack graph models). In particular, by incorporating channel quality assessment results into the attack graph analysis model, and by correlating communication link quality with network security threats in the new energy power station scenario, the determination of security threat levels more closely reflects the actual characteristics of the industrial wireless environment. This provides a reliable basis for the accurate generation of security strategies. The module interaction logic in this phase is as follows: Figure 5 , Figure 5 This diagram illustrates the module interaction process of a wireless terminal security management system, clarifying the interaction relationships among core modules such as WAPI authentication, post-quantum key processing, physical layer parameter synchronization, vulnerability identification, CNN analysis, attack graph evaluation, and policy generation and distribution.

[0146] During the security policy execution phase, a dynamic correlation mechanism between the comprehensive security threat level and physical layer security parameters is established (the update cycle is positively correlated with the threat level), enabling adaptive adjustment of security protection strength. When a high-risk threat is detected, the system automatically shortens the waveform parameter update cycle, increasing the difficulty for attackers to crack the system; while in a low-risk state, the update frequency is appropriately reduced to achieve the best balance between security and communication efficiency.

[0147] Furthermore, through the orderly connection and closed-loop feedback of the three stages, this embodiment constructs a complete security chain from identity authentication to communication protection, and from threat perception to dynamic protection. It solves the problems of isolated protection measures and delayed response in traditional security solutions, and provides a wireless terminal security management solution for new energy power stations that can both ensure communication reliability and have active defense capabilities.

[0148] This embodiment provides a wireless terminal security management system in a second aspect, which applies the wireless terminal security management method described above. The system includes:

[0149] The communication connection establishment module, located in the wireless terminal and the network access point, is configured to: perform two-way authentication between the wireless terminal and the network access point based on WAPI certificates; after successful authentication, perform a one-time post-quantum key encapsulation to establish a shared session key seed, and initialize the physical layer security enhancement mechanism, so that the wireless terminal and the network access point periodically and synchronously update the communication waveform parameters based on the shared session key seed;

[0150] The security posture assessment module, located in the network access point or a security server connected to the network access point, is configured to: collect device characteristic information, near-field communication data, and electromagnetic environment data of the operating frequency band of the wireless terminal; match and analyze the device characteristic information and near-field communication data with a preset vulnerability feature database to identify security vulnerabilities; simultaneously, input the electromagnetic environment data into a pre-trained neural network model for analysis to obtain channel quality assessment results and interference type classification results; and, based on the identified security vulnerabilities, predefined asset importance, and channel quality assessment results, perform joint analysis through an attack graph model to calculate the comprehensive security threat level of the wireless terminal.

[0151] The security policy execution module, located at the network access point, is configured to dynamically generate security policies and distribute them to wireless terminals based on the comprehensive security threat level, channel quality assessment results, and interference type classification results.

[0152] Among them, the physical layer security enhancement mechanism continues to operate during the secure communication session between the network access point and the wireless terminal after initialization, and the update cycle of the communication waveform parameters is positively correlated with the overall security threat level.

[0153] In the embodiments provided in this application, it should be understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, code, or any suitable combination thereof. For hardware implementation, the processor may be implemented in one or more of the following: application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, other electronic units designed to implement the functions described herein, or combinations thereof. For software implementation, some or all of the processes of the embodiments may be performed by a computer program instructing the associated hardware. During implementation, the program may be stored in a computer-readable storage medium or transmitted as one or more instructions or code on a computer-readable storage medium. Computer-readable storage media include computer storage media and communication media, wherein communication media include any medium that facilitates the transmission of a computer program from one place to another. Storage media may be any available medium accessible to a computer. Computer-readable storage media may include, but are not limited to, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code having the form of instructions or data structures and accessible to a computer.

[0154] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for security management of wireless terminals, Its features are, include: The communication connection establishment phase, the security situation assessment phase, and the security policy execution phase; The communication connection establishment phase includes: the wireless terminal and the network access point performing two-way authentication based on WAPI certificates; after successful authentication, a one-time post-quantum key encapsulation is performed to establish a shared session key seed, and through a physical layer security enhancement mechanism, the wireless terminal and the network access point periodically and synchronously update communication waveform parameters based on the shared session key seed; The security situation assessment phase includes: collecting device characteristic information, near-field communication data, and electromagnetic environment data of the operating frequency band of the wireless terminal; matching and analyzing the device characteristic information and near-field communication data with a preset vulnerability feature database to identify security vulnerabilities; and inputting the electromagnetic environment data into a pre-trained neural network model for analysis to obtain channel quality assessment results and interference type classification results; based on the identified security vulnerabilities, predefined asset importance, and the channel quality assessment results, joint analysis is performed using an attack graph model to calculate the comprehensive security threat level of the wireless terminal. The security policy execution phase includes: the network access point dynamically generates a security policy based on the comprehensive security threat level, the channel quality assessment result, and the interference type classification result, and then sends the security policy to the wireless terminal; The physical layer security enhancement mechanism is initialized during the communication connection establishment phase and remains operational during the secure communication session between the network access point and the wireless terminal. The update cycle of the communication waveform parameters is positively correlated with the overall security threat level.

2. The wireless terminal security management method according to claim 1, Its features are, The one-time post-quantum key encapsulation includes: The network access point uses the public key of the wireless terminal to encrypt the shared session key seed, generating key-encapsulated ciphertext; The wireless terminal uses its private key to decrypt the key-encapsulated ciphertext and recover the shared session key seed.

3. The wireless terminal security management method according to claim 2, Its features are, The process of generating the key-encapsulated ciphertext includes: The network access point uses the public key of the wireless terminal to generate a random secret vector. The public key is a publicly available set of multivariate polynomials on a polynomial ring. , , To define in a finite field polynomial variables on, Is the coefficient in Multivariate polynomials on the surface , From a finite field The elements are randomly selected from the input; and the key encapsulation ciphertext is calculated. ,in , , For the shared key derived from the secret vector, , Derived function for key. This refers to the key information obtained after encoding the shared session key seed. For hash functions, Indicates the XOR operation; The recovery process of the shared session key seed includes: The wireless terminal uses its private key, which is trapdoor information corresponding to the public key, to... The random secret vector can be effectively recovered. ;calculate and through Recover the key information ; regarding the key information Decoding is performed to obtain the shared session key seed.

4. The wireless terminal security management method according to claim 1, Its features are, The security policy execution phase also includes: Continuously monitor the MAC layer timing traffic of the wireless terminal, extract the MAC layer frame interval time sequence and frame length sequence to form a device behavior sequence; The device behavior sequence is extracted using a temporal convolutional network to obtain a fixed-dimensional device behavior feature vector. Calculate the deviation between the device behavior feature vector and the pre-registered standard behavior template; The deviation is compared with a dynamic threshold. If the deviation exceeds the dynamic threshold, the communication connection establishment phase or the wireless terminal network isolation operation is triggered. The dynamic threshold is determined based on the feature vector distribution statistics of the standard behavior template in the historical monitoring period.

5. The wireless terminal security management method according to claim 4, Its features are, The process of obtaining the device behavior feature vector includes: The frame interval time sequence and frame length sequence of the MAC layer are standardized to generate a standardized input sequence; The input sequence is fed into the temporal convolutional network, which scans the input sequence through causal convolutional layers and dilated convolutional layers with increasing dilation coefficients to capture long-range dependencies in the device behavior sequence and outputs a high-level feature sequence. The high-level feature sequence is compressed in the time dimension by the global pooling layer at the end of the temporal convolutional network, its global statistics are calculated, and the high-level feature sequence is aggregated into the device behavior feature vector.

6. The wireless terminal security management method according to claim 1, Its features are, The communication waveform parameters include the roll-off factor of the baseband filter, the pilot pattern distribution used in OFDM modulation, and the dynamic range of the signal's transmit power.

7. The wireless terminal security management method according to claim 1, Its features are, The step of inputting electromagnetic environment data into a pre-trained neural network model for analysis includes: The raw electromagnetic environment data is filtered and normalized before being preprocessed to generate model input data; The input data of the model is input into the trained CNN neural network model, and the CNN neural network model outputs the interference type classification result corresponding to the current channel interference type and the channel quality assessment result corresponding to the channel quality score result.

8. The wireless terminal security management method according to claim 1, Its features are, The joint analysis is performed using an attack graph model. include: The identified security vulnerabilities, the asset importance level of the wireless terminal, the available network resources, and the channel quality assessment results are used as nodes in the attack graph; Using potential attack behaviors as edges connecting the nodes, an attack path is constructed from the initial vulnerability to critical assets; Based on the impact of vulnerability exploitation difficulty, asset importance, and current channel quality on attack success rate, a weight value is calculated for each attack path. The weight values ​​of all attack paths are divided into multiple consecutive intervals according to their numerical values. The interval containing the path with the largest numerical weight value is determined as the overall security threat level of the wireless terminal.

9. The wireless terminal security management method according to claim 8, Its features are, The weight value is calculated using the following formula: ； in, This represents the weight value of a single attack path; This indicates the critical score of the terminal asset targeted by the attack path; This represents the base probability that the i-th vulnerability on the attack path is successfully exploited. The function representing the channel quality impact has the following inputs: The normalized value of the channel quality assessment result is output as a coefficient between [0,1].

10. A wireless terminal security management system, The wireless terminal security management method as described in any one of claims 1-9 is adopted. Its features are, The system includes: The communication connection establishment module, located in the wireless terminal and the network access point, is configured to: perform bidirectional authentication between the wireless terminal and the network access point based on WAPI certificates; after successful authentication, perform a one-time post-quantum key encapsulation to establish a shared session key seed, and initialize the physical layer security enhancement mechanism so that the wireless terminal and the network access point periodically and synchronously update communication waveform parameters based on the shared session key seed; The security situation assessment module, located in the network access point or a security server communicatively connected to the network access point, is configured to: collect device characteristic information, near-field communication data, and electromagnetic environment data of the operating frequency band of the wireless terminal; match and analyze the device characteristic information and near-field communication data with a preset vulnerability feature database to identify security vulnerabilities; simultaneously, input the electromagnetic environment data into a pre-trained neural network model for analysis to obtain channel quality assessment results and interference type classification results; and, based on the identified security vulnerabilities, predefined asset importance, and the channel quality assessment results, perform joint analysis through an attack graph model to calculate the comprehensive security threat level of the wireless terminal. A security policy execution module, located at the network access point, is configured to: dynamically generate a security policy based on the comprehensive security threat level, the channel quality assessment result, and the interference type classification result, and then distribute the security policy to the wireless terminal. The physical layer security enhancement mechanism, after initialization, continues to operate during the secure communication session between the network access point and the wireless terminal, and the update cycle of the communication waveform parameters is positively correlated with the overall security threat level.

Images