Device authentication and monitoring method and apparatus

Abstract

The application provides a device authentication and monitoring method and device, wherein the method mainly selects and executes among a plurality of authentication processes including local device authentication by dynamically sensing real-time connection states of a plurality of authentication services, so that the authentication capability can be maintained when part of the authentication services are unreachable, and the availability of login authentication in a communication abnormal scenario is effectively guaranteed; meanwhile, authentication security events are collected and reported to a remote security monitoring center platform for real-time monitoring and abnormal behavior analysis, and when an attack behavior is identified, a linkage execution handling instruction is triggered to block user login and attack, so that a closed-loop linkage of security authentication, security monitoring and security handling control is realized, and the overall security of the device is improved.

Description

Technical Field

[0001] This application belongs to the field of industrial control technology, and in particular relates to a method and apparatus for equipment authentication and monitoring. Background Technology

[0002] In fields such as industrial control and power automation, a centralized authentication architecture is often used to improve the security of device access. The basic approach is that terminal devices forward user login credentials to a remote authentication server, which centrally verifies the user's identity and returns an acceptance or rejection decision.

[0003] However, the aforementioned authentication process is highly dependent on network connectivity with the remote server. In actual operation, once a network outage or server failure occurs, the terminal device cannot obtain the authentication server's judgment result, causing all login operations to be blocked or rejected. This single point of failure means that the system completely loses its ability to authenticate users when it loses its connection with the authentication server, severely restricting the availability of critical equipment in emergency scenarios. Furthermore, existing solutions lack effective centralized monitoring and coordinated handling methods for security incidents generated during the login authentication process. Login logs recorded locally by devices are scattered across various terminals, making real-time aggregation and unified analysis difficult. When unauthorized login attempts or attacks occur, maintenance personnel often cannot detect them in time, let alone proactively block them during the attack. They can only trace the attacks afterward by reviewing logs, resulting in security threats persisting for an extended period. Summary of the Invention

[0004] This application provides a device authentication and monitoring method and apparatus, which can effectively ensure the availability of login authentication in communication anomaly scenarios, and at the same time realize centralized monitoring and coordinated handling of authentication security events.

[0005] A first aspect of this application provides a device authentication and monitoring method, comprising: responding to a login request initiated by a user on a secondary device in a substation, obtaining the connectivity status of at least two authentication services; determining and executing a target authentication process from a pre-configured plurality of authentication processes based on the connectivity status, wherein the plurality of authentication processes all use a device local authentication step based on permission data locally stored on the secondary device in the substation as the final authentication step, and the combination of authentication steps included before the device local authentication step in different authentication processes is different; during the execution of the target authentication process, collecting authentication security events and reporting them to a remote security monitoring center platform, wherein the remote... The security monitoring center platform is used to monitor and analyze abnormal behavior based on authentication security events from various substations. When the remote security monitoring center platform identifies an attack based on abnormal behavior analysis and issues a response command, the substation's secondary equipment receives and executes the response command to block user login and attacks. During the execution of the target authentication process, if an authentication rejection response is received from any authentication service, the current authentication process is terminated and user login is denied. If the connectivity status indicates that an unreachable authentication service exists, the selected target authentication process is a downgraded authentication process, which includes an authentication step initiated to a reachable authentication service and a local device authentication step.

[0006] In the technical solution of this application, the real-time connectivity status of multiple authentication services is dynamically sensed, and the system adaptively selects and executes various authentication processes, including local device authentication, based on this. This ensures that authentication capabilities are maintained even when some authentication services are unavailable, effectively guaranteeing the availability of login authentication in scenarios with communication anomalies. At the same time, authentication security events are collected and reported to a remote security monitoring center platform for abnormal behavior analysis. When attack behavior is identified, the system receives and executes handling instructions to block user login and attacks. This achieves a closed-loop linkage of security authentication, security monitoring, and security handling control, thereby improving the overall security of the device.

[0007] Optionally, in one possible implementation of the first aspect, the above-mentioned collection and reporting of authentication security events to the remote security monitoring center platform includes: during the execution of the target authentication process, generating corresponding authentication security events based on the authentication behaviors that occur, wherein the authentication security events include at least one of authentication request events, authentication result events, downgrade switching events, server status events, and user operation events; the authentication request event carries at least the username, device identifier, source network address (Internet Protocol Address, IP address), and authentication method; the authentication result event carries at least the result of authentication success or rejection and the reason for failure; the downgrade switching event carries at least the switching time, the authentication level before and after downgrade, and the unreachable authentication service identifier; the server status event carries at least the status change information of authentication service recovery or interruption; the user operation event carries at least the operation log after successful login; and the authentication security events are encapsulated into security event messages and sent to the remote security monitoring center platform. Thus, by defining multiple types of authentication security events and their key fields, the scattered information generated during the execution of the target authentication process is collected in a structured manner and reported uniformly, enabling the remote security monitoring center platform to obtain comprehensive and standardized authentication security data, providing a reliable data foundation for subsequent abnormal behavior analysis.

[0008] Optionally, in another possible implementation of the first aspect, the above-mentioned abnormal behavior analysis includes: matching authentication security events with at least one detection rule; the detection rule includes at least one of the following: if the number of consecutive authentication failures of the same user or the same source network address within a preset time window exceeds a preset authentication failure threshold, it is determined to be a brute-force attack; if an authentication login event occurs outside of maintenance periods, it is determined to be an abnormal time login; if the same user successfully logs into multiple different devices within a preset time, it is determined to be a lateral movement; if the authentication request comes from an unauthorized network address range, it is determined to be an abnormal source network address access; if multiple source network addresses collaboratively initiate low-frequency authentication requests, it is determined to be a distributed slow attack; if any detection rule matches, the attack behavior is identified. Therefore, by matching authentication security events with multiple attack detection rules, attack behaviors such as brute-force attacks, abnormal time logins, lateral movement, abnormal source network address access, and distributed slow attacks can be automatically identified from different dimensions, thereby improving the ability to detect security threats during the login authentication process and the timeliness of response.

[0009] Optionally, in another possible implementation of the first aspect, after identifying an attack behavior, the method further includes: classifying the attack behavior into high-risk, medium-risk, or low-risk alerts according to the attack type corresponding to the hit detection rule; in the case of a high-risk alert, pushing an alert via at least one of SMS, application push, or audible and visual alarms, and initiating a coordinated handling instruction issuance process; in the case of a medium-risk alert, pushing an alert via SMS or application push, displaying the medium-risk alert information on the monitoring interface, and recording audit logs; in the case of a low-risk alert, recording audit logs and providing a notification on the monitoring interface. Thus, by classifying identified attack behaviors into different alert levels and executing differentiated push and handling processes based on alert levels, operations and maintenance personnel can prioritize high-risk threats while avoiding excessive consumption of operations and maintenance resources by low-risk events, thereby improving the efficiency of security operations and maintenance.

[0010] Optionally, in another possible implementation of the first aspect, the substation secondary equipment receives and executes a handling instruction to block user login and attacks, including: receiving a handling instruction issued by a remote security monitoring center platform, wherein the handling instruction includes at least one of forcing the user offline, locking the account, blocking the source network address, and switching the authentication policy; writing the blocking rule corresponding to the handling instruction into the local non-volatile storage of the substation secondary equipment so that the blocking rule remains effective after the substation secondary equipment is restarted; executing the corresponding blocking operation according to the handling instruction, wherein the blocking operation corresponding to the forcing the user offline instruction is to terminate the user's current session and log out, the blocking operation corresponding to the locking the account instruction is to prevent the user from logging in subsequently, the blocking operation corresponding to the blocking the source network address instruction is to add the source network address to the local blacklist and reject the authentication request initiated by the source network address, and the blocking operation corresponding to the switching authentication policy instruction is to switch the authentication mode to the enhanced authentication mode; and returning an execution confirmation message to the remote security monitoring center platform after the blocking operation is completed. Therefore, by persistently writing the blocking rules corresponding to the handling instructions into the local non-volatile storage of the substation secondary equipment, and performing corresponding blocking operations for different types of handling instructions, the blocking effect can still be maintained after the equipment is restarted, effectively preventing attackers from bypassing the blocking by restarting the equipment, thus improving the reliability and durability of the handling.

[0011] Optionally, in another possible implementation of the first aspect, the method further includes: after the substation secondary equipment determines that the authentication service is unreachable and reports a degradation alarm, it will not report the same degradation alarm again until the authentication service becomes reachable. Specifically, for alarms from multiple substation secondary devices within the same substation regarding the same authentication service being unreachable, the local security monitoring forwarding unit aggregates and reports them to the remote security monitoring center platform, so that the remote security monitoring center platform only displays a single alarm, avoiding frequent alarms for repeated events. After the authentication service is first marked as unreachable, the substation secondary equipment delays the reporting of the alarm for a preset delay period. If the authentication service becomes reachable during the delay period, no alarm is generated. The handling instructions include temporary blocking instructions or permanent blocking instructions. Temporary blocking instructions are automatically lifted after a preset effective period, while permanent blocking instructions are lifted upon receiving a release instruction from the remote security monitoring center platform. The remote security monitoring center platform maintains a list of blocking rules for the entire network and periodically synchronizes the blocking status with each substation secondary device. Therefore, the alarm suppression mechanism avoids the interference of a large number of repeated alarms to the operation and maintenance personnel, and the blocking status management mechanism ensures the continuous effectiveness and accurate synchronization of blocking rules, thereby improving the reliability of monitoring and handling.

[0012] Optionally, in another possible implementation of the first aspect, the method further includes: receiving user permission data and storing the user permission data locally on the substation secondary equipment. At least two authentication services are included, such as a first authentication service and a second authentication service. The user permission data is pushed from the first authentication service to the second authentication service via a one-way synchronization method, and then forwarded by the second authentication service to the substation secondary equipment. The one-way synchronization includes periodic full synchronization and change-triggered incremental synchronization. During the local equipment authentication process, the locally stored user permission data is obtained, and the username and password entered by the user are compared and verified with the user permission data. If the verification passes, the user is allowed to log in, and operation permissions are assigned according to the user's corresponding operation role recorded in the user permission data. The operation role includes at least one of read-only, operator, administrator, and auditor. Therefore, by pre-caching the user permission data locally on the substation secondary equipment and performing verification and role allocation based on the cached data during local equipment authentication, effective identity verification and access control can still be completed based on the latest permission information even in extreme cases where communication is completely interrupted and all authentication services are unavailable, ensuring the availability of emergency maintenance operations.

[0013] Optionally, in another possible implementation of the first aspect, at least two authentication services include a first authentication service and a second authentication service. The above-mentioned determination and execution of a target authentication process from a pre-configured set of authentication processes based on the connectivity status includes: when the connectivity status indicates that both the first and second authentication services are reachable, sending a first authentication request to the first authentication service; if an authentication acceptance response is received from the first authentication service, sending a second authentication request to the second authentication service; if an authentication acceptance response is received from the second authentication service, executing a device-local authentication step; when the connectivity status indicates that the first authentication service is unreachable but the second authentication service is reachable, sending a second authentication request to the second authentication service; if an authentication acceptance response is received from the second authentication service, executing a device-local authentication step; when the connectivity status indicates that both the first and second authentication services are unreachable, directly executing the device-local authentication step; wherein both the first and second authentication requests are encapsulated by the substation secondary equipment into Remote Authentication Dial-In User Service (RADIUS) protocol messages and sent to the corresponding authentication service to request authentication. Therefore, by automatically switching between three processes—full multi-level authentication, downgraded authentication, and pure local authentication—based on the accessibility combination of the first and second authentication services, the device can adapt to different communication states to the greatest extent possible while ensuring security, and ensure that the device can complete the necessary authentication under various network conditions.

[0014] Optionally, in another possible implementation of the first aspect, obtaining the connectivity status of at least two authentication services includes: sending probe messages to the authentication services, wherein the probe messages do not carry usernames and passwords; if no valid response is received from the authentication services within a preset timeout period, retransmission is performed; if no valid response is received after the number of retransmissions reaches a preset probe retransmission threshold, the authentication services are determined to be unreachable, wherein a valid response includes an authentication acceptance response or a status server response message; the method further includes: sending probe messages to the authentication services marked as unreachable at preset time intervals; after receiving a valid response from the authentication services marked as unreachable to the probe messages, marking the connectivity status of the authentication services as reachable, and switching to the target authentication process corresponding to all reachable authentication services. Thus, by using a probe method with a timeout retransmission mechanism to determine the connectivity status of authentication services, and automatically switching the degraded process back to the normal process after the authentication services recover, the unreachability of services is accurately identified, and the security protection strength is restored promptly after service recovery, without manual intervention, achieving a dynamic balance between high security and high availability.

[0015] A second aspect of this application provides a device authentication and monitoring apparatus, including: The status acquisition module is used to obtain the connectivity status of at least two authentication services in response to a login request initiated by a user on the secondary equipment of the substation.

[0016] The process management module is used to determine and execute a target authentication process from a variety of pre-configured authentication processes based on the connectivity status. Each of the various authentication processes uses a device-local authentication step based on permission data stored locally on the substation's secondary equipment as the final authentication step, and the combinations of authentication steps preceding the device-local authentication step are different in each authentication process. If the connectivity status indicates the existence of an unreachable authentication service, the selected target authentication process is a downgraded authentication process, which includes an authentication step initiated to a reachable authentication service and the device-local authentication step.

[0017] The event acquisition module is used to collect authentication security events and report them to the remote security monitoring center platform during the execution of the target authentication process. The remote security monitoring center platform is used to monitor and analyze abnormal behavior based on the authentication security events from various substations.

[0018] The handling execution module is used to receive and execute the handling instructions to block the user login and attack when the remote security monitoring center platform identifies the attack behavior based on the abnormal behavior analysis and issues the handling instructions in a coordinated manner.

[0019] The termination processing module is used to terminate the current authentication process and refuse the user's login if an authentication rejection response is received from any of the authentication services during the execution of the target authentication process.

[0020] A third aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the device authentication and monitoring method of the first aspect described above.

[0021] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the device authentication and monitoring method of the first aspect described above.

[0022] The fifth aspect of this application provides a computer program product that, when run on an electronic device, causes the electronic device to execute the device authentication and monitoring method of the first aspect described above.

[0023] It is understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant descriptions in the first aspect mentioned above, and will not be repeated here. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a schematic diagram of the architecture of a device authentication and monitoring system provided in an embodiment of this application; Figure 2 This is a flowchart illustrating a device authentication and monitoring method provided in an embodiment of this application; Figure 3 This is a schematic diagram of the authentication status management module workflow provided in the embodiments of this application; Figure 4 This is a general flowchart of the multi-level user authentication method provided in the embodiments of this application; Figure 5 This is a timing diagram of the complete three-level authentication process under normal conditions provided in the embodiments of this application; Figure 6 This is a schematic diagram of the downgrade authentication process provided in the embodiments of this application; Figure 7 This is a schematic diagram of the hierarchical reporting process for authentication security events provided in the embodiments of this application; Figure 8 This is a schematic diagram of the workflow of the abnormal behavior analysis engine provided in the embodiments of this application; Figure 9 This is a schematic diagram of the interface layout and functional modules of the remote security monitoring platform provided in the embodiments of this application; Figure 10 This is a flowchart illustrating the issuance and execution of remote security monitoring platform linkage response instructions provided in this application embodiment; Figure 11 This is a schematic diagram of the linkage handling command response process on the secondary equipment side of a substation provided in an embodiment of this application; Figure 12 This is a schematic diagram of the operation process for lifting the disposal status of the authentication security monitoring system provided in this application embodiment; Figure 13 This is a schematic diagram of the overall deployment architecture of the authentication system provided in the embodiments of this application; Figure 14 This is a schematic diagram of the collaborative operation of the master and substations of the authentication security monitoring system provided in this application embodiment; Figure 15 This is a schematic diagram of the structure of a device authentication and monitoring device provided in an embodiment of this application; Figure 16 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0026] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0027] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0028] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0029] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0030] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0031] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0032] It should be understood that the sequence number of each step in this embodiment does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of this application embodiment.

[0033] In related technologies, the authentication process heavily relies on network connectivity between remote servers. In actual operation, once a network outage or server failure occurs, terminal devices cannot obtain the authentication server's judgment result, causing all login operations to be blocked or rejected. This single point of failure means that the system completely loses its ability to authenticate users when it loses its connection to the authentication server, severely restricting the availability of critical equipment in emergency scenarios. Furthermore, existing solutions lack effective centralized monitoring and coordinated handling methods for security incidents generated during the login authentication process. Login logs recorded locally by devices are scattered across various terminals, making real-time aggregation and unified analysis difficult. When unauthorized login attempts or attacks occur, maintenance personnel often cannot detect them in time, let alone proactively block them during the attack. They can only trace the attacks afterward by reviewing logs, resulting in security threats persisting for an extended period.

[0034] In view of this, embodiments of this application provide a device authentication and monitoring method and apparatus. The method mainly dynamically senses the real-time connectivity status of multiple authentication services and adaptively selects and executes various authentication processes, including local device authentication, thereby maintaining authentication capability even when some authentication services are unavailable, effectively ensuring the availability of login authentication in communication anomaly scenarios. At the same time, by collecting authentication security events and reporting them to a remote security monitoring center platform for abnormal behavior analysis, and receiving and executing handling instructions to block user login and attacks when attack behavior is identified, a closed-loop linkage of security authentication, security monitoring, and security handling control is realized, improving the overall security of the device.

[0035] The following provides an example illustrating the application scenarios of the device authentication and monitoring method provided in this application. In the daily operation and maintenance of unattended substations, when maintenance personnel arrive on-site to perform emergency troubleshooting operations on protection devices, they may face situations where the communication link between the substation and the remote dispatch center is interrupted due to construction, equipment failure, or extreme weather. Under traditional centralized authentication schemes, login authentication requests initiated by protection devices must be sent to a remote authentication server to complete identity verification. Once this communication link is interrupted, the authentication request cannot be responded to, and the legitimate login of maintenance personnel will be directly rejected, resulting in the inability to handle faults in a timely manner and delaying the power grid restoration time. By adopting the method of this application, when the protection device receives a login request from maintenance personnel, it can proactively detect and perceive the connectivity status between the remote authentication service and the on-site authentication service. When it detects that the remote authentication service is unreachable but the on-site authentication service is reachable, the device can automatically select a downgraded authentication path that does not rely on the remote authentication service without waiting for timeout or error reports. This path will first have the on-site authentication server verify the identity of the maintenance personnel. After successful verification, the device itself will confirm whether the personnel are authorized to operate the device based on pre-cached permission data. Simultaneously, during the authentication process, the protection device synchronously collects authentication security events and reports them to the remote security monitoring center platform. The remote security monitoring center platform monitors and analyzes abnormal behaviors based on authentication security events from various substations. Once an attack is identified and a handling instruction is issued, the protection device immediately receives and executes the handling instruction to block unauthorized login. The entire switching process is transparent to maintenance personnel, ensuring basic identity verification security during communication anomalies while ensuring that emergency operations are not interrupted, thus balancing the security protection and emergency response availability requirements of substation secondary equipment under extreme operating conditions.

[0036] To illustrate the technical solution of this application, specific embodiments are described below. For ease of understanding, the solution of this application will be described in detail below, mainly in the context of a substation.

[0037] Reference Figure 1 This diagram illustrates the architecture of a device authentication and monitoring system provided in an embodiment of this application. Figure 1 As shown, the system adopts a three-layer distributed architecture consisting of a remote master station layer, a substation control layer, and a substation secondary equipment layer. Communication between the three layers is achieved through the power dispatch data network, the substation control layer, and the bay layer network.

[0038] The remote main station layer is equipped with dual-machine redundant primary and backup servers, integrating remote first-level authentication service (an example of the first authentication service), which is responsible for the unified verification of user identities and centralized distribution of authentication results across the entire network. It also has built-in functional units such as user data synchronization management, abnormal behavior analysis engine, global blocking rule control, security audit and persistent storage, and secure encryption of communication transmission, and is connected to a human-computer interaction module.

[0039] Each substation control layer independently deploys a local authentication and monitoring center, which contains a secondary distributed authentication node (an example of a second authentication service). This node provides centralized local authentication for equipment within the substation and acts as a message pass-through gateway between the remote master station layer and the secondary equipment layer. The center also includes sub-units for security monitoring and forwarding, secure encryption of communication transmission, and human-machine interaction within the substation.

[0040] The secondary equipment layer includes substation secondary equipment such as monitoring backend servers, protection devices, measurement and control devices, remote control devices, and maintenance laptops. Each substation secondary equipment is uniformly deployed with authentication request submodule, authentication status management module, security event collection submodule, and security command execution submodule. The authentication status management module is responsible for detecting the real-time connectivity status between the first authentication service and the second authentication service, and the security event collection submodule is responsible for generating and reporting structured events such as login and degradation.

[0041] In addition, the system includes a globally deployed transmission security encryption module and an operation and maintenance human-machine interaction module, providing security assurance and operation and maintenance access for cross-layer communication. The core interactions between the various layers of the system include authentication data streams, user synchronization data streams, monitoring and alarm data streams, and handling instruction issuance data streams, which together support the dynamic switching of multi-level authentication and the monitoring and closed-loop handling of security events.

[0042] exist Figure 1 Based on the system architecture shown, Figure 2 A schematic flowchart of a device authentication and monitoring method provided in an embodiment of this application is shown. Figure 2 As shown, the device authentication and monitoring method may include the following steps: Step 201: In response to a login request initiated by a user on a substation secondary device, obtain the connectivity status of at least two authentication services.

[0043] In this embodiment, a user-initiated login request refers to an operation triggered by maintenance personnel entering authentication credentials such as username and password on the human-machine interface or configuration tool login interface of the substation secondary equipment. The authentication request submodule deployed internally by the substation secondary equipment acts as a RADIUS client. Upon receiving the login request, it does not immediately encapsulate the authentication information into a RADIUS message and send it outwards. Instead, the authentication status management module first probes the connectivity status of the first and second authentication services to obtain the current reachability information of each authentication service, providing a decision-making basis for the dynamic selection of subsequent authentication processes.

[0044] The authentication status management module is a functional unit deployed within the secondary equipment of each substation, responsible for real-time monitoring of the connectivity of authentication services at all levels. This module completes initialization configuration upon device startup, reading the network addresses, port numbers, and shared keys of the first and second authentication services pre-installed in the device. It also sets the probe timeout (e.g., 3 seconds), maximum retransmission count (e.g., 3 times), and failure detection interval (e.g., 10 minutes). After initialization, the module enters a cyclical probe state, periodically sending probe messages (e.g., using OPTIONS messages or Status-Server messages) to the first and second authentication services, and determining their connectivity status based on the responses from each authentication service.

[0045] In one embodiment, the authentication status management module can determine the connectivity status according to the following mechanism: if a valid response (such as an Access-Accept message or other valid response) is received from the authentication service within a preset timeout period, the status of the corresponding authentication service is marked as reachable; if an authentication rejection response (such as an Access-Reject message) is received from the authentication service within the timeout period, the authentication service itself is still reachable, only indicating that the authentication request was actively rejected by the server. In this case, no degradation processing is triggered, and only the authentication failure event is recorded; if no response is received within the timeout period, retransmission is performed. When the number of retransmissions reaches the preset maximum number of retransmissions and no valid response is received, the status of the authentication service is marked as unreachable.

[0046] It should be noted that the system clearly distinguishes between Access-Reject and communication timeout: the former indicates that the authentication service has made a negative judgment on the user's identity and the authentication process should be terminated; the latter indicates that the authentication service itself is unreachable and should trigger the subsequent downgrade authentication mechanism.

[0047] In the actual application environment of a substation, the first authentication service is deployed at the remote master station layer. Substation secondary equipment needs to communicate with it through the station control layer network, the local authentication and monitoring center (as a gateway), and the power dispatch data network. The second authentication service is deployed at the substation control layer, and substation secondary equipment can interact with it directly through the substation network. Therefore, the authentication status management module initiates probes for both authentication services during the probe process, independently determining the connectivity status of each service, ultimately forming a complete view of the current reachability of the first and second authentication services for subsequent authentication processes to select from.

[0048] For example, in a specific login operation, after the maintenance personnel enter their username and password on the monitoring backend server of a substation and confirm, the authentication status management module of the substation's secondary equipment immediately sends probe packets to both the remote primary authentication service and the internal secondary distributed authentication node. If the remote primary authentication service returns a valid response within 3 seconds, it is marked as reachable; if the internal secondary distributed authentication node also returns a valid response within 3 seconds, it is also marked as reachable. At this point, the authentication status management module obtains the connectivity status of both the primary and secondary authentication services as reachable, and will subsequently select to execute the complete three-level authentication process accordingly. Conversely, if the remote primary authentication service times out without response for three consecutive probes, it is marked as unreachable, and a downgraded authentication process will be triggered.

[0049] In one embodiment, the step of obtaining connectivity status may specifically include: sending a probe message to the authentication service, wherein the probe message does not carry a username and password; if no valid response is received from the authentication service within a preset timeout period, a retransmission is performed; if no valid response is received after the number of retransmissions reaches a preset probe retransmission threshold, the authentication service is determined to be unreachable, wherein a valid response includes an authentication acceptance response or a status server response message; further, probe messages are sent to the authentication service marked as unreachable at preset time intervals; after receiving a valid response from the authentication service marked as unreachable to the probe message, the connectivity status of the authentication service is marked as reachable, and the connection status is switched to the target authentication process corresponding to all reachable authentication services. Thus, by using a probe method with a timeout retransmission mechanism to determine the connectivity status of the authentication service, and automatically switching the degraded process back to the normal process after the authentication service recovers, the system accurately identifies service unreachability and promptly restores security protection strength after service recovery, without manual intervention, achieving a dynamic balance between high security and high availability.

[0050] It should be noted that the specific implementation of obtaining connectivity status is executed by the authentication status management module. Probe messages are lightweight request messages proactively sent by substation secondary equipment to the authentication service. Their purpose is to test the network reachability and service availability of the authentication service, rather than submitting actual user identity verification information. Unlike Access-Request messages used for actual user authentication, probe messages do not carry authentication credentials such as usernames and passwords; they are only used for connectivity detection.

[0051] For example, the probe message can be the Status-Server message type defined in the RADIUS protocol. This message is specifically used to query the running status of the RADIUS server. When the server is running normally, it should return an Access-Accept or a dedicated Status-Server response.

[0052] The preset timeout period is the maximum time that secondary equipment in a substation can wait for a response after sending a probe message. In a substation network environment, communication latency can fluctuate due to the potential for multiple layers of network switching equipment between devices; therefore, the preset timeout period should not be set too short. For example, it can be set to 3 seconds, balancing probe efficiency and network fault tolerance. If the authentication status management module receives a valid response from the authentication service (such as an Access-Accept message or a Status-Server response message) within these 3 seconds, it immediately determines that the authentication service is reachable, and the probe ends.

[0053] In one possible implementation, if no response is received within a preset timeout period, the authentication status management module does not immediately determine that the authentication service is unreachable, but instead initiates a retransmission mechanism. The retransmission mechanism refers to the process of sending a probe packet to the same authentication service again and waiting for a response if no response is received. Each retransmission restarts the timer. When the cumulative number of retransmissions reaches the probe retransmission threshold (e.g., set to 3 times) and still no valid response is received, i.e., multiple consecutive probes time out, the authentication service is determined to be unreachable. This retransmission design effectively avoids misjudgments caused by instantaneous network jitter or occasional packet loss, improving the reliability of connectivity status determination.

[0054] Furthermore, when the authentication status management module marks an authentication service as unreachable and triggers a downgraded authentication process, the system does not remain in the downgraded state permanently. Instead, it continuously sends probe messages to the marked unreachable authentication service at preset time intervals (e.g., every 5 minutes). These probe messages are similar in nature to the aforementioned probe messages, being lightweight connectivity test messages. If, during the probe process, the marked unreachable authentication service resumes normal operation and returns a valid response to the probe messages, the authentication status management module immediately updates the connectivity status of that authentication service from unreachable to reachable and automatically switches the currently executing downgraded authentication process back to the normal authentication process matching this reachable state. For example, when a remote Level 1 authentication service recovers from unreachable to reachable, if the Level 2 distributed authentication node itself is also reachable at this time, the system automatically switches back from Level 2 downgraded authentication to full Level 3 authentication. The entire rollback process is automatically completed by the authentication status management module without manual intervention. Simultaneously, the security event collection submodule generates corresponding automatic rollback events, recording the rollback time, the accessible authentication service identifier, and the authentication level before and after the switch, and reports these to the local authentication and monitoring center. This automatic rollback mechanism ensures that the system can promptly restore to the highest security protection level after communication is restored, achieving a dynamic balance between security and availability.

[0055] For example, with Figure 3 Taking the authentication status management module workflow as an example, after the module starts, it first performs initialization configuration, and then enters the main loop to periodically send probe messages and wait for a response. When there is no response after a timeout, the retransmission count is incremented by 1. If the retransmission count is less than 3, it returns to the main loop to continue probing; if it reaches or exceeds 3, the server status is marked as unreachable, and the corresponding degradation mode is triggered according to the specific unreachable server identity. Figure 3 The loop execution logic of the above detection and judgment mechanism is fully presented.

[0056] Step 202: Based on the connectivity status, determine a target authentication process from a variety of pre-configured authentication processes and execute it.

[0057] Among them, multiple authentication processes all use the device local authentication step based on the permission data stored locally on the substation secondary equipment as the final authentication step, and the combination of authentication steps included before the device local authentication step in different authentication processes is different.

[0058] In this embodiment, the pre-configured multiple authentication processes refer to a set of optional authentication paths that are embedded in the authentication status management module during the factory or system deployment phase of the substation secondary equipment. The combinations of authentication steps preceding the local device authentication step in each authentication process are different, but all use the local device authentication step as the final authentication step. After obtaining the connectivity status of the first authentication service and the second authentication service, the authentication status management module automatically selects one of the multiple authentication processes as the target authentication process and executes it based on the current reachability of each authentication service.

[0059] In one possible implementation, there is a clear correspondence between the selection logic of the target authentication process and the connectivity status of each authentication service. Figure 4 A general flowchart of the multi-level user authentication method provided in this application embodiment is shown. This flowchart clearly illustrates the complete decision path for selecting different authentication processes based on connectivity state branches. (Refer to...) Figure 4 Once the authentication status management module completes the connectivity status detection, the system enters three different execution paths based on the reachability combination of the first authentication service and the second authentication service.

[0060] When the connectivity status indicates that both the first and second authentication services are reachable, the authentication status management module selects the complete authentication process as the target authentication process. This process includes three authentication steps: initiating authentication with the first authentication service, initiating authentication with the second authentication service, and performing local device authentication. At this time, the authentication request submodule inside the substation secondary equipment first encapsulates the authentication information entered by the user into a RADIUS Access-Request message and sends it to the remote first-level authentication service for first-level verification.

[0061] It should be noted that in the actual network environment of a substation, the secondary equipment is located at the secondary equipment layer and cannot directly establish a network connection with the remote master station layer. It must first connect to the local authentication and monitoring center via the station control layer network, and then the center communicates with the remote first-level authentication service through the power dispatch data network. Therefore, during the first-level authentication process, the local authentication and monitoring center deployed at the substation control layer operates in pure transparent transmission mode. It does not parse or modify the content of the Access-Request messages sent by the substation secondary equipment, but only performs Layer 2 or Layer 3 forwarding based on the destination address of the message, transparently transmitting the message to the remote first-level authentication service via the power dispatch data network. The Access-Accept or Access-Reject messages returned by the remote first-level authentication service are also transparently transmitted back to the substation secondary equipment via the local authentication and monitoring center along the original path.

[0062] In this embodiment, under the pure transparent transmission mode, the control of timeout retransmission is entirely dominated by the substation secondary equipment, and is unrelated to the local authentication and monitoring center that assumes the transparent transmission role. After the substation secondary equipment sends an Access-Request message, if it does not receive any response from the remote primary authentication service within the set timeout period, it will retransmit the message until the preset maximum number of retransmissions is reached. If an Access-Accept message is received from the remote primary authentication service within the maximum number of retransmissions, it indicates that the first-level authentication is successful, and the substation secondary equipment immediately initiates the second-level authentication by sending a new Access-Request message to the secondary distributed authentication node. After receiving the request, the secondary distributed authentication node queries the user's identity information and permission configuration in its locally stored user data copy. After successful verification, it returns an Access-Accept message, which the substation secondary equipment receives and proceeds to the third-level device local authentication stage. If an Access-Reject message is received from the remote primary authentication service during the first-level authentication process, it indicates that the user's identity verification has failed, and the authentication process is immediately terminated, without further second- and third-level authentication.

[0063] Similarly, for Level 2 authentication, if an Access-Reject message is received from the Level 2 distributed authentication node, the authentication process will also terminate immediately and will not proceed to the local device authentication stage. Figure 5 The sequence diagram illustrates the complete three-level authentication process under normal conditions. From left to right, the diagram lists five participating entities: the user, substation secondary equipment, remote primary authentication service, secondary distributed authentication node, and local device authentication. It describes the complete interactive process: after the user enters their username and password, the substation secondary equipment sequentially initiates a first-level Access-Request to the remote primary authentication service and receives an Access-Accept response; it then initiates a second-level Access-Request to the secondary distributed authentication node and receives an Access-Accept response; finally, after successful local device authentication, it returns a successful login message to the user. The process terminates immediately if any primary authentication level receives a Reject message.

[0064] In one embodiment, the aforementioned at least two authentication services include a first authentication service and a second authentication service. Step 202 may specifically include: when the connectivity status indicates that both the first and second authentication services are reachable, sending a first authentication request to the first authentication service; if an authentication acceptance response is received from the first authentication service, sending a second authentication request to the second authentication service; if an authentication acceptance response is received from the second authentication service, performing a local device authentication process; when the connectivity status indicates that the first authentication service is unreachable but the second authentication service is reachable, sending a second authentication request to the second authentication service; if an authentication acceptance response is received from the second authentication service, performing a local device authentication process; when the connectivity status indicates that both the first and second authentication services are unreachable, directly performing a local device authentication process. Therefore, by automatically switching between three processes—complete multi-level authentication, downgraded authentication, and pure local authentication—based on the reachability combination of the first and second authentication services, security is ensured while maximizing adaptability to different communication states, ensuring that the device can complete necessary authentication under various network conditions.

[0065] It should be noted that in all three processes described above, the local device authentication step serves as the final authentication step. When both the first and second authentication services are reachable, the local device authentication step includes two authentication steps: initiating authentication with the first authentication service and initiating authentication with the second authentication service. When the first authentication service is unreachable but the second authentication service is reachable, the local device authentication step only includes one authentication step: initiating authentication with the second authentication service. When both the first and second authentication services are unreachable, the local device authentication step does not include any steps initiating authentication externally. Regardless of the outcome of the aforementioned authentication steps, the user must ultimately pass the verification of the local device authentication step to complete the login. This structural design, with local device authentication as the final checkpoint, ensures that even if the upstream centralized authentication service is unexpectedly bypassed or breached, the local device permission verification still provides a final line of defense, effectively improving overall authentication security.

[0066] In this scenario, when the connectivity status indicates that the first authentication service is unreachable but the second authentication service is reachable, the target authentication process is the first-level downgraded authentication process. When the authentication status management module determines in the aforementioned embodiment that the remote first-level authentication service is unreachable (continuous probes time out and the maximum retransmission count is reached), but the second-level distributed authentication node is reachable, the system automatically selects this downgraded process as the target authentication process, skipping the authentication process initiated to the remote first-level authentication service and shifting the authentication starting point to the second-level distributed authentication node. Specifically, the authentication request submodule of the substation secondary equipment directly encapsulates the user authentication information into an Access-Request message and sends it to the second-level distributed authentication node for verification. At this time, the second-level distributed authentication node assumes the primary authentication responsibility, performing identity verification and permission matching based on the user data copy previously synchronized from the remote first-level authentication service. After successful verification, an Access-Accept message is returned, and the substation secondary equipment then enters the local device authentication phase. This downgraded process ensures that even in the event of remote communication interruption or remote server failure, on-site maintenance personnel can still complete identity verification and log in to the device through centralized local authentication plus local device verification, avoiding a situation where the device becomes completely unusable due to a single point of failure at the remote location.

[0067] When the connectivity status indicates that both the first and second authentication services are unreachable, the target authentication process is the second-level degraded authentication process, corresponding to the most extreme communication interruption scenario. When the authentication status management module determines that both the first and second authentication services are unreachable (continuous probe timeouts and both reaching the maximum retransmission count), it indicates that the communication links between the substation secondary equipment and both the internal and remote authentication services have been interrupted. In this case, the system selects this process as the target authentication process, completely skipping the centralized authentication steps of remote and local authentication, and only performing local device authentication. After receiving a user login request, the substation secondary equipment no longer attempts to send messages to any authentication service, but directly calls the locally stored user permission data to compare and verify the username and password entered by the user, and confirms whether the user has the authorization to operate the device and the corresponding operation role. This degraded process design ensures that even in the most unfavorable situation of complete communication interruption, maintenance personnel can still complete identity verification and log in to the device to perform emergency operations through local device authentication, ensuring the emergency response capability of the power system in extreme situations.

[0068] In one possible implementation, Figure 6 The complete process of the two downgrade authentication procedures described above is shown. (Refer to...) Figure 6Scenario 1: When the heartbeat detection mechanism shows that the remote Level 1 authentication service has repeatedly timed out and reached its retransmission limit, while the Level 2 distributed authentication node is reachable, the system marks the remote server as unreachable and automatically switches to a two-level authentication mode, performing local centralized authentication plus device-level local authentication. Successful authentication allows login and logs the results; failed authentication denies login and logs the results. (Refer to...) Figure 6 In scenario two, when the heartbeat detection mechanism shows that both the remote primary authentication service and the secondary distributed authentication node have timed out continuously and reached their retransmission limits, the system marks both as unreachable and automatically switches to a pure device-local authentication mode. Successful authentication allows login and logs the results; failed authentication denies login and logs the results. Simultaneously, all the aforementioned degradation switching events are generated into corresponding structured events by the security event collection submodule, recording key information such as the switching time, the authentication level before degradation, the authentication level after degradation, and the unreachable server identifier, and are reported to the local authentication and monitoring center.

[0069] In one embodiment, the method may further include: encapsulating at least one of the authentication requests sent to the first authentication service and the authentication requests sent to the second authentication service into a RADIUS protocol message for transmission. The remote authentication dial-up user service protocol message includes username attributes, password attributes, client identifier attributes, and device identifier attributes. Therefore, by encapsulating the authentication requests into standardized RADIUS protocol messages for transmission, the compatibility and standardization of authentication interactions between the device and the authentication service are improved, facilitating integration with existing network devices and authentication systems.

[0070] Specifically, when initiating an authentication request, the authentication request submodule within the substation's secondary equipment encapsulates the user-input username and password information into an Access-Request message according to the RADIUS protocol specification. This message includes fields such as username attribute, password attribute (encrypted with a shared key), client identifier attribute, and device identifier attribute. Upon receiving the Access-Request message, either the first or second authentication service verifies it. If verification succeeds, an Access-Accept message is returned; otherwise, an Access-Reject message is returned. Simultaneously, the RADIUS protocol also supports accounting functionality, recording the entire user login session through Accounting messages, including login start time, login end time, and session duration, providing data support for subsequent security audits and operation tracing. By employing the standardized RADIUS protocol for authentication message encapsulation and transmission, the method in this embodiment is compatible with existing mainstream network devices and authentication systems, exhibiting good versatility and scalability.

[0071] Step 203: During the execution of the target authentication process, authentication security events are collected and reported to the remote security monitoring center platform.

[0072] The remote security monitoring center platform is used to monitor and analyze abnormal behavior based on certified security events from various substations.

[0073] In this embodiment of the application, during the execution of the target authentication process, the security event acquisition submodule inside the substation secondary equipment synchronously generates structured authentication security event records at each key stage, and then... Figure 7 The process shown is a hierarchical reporting process to the remote security monitoring center platform. (Refer to...) Figure 7 When an authentication event occurs at the substation secondary equipment terminal, the security event collection submodule first branches the processing according to the event type: For authentication request events, it collects information such as username, device identifier, source IP, and authentication method; for authentication result events, it collects the authentication pass or fail result and the specific reason for failure; for downgrade switching events, it collects the switching time, the authentication level before and after downgrade, and the unreachable server identifier; for server status events, it collects the status change information of authentication service recovery or interruption; for user operation events, it directly collects the key operation logs after the user successfully logs in.

[0074] After the aforementioned events are encapsulated into security event messages by the security event acquisition submodule according to a custom communication protocol, they are uploaded to the local security monitoring and forwarding unit within the station. This unit parses and standardizes the messages and stores them in a local time-series database. Following local processing, the local security monitoring and forwarding unit performs alarm storm suppression judgment on the events: for first-time authentication service unreachable alarms or normal authentication events, they are forwarded transparently, and the globally deployed transmission security encryption module encrypts the messages using Transport Layer Security (TLS) before reporting them to the abnormal behavior analysis engine unit of the remote security monitoring center platform via the power dispatch data network; for suppressable recurring alarm events, they are only recorded locally and not reported again. Finally, the security events reported to the remote security monitoring center platform are displayed on the front-end visualization screen in real-time scrolling, geographical views, and overall situational awareness for maintenance personnel to monitor in real time.

[0075] In one embodiment, the steps of collecting authentication security events and reporting them to the remote security monitoring center platform may specifically include: generating corresponding authentication security events based on the authentication behaviors that occur during the execution of the target authentication process. These authentication security events include at least one of authentication request events, authentication result events, downgrade switching events, server status events, and user operation events. Authentication request events carry at least the username, device identifier, source IP, and authentication method; authentication result events carry at least the authentication pass / fail result and the reason for failure; downgrade switching events carry at least the switching time, the authentication level before and after downgrade, and the unreachable authentication service identifier; server status events carry at least the status change information of authentication service recovery or interruption; and user operation events carry at least the operation log after successful login. The authentication security events are then encapsulated into security event messages and sent to the remote security monitoring center platform. Thus, by defining multiple types of authentication security events and their key fields, the scattered information generated during the execution of the target authentication process is collected in a structured and unified manner, enabling the remote security monitoring center platform to obtain comprehensive and standardized authentication security data, providing a reliable data foundation for monitoring and subsequent abnormal behavior analysis.

[0076] The custom communication protocol uses the Transmission Control Protocol (TCP) for message exchange. The basic message format includes three parts: message header, message body, and message trailer. The message header contains a message identifier (defined as 0xCC), message type (0x01 indicates a security event upload message type, 0x02 indicates a security blocking and handling message type), message subtype, and data content length (network byte order). The message body carries the specific data content. The message trailer contains a data content checksum (the sum of the message body data content) and a message trailer identifier (defined as 0xFF). The message type for security event upload messages is 0x01, and its message subtypes can be further divided into secondary equipment body events (0x01), substation local authentication center events (0x02), or main station platform events (0x03). Security blocking messages are divided into downlink messages and uplink messages, both of which are of type 0x02. Downlink message subtypes include forced user offline (0x01), account lock (0x02), source IP ban (0x03), and authentication policy switch (0x04). Uplink message subtypes correspond to downlink messages. A return value field is added to the message body. A return value of 0 indicates successful execution, while other return values ​​indicate an error and carry the corresponding error code.

[0077] In one possible implementation, the abnormal behavior analysis engine unit deployed within the remote security monitoring center platform is responsible for performing real-time correlation analysis on reported network-wide authentication security events to identify potential intrusion behaviors. Figure 8A working flow of the abnormal behavior analysis engine is shown. With reference to Figure 8 , when the abnormal behavior analysis engine receives the security authentication event streams from each substation, event preprocessing is performed first, and quintuple information including user, equipment, source IP, time and authentication result is extracted from each event. After the preprocessing is completed, the engine performs matching of multiple types of attack detection rules in parallel, including: brute-force cracking detection (judging whether the number of consecutive authentication failures of the same user or the same source IP within a time window exceeds the authentication failure frequency threshold), abnormal time login detection (judging whether an authentication login event occurs during a non-maintenance period), lateral penetration detection (judging whether the same user successfully logs in to multiple different devices within a short period of time), abnormal source IP detection (judging whether an authentication request comes from an unauthorized network address segment), distributed slow attack detection (judging whether multiple source IPs cooperatively initiate low-frequency authentication requests), and permission overstepping detection (judging whether the user's login permission exceeds the scope bound to the user's equipment). For an authentication behavior that matches any rule, the engine enters risk level assessment, and divides alerts into three levels: high risk, medium risk and low risk: high-risk alerts (such as brute-force cracking attacks, lateral penetration characteristics, access from abnormal source IPs) trigger multi-channel alert pushing, including short message or Application (APP) pushing, sound and light alarm, large screen flashing identification and other methods, and meanwhile transfer to the subsequent linkage disposal process; medium-risk alerts (such as login at abnormal time, distributed slow attacks) trigger alert pushing and record audit logs; low-risk alerts (such as permission overstepping attempts) only record audit logs and make marking prompts on the monitoring interface. To reduce false positives, the abnormal behavior analysis engine also supports configuring network address whitelists and user whitelists. Authentication behaviors initiated by source IPs or users in the whitelist do not trigger abnormal alerts, but authentication failure events still normally record audit logs. When a certain type of alert is marked as a false positive multiple times within a certain period of time, the remote security monitoring center platform prompts operation and maintenance personnel to re-evaluate whether the threshold parameter of the rule is reasonable, supports online adjustment of detection rules, and realizes adaptive optimization of the rules.

[0078] In one embodiment, the aforementioned abnormal behavior analysis may specifically include: matching authentication security events with at least one detection rule; the detection rule includes at least one of the following: if the same user or the same source IP fails authentication more than a preset authentication failure threshold within a preset time window, it is determined to be a brute-force attack; if an authentication login event occurs outside of maintenance periods, it is determined to be an abnormal time login; if the same user successfully logs into multiple different devices within a preset time, it is determined to be a lateral movement; if the authentication request comes from an unauthorized network address range, it is determined to be an abnormal source IP access; if multiple source IPs collaboratively initiate low-frequency authentication requests, it is determined to be a distributed slow attack; if any detection rule matches, the attack behavior is identified. Therefore, by matching authentication security events with multiple attack detection rules, attack behaviors such as brute-force attacks, abnormal time logins, lateral movement, abnormal source IP access, and distributed slow attacks can be automatically identified from different dimensions, thereby improving the ability to detect security threats during the login authentication process and the timeliness of response.

[0079] In one embodiment, after identifying an attack, the attack can be categorized into high-risk, medium-risk, or low-risk alerts based on the attack type corresponding to the detected rules. In the case of a high-risk alert, an alert is pushed via at least one of SMS, application push notifications, or audible and visual alarms, and the process is initiated to issue a coordinated response command. In the case of a medium-risk alert, an alert is pushed via SMS or application push notifications, and the alert information is displayed on the monitoring interface, along with an audit log. In the case of a low-risk alert, an audit log is recorded, and a notification is displayed on the monitoring interface. Therefore, by classifying identified attacks into different alert levels and implementing differentiated push notifications and response procedures based on alert level, operations and maintenance personnel can prioritize high-risk threats while avoiding excessive resource consumption by low-risk events, thus improving the efficiency of security operations and maintenance.

[0080] In one possible implementation, Figure 9 The interface layout and functional modules of the remote security monitoring center platform are shown. Figure 9As shown, the platform interface is divided into two parts: the front-end interface and the back-end data processing architecture. In the front-end interface, the upper left area is a geographic information view, using different colors to indicate the current authentication status of each substation on a geographical distribution map (green indicates normal, yellow indicates authentication failure or downgrade alarms, and red indicates suspected intrusion behavior detected). The lower left area is a panoramic overview, displaying statistics such as the number of currently online users, the number of authentication requests today, the number of authentication failures today, the number of pending alarms, and the number of substations with downgraded authentication. Simultaneously, the platform also supports authentication success rate trend analysis, statistically analyzing the success rate, failure rate, and downgrade rate of authentication at each level over time, assisting maintenance personnel in assessing the overall health of the authentication service. The upper right area is an abnormal alarm list, displaying alarm time, alarm content, and alarm level in a table format. The lower right area is a real-time authentication scrolling area, displaying the authentication event process initiated by secondary equipment in each substation in real-time in a list format. The bottom area is a quick operation bar for manual handling by maintenance personnel, including quick operation buttons for forced user offline, account locking, source IP blocking, and switching authentication strategies. The backend data processing architecture is divided into a left-side data acquisition and analysis process and a right-side disposal instruction issuance process, which together form a complete monitoring and disposal closed loop.

[0081] Step 204: When the remote security monitoring center platform identifies the attack behavior based on abnormal behavior analysis and issues a response instruction, the substation secondary equipment receives and executes the response instruction to block user login and the attack.

[0082] In this embodiment of the application, when the abnormal behavior analysis engine unit inside the remote security monitoring center platform identifies a high-risk attack behavior and triggers an alarm, the system can initiate a coordinated response to the secondary equipment of the substation through the global blocking rule control unit of the remote security monitoring center platform. Figure 10 This illustrates the issuance and execution process of coordinated response commands from the remote security monitoring center platform. (Refer to...) Figure 10 When a high-risk anomaly alarm triggers and a coordinated response is initiated, the response triggering method is divided into two branches: manual and automatic. In the manual branch, maintenance personnel select the response type (one of four types: forced user offline, account lockout, source IP blocking, or authentication policy switching) on ​​the remote security monitoring center platform. The system constructs the necessary information for the response instruction based on the selected type, and issues it after secondary confirmation. In the automatic branch, the abnormal behavior analysis engine automatically matches and constructs the necessary information for the response instruction based on the alarm type, issuing it directly without manual confirmation. After the response instruction is issued to the substation secondary equipment via the network, the system waits for the substation secondary equipment to return an execution response. Based on the response result, it proceeds to one of three branches: execution success, execution failure, or execution timeout, ultimately converging at the platform to update and record the blocking response result.

[0083] In one embodiment, the step of receiving and executing a disposal instruction to block user login and attack may specifically include: receiving a disposal instruction issued by a remote security monitoring center platform, wherein the disposal instruction includes at least one of forcing the user offline, locking the account, banning the source IP, and switching an authentication policy; writing the blocking rule corresponding to the disposal instruction into the local non-volatile memory of the secondary equipment of the substation, so that the blocking rule still takes effect after the secondary equipment of the substation is restarted; executing a corresponding blocking operation according to the disposal instruction, wherein the blocking operation corresponding to the instruction of forcing the user offline is terminating the current session of the user and logging out, the blocking operation corresponding to the instruction of locking the account is preventing the user from subsequent logins, the blocking operation corresponding to the instruction of banning the source IP is adding the source IP to the local blacklist and rejecting the authentication request initiated by the source IP, and the blocking operation corresponding to the instruction of switching the authentication policy is switching the authentication mode to the enhanced authentication mode; after the blocking operation is completed, returning an execution confirmation message to the remote security monitoring center platform. Therefore, by persistently writing the blocking rule corresponding to the disposal instruction into the local non-volatile memory of the secondary equipment of the substation, and executing corresponding blocking operations for different types of disposal instructions, the blocking effect can still be maintained after the equipment is restarted, effectively preventing attackers from bypassing the blocking by restarting the equipment, and improving the reliability and durability of the disposal.

[0084] In a possible implementation, Figure 11 further illustrates the linked disposal instruction response process on the secondary equipment side of the substation. With reference to Figure 11 , after the security instruction execution sub-module of the secondary equipment of the substation receives the security disposal instruction issued by the remote security monitoring center platform, it first writes the blocking rule into the local non-volatile memory (such as flash memory) to ensure that the blocking rule still takes effect after the equipment is restarted, and prevent an attacker from bypassing the blocking after the equipment is restarted. Then, the security instruction execution sub-module executes specific disposal operations according to the instruction type: for the instruction of forcing the user offline, forcibly terminate the suspicious session and log out immediately; for the instruction of locking the account, lock the account to prevent it from subsequent login; for the instruction of banning the source IP, add the network address to the local blacklist of the equipment and reject its subsequent authentication requests; for the instruction of switching the authentication policy, switch the equipment to the enhanced authentication mode (such as enabling multi-factor authentication or administrator approval). No matter what disposal operation is executed, the secondary equipment of the substation will return a confirmation message of successful or failed execution to the remote security monitoring center platform after completion, and uniformly record the disposal result log. The global blocking rule control unit of the remote security monitoring center platform regularly synchronizes the blocking status with the secondary equipment of each substation, so as to ensure that the blocking status recorded by the platform is consistent with the actual execution status of the equipment.

[0085] Wherein, the security disposal instruction can be encapsulated by a custom TCP communication protocol, the message type of the downlink disposal message is 0x02, and the message body contains the specific blocking disposal content.

[0086] In one possible implementation, once the attack has been confirmed and resolved, the operations and maintenance personnel can manually issue a command to unblock the attack through the remote security monitoring center platform. Figure 12 A schematic diagram illustrating the operation process for deactivating the authentication security monitoring system from its deactivated state is shown. (Refer to...) Figure 12 After manual confirmation that the threat has been eliminated, the remote security monitoring center platform queries the current blocking status of the substation's secondary equipment. Upon confirming that blocking is in progress, it manually issues a release command, which is transmitted to the substation's secondary equipment via the local security monitoring forwarding unit. Upon receiving the release command, the substation's secondary equipment clears its local blocking rules and returns a release confirmation message to the remote security monitoring center platform. The remote security monitoring center platform receives this message, updates the release status, and records it in the audit log. The substation's secondary equipment then resumes the user's normal multi-level authentication login process.

[0087] In one possible implementation, Figure 13 The overall deployment architecture of the authentication system according to an embodiment of this application is shown. (Refer to...) Figure 13 Within the remote master station area, a remote primary authentication service master server and slave servers are deployed, working collaboratively in a dual-machine redundancy configuration. The master server handles all authentication requests during normal operation and automatically switches to the slave server in case of failure. The remote master station is connected to the substation via a power dispatch data network, which carries various interactive functions including periodic user data synchronization, authentication server status detection, user authentication operation message exchange, and optional encrypted channels. Within the substation's local area, a secondary distributed authentication node is deployed. This node connects upwards to the remote master station via the power dispatch data network and downwards to RADIUS clients in various substation secondary equipment, such as monitoring backend servers, protection devices, measurement and control devices, and remote control devices, via the station control layer network and bay layer network. Each substation secondary device is configured with the network address, port number (default 1812), and shared key of the remote primary authentication service and the secondary distributed authentication node, supporting both RADIUS and local fallback authentication modes.

[0088] In this embodiment, the message interactions involved in the authentication data stream, monitoring alarm data stream, and handling instruction issuance data stream can all be encrypted using a globally deployed transmission security encryption module. This module is uniformly responsible for the verification of custom TCP messages, management of TLS encrypted channels, distribution of digital certificates and key updates, and adds message replay and tamper-proof verification capabilities to ensure end-to-end security of communication between the scheduling data network and the station control layer network.

[0089] In one embodiment, the above method may further include: after a substation secondary device determines that the authentication service is unreachable and reports a degradation alarm, it will not report the same degradation alarm again until the authentication service becomes reachable again. Specifically, for alarms from multiple substation secondary devices within the same substation regarding the same authentication service being unreachable, the local security monitoring forwarding unit aggregates and reports them to the remote security monitoring center platform, ensuring that the remote security monitoring center platform only displays a single alarm and avoids frequent alarms for repeated events. After the authentication service is first marked as unreachable, the substation secondary device delays reporting the alarm for a preset delay period. If the authentication service becomes reachable again during the delay period, no alarm is generated. The handling instructions include temporary blocking instructions or permanent blocking instructions. Temporary blocking instructions are automatically lifted after a preset effective period, while permanent blocking instructions are lifted upon receiving a release instruction from the remote security monitoring center platform. The remote security monitoring center platform maintains a list of blocking rules for the entire network and periodically synchronizes the blocking status with each substation secondary device. Therefore, the alarm suppression mechanism avoids the interference of a large number of repeated alarms to the operation and maintenance personnel, and the blocking status management mechanism ensures the continuous effectiveness and accurate synchronization of blocking rules, thereby improving the reliability of monitoring and handling.

[0090] It should be noted that the alarm suppression mechanism is used to prevent a large number of substation secondary devices from simultaneously reporting alarms of the same nature during communication anomalies, thereby reducing the alarm processing pressure on the remote safety monitoring center platform and lowering the cognitive burden on maintenance personnel when faced with a large number of similar alarms on the monitoring interface. The blocking status management mechanism, by distinguishing between temporary and permanent blocking and periodically synchronizing blocking rules, ensures that the blocking status is consistent between different substation secondary devices and between substation secondary devices and the remote safety monitoring center platform, preventing blocking measures from failing or being bypassed due to inconsistent status.

[0091] Step 205: If an authentication rejection response is received from any authentication service during the execution of the target authentication process, the current authentication process is terminated and the user is denied login.

[0092] In cases where the connectivity status indicates the existence of an unreachable authentication service, the selected target authentication process is a downgraded authentication process, which includes an authentication step initiated to an reachable authentication service and a local device authentication step.

[0093] In this embodiment, an authentication rejection response refers to an Access-Reject message proactively returned by the authentication service after verifying the authentication request sent by the substation secondary equipment, due to reasons such as invalid user identity, incorrect password, or insufficient permissions. This message is fundamentally different in nature from communication timeout or no response: the former indicates that the authentication service has made a clear negative judgment on the user's identity, while the latter indicates that the authentication service itself is unavailable.

[0094] It should be understood that regardless of whether a full authentication process or a downgraded authentication process is currently in progress, as soon as the substation secondary equipment receives an Access-Reject message from any participating authentication service, the current authentication process will immediately terminate, and the user will be denied login. Subsequent authentication steps will not continue. This rule ensures the security boundary of the authentication system: once an authoritative authentication service clearly determines that a user's identity is illegitimate, the system will reject the user without any downgrade or compromise.

[0095] In this embodiment, the downgraded authentication process is a fault-tolerant authentication path specifically designed to address situations where authentication services are unreachable. When the authentication status management module determines in step 201 that an unreachable authentication service exists, the target authentication process selected in step 202 is the downgraded authentication process. The core feature of the downgraded authentication process is that it skips the step of initiating an authentication request to the unreachable authentication service, only initiating authentication to the authentication service that is in a reachable state, and performing the device local authentication step after the authentication is successful.

[0096] For example, if the remote primary authentication service is unreachable but the secondary distributed authentication node is reachable, the downgraded authentication process includes two stages: an authentication step initiated to the secondary distributed authentication node and a local device authentication step. If both the remote primary authentication service and the secondary distributed authentication node are unreachable, the downgraded authentication process only includes one stage: the local device authentication step. The downgraded authentication process follows the same rule as the normal authentication process, where the process terminates upon receiving an Access-Reject request at any stage. The only difference is that the number of stages sending authentication requests is reduced due to the unavailability of some authentication services.

[0097] In one embodiment, user permission data can also be received and stored locally on the substation secondary equipment. At least two authentication services are included: a first authentication service and a second authentication service. User permission data is pushed from the first authentication service to the second authentication service via a one-way synchronization method, and then forwarded to the substation secondary equipment by the second authentication service. One-way synchronization includes periodic full synchronization and change-triggered incremental synchronization. During the local equipment authentication process, the locally stored user permission data is retrieved, and the username and password entered by the user are compared and verified against the user permission data. If the verification passes, the user is allowed to log in, and operation permissions are assigned according to the user's corresponding operation role recorded in the user permission data. Operation roles include at least one of read-only, operator, administrator, and auditor. Therefore, by pre-caching user permission data locally on the substation secondary equipment and performing verification and role allocation based on the cached data during local equipment authentication, effective identity verification and access control can still be achieved based on the latest permission information even in extreme cases where communication is completely interrupted and all authentication services are unavailable, ensuring the availability of emergency maintenance operations.

[0098] It should be noted that the user permission data relied upon for the local authentication process is not maintained independently by the substation secondary equipment. Instead, it is pre-obtained from a remote authoritative data source and cached locally through a cascading synchronization mechanism. Specifically, the substation secondary equipment, through its deployed security instruction execution submodule and authentication status management module, receives user permission data issued via the secondary distributed authentication node and stores this data in non-volatile storage media on the substation secondary equipment's local machine. This user permission data is a structured list, with each record containing at least the username, the password encrypted using a salted hash algorithm, the scope of devices the user is authorized to operate on, and the corresponding operation role. The operation role defines the functional permission level that the user possesses after successful login. For example, operation roles can include read-only, operator, administrator, auditor, etc., with different roles corresponding to different sets of operation permissions.

[0099] When the target authentication process reaches the local authentication stage, the authentication request submodule of the substation secondary equipment reads the cached user permission data from local non-volatile storage and verifies the username and password entered by the user. The verification process includes: checking if the user exists in the locally cached user list; if so, calculating the ciphertext using the same salted hash algorithm on the entered password and comparing it with the ciphertext in the cache; if the ciphertexts match, authentication is successful, and the user is assigned the corresponding operation permissions based on their corresponding operation role in the cache. If the user is not in the local cache list, or the password ciphertext does not match, local authentication fails, user login is denied, and the authentication failure event is recorded. By pre-caching user permission data locally on the substation secondary equipment, even in extreme situations where communication is completely interrupted and all authentication services are unavailable, the substation secondary equipment can still independently complete authentication based on the latest permission information, ensuring the availability of emergency maintenance operations.

[0100] In one embodiment, the remote primary authentication service's verification of authentication requests also includes session uniqueness control and user binding scope control. Session uniqueness control means that the remote primary authentication service can be configured to allow the same user to establish multiple login sessions simultaneously. Under the default security policy, if the same user, already logged into one device, attempts to log into another, the system allows the login but records the unauthorized login event and sends an alarm. User binding scope control means that a user account can be associated with the range of substations and devices it is allowed to log into. When a substation secondary device initiates authentication, it sends its device identifier along with the authentication request. The remote primary authentication service verifies whether the user is within the authorized device range. If the user attempts to log into an unauthorized device, the remote primary authentication service directly returns Access-Reject, and the authentication process terminates.

[0101] In one possible implementation, user permission data synchronization employs a one-way synchronization architecture with a remote primary authentication service as the sole data source, distributed tiered through secondary distributed authentication nodes to substation secondary equipment. One-way synchronization means that user permission data flows only from the remote primary authentication service to the secondary distributed authentication nodes, and then from the secondary distributed authentication nodes to the secondary equipment in each substation. All add, delete, and modify operations on user information are completed uniformly on the remote primary authentication service. The secondary distributed authentication nodes and substation secondary equipment act only as read-only data copies and do not have independent permissions to modify user data. This one-way synchronization design ensures the consistency and authority of user permission data across the entire network.

[0102] In terms of the synchronization triggering mechanism, this application embodiment adopts a combination of periodic full synchronization and change-triggered incremental synchronization. Periodic full synchronization is performed at a preset time period (e.g., 1 hour). The remote primary authentication service pushes complete user information data (including username, password encrypted with a salted hash algorithm, permission roles, substation affixed to, and the binding scope of loggable devices) to the secondary distributed authentication nodes of each substation. Upon receiving this data, the secondary distributed authentication nodes completely overwrite their locally stored user data copies. Change-triggered incremental synchronization is triggered in real-time by the remote primary authentication service when user information is added, deleted, or modified. The updated incremental data is immediately pushed to the relevant secondary distributed authentication nodes, ensuring that critical changes (such as account deletion or permission modification) take effect within a second-level time window, preventing deleted accounts from continuing to authenticate locally due to data synchronization delays. After updating their local user data copies, the secondary distributed authentication nodes then synchronize and distribute permission data to all secondary devices in the substation via the substation network, completing the final cache update of user permission data.

[0103] Furthermore, the synchronization mechanism incorporates fault-tolerant handling logic for synchronization failures. If a secondary distributed authentication node fails to receive synchronization data from the remote primary authentication service due to network interruption or other reasons, it continues to use the previously successfully synchronized user data copy to provide authentication services, while recording the synchronization failure event and reporting it via the security event collection submodule. When the number of consecutive synchronization failures exceeds a set threshold (e.g., set to 3 times), the secondary distributed authentication node will mark itself as having expired data and append an expired data flag to its returned authentication response, prompting the remote security monitoring center platform to intervene manually.

[0104] In one possible implementation, Figure 14 This illustrates the workflow of the master and slave stations working collaboratively in the authentication security monitoring system. (Refer to...) Figure 14 The process consists of two data transmission paths. The upper path, from left to right, is the authentication event upload path: the substation secondary equipment reports the authentication security events to the local server, which then uploads them to the remote security monitoring center platform via the power dispatch data network, achieving hierarchical aggregation and centralized storage of security events. The lower path, from right to left, is the security handling instruction issuance path: the remote security monitoring center platform issues security handling instructions, which are then forwarded to the substation secondary equipment via the power dispatch data network and the local server. After execution, the substation secondary equipment returns the execution result, which is then reported hierarchically to the remote security monitoring center platform.

[0105] The device authentication and monitoring method disclosed in the above embodiments of this application mainly achieves authentication capability by dynamically sensing the real-time connectivity status of multiple authentication services and adaptively selecting and executing multiple authentication processes, including local device authentication, thereby maintaining authentication capability even when some authentication services are unavailable, effectively ensuring the availability of login authentication in communication anomaly scenarios. At the same time, by collecting authentication security events and reporting them to a remote security monitoring center platform for monitoring and abnormal behavior analysis, and receiving and executing handling instructions to block user login and attacks when attack behavior is identified, a closed-loop linkage of security authentication, security monitoring and security handling control is realized, thereby improving the overall security of the device.

[0106] See Figure 15 The diagram shows a structural schematic of a device authentication and monitoring apparatus provided in an embodiment of this application. For ease of explanation, only the parts related to the embodiment of this application are shown.

[0107] The device authentication and monitoring system may specifically include the following modules: The status acquisition module 1501 is used to obtain the connectivity status of at least two authentication services in response to a login request initiated by a user in the secondary equipment of the substation.

[0108] The process management module 1502 is used to determine and execute a target authentication process from a variety of pre-configured authentication processes based on the connectivity status. Each of the various authentication processes uses a device-local authentication step based on permission data stored locally on the substation's secondary equipment as the final authentication step, and the combinations of authentication steps preceding the device-local authentication step are different in each authentication process. If the connectivity status indicates the existence of an unreachable authentication service, the selected target authentication process is a downgraded authentication process, which includes an authentication step initiated to a reachable authentication service and the device-local authentication step.

[0109] The event acquisition module 1503 is used to acquire authentication security events and report them to the remote security monitoring center platform during the execution of the target authentication process. The remote security monitoring center platform is used to monitor and analyze abnormal behavior based on the authentication security events from various substations.

[0110] The handling execution module 1504 is used to receive and execute the handling instructions to block the user login and the attack when the remote security monitoring center platform identifies the attack behavior based on the abnormal behavior analysis and issues the handling instructions in a coordinated manner.

[0111] The termination processing module 1505 is used to terminate the current authentication process and refuse the user login if an authentication rejection response is received from any of the authentication services during the execution of the target authentication process.

[0112] The device authentication and monitoring apparatus disclosed in the above embodiments of this application mainly dynamically senses the real-time connectivity status of multiple authentication services and adaptively selects and executes various authentication processes, including local device authentication, thereby maintaining authentication capabilities even when some authentication services are unavailable, effectively ensuring the availability of login authentication in communication anomaly scenarios. At the same time, by collecting authentication security events and reporting them to a remote security monitoring center platform for abnormal behavior analysis, and receiving and executing handling instructions to block user login and attacks when attack behavior is identified, a closed-loop linkage of security authentication, security monitoring, and security handling control is realized, thereby improving the overall security of the device.

[0113] Furthermore, in one possible implementation of this application embodiment, the event acquisition module 1503 may specifically include the following units: The event generation unit is used to generate corresponding authentication security events based on the authentication behaviors that occur during the execution of the target authentication process. These authentication security events include at least one of the following: authentication request events, authentication result events, downgrade switching events, server status events, and user operation events. Authentication request events at least carry the username, device identifier, source network address, and authentication method. Authentication result events at least carry the result of authentication success or rejection and the reason for failure. Downgrade switching events at least carry the switching time, the authentication level before and after downgrade, and the identifier of the unreachable authentication service. Server status events at least carry information about the status change of authentication service recovery or interruption. User operation events at least carry operation logs after successful login.

[0114] The encapsulation and transmission unit is used to encapsulate authentication security events into security event messages and send them to the remote security monitoring center platform.

[0115] Therefore, by defining various types of authentication security events and their key fields, the scattered information generated during the execution of the target authentication process is collected in a structured manner and reported in a unified manner. This enables the remote security monitoring center platform to obtain comprehensive and standardized authentication security data, providing a reliable data foundation for monitoring and subsequent abnormal behavior analysis.

[0116] Furthermore, in another possible implementation of this application embodiment, the remote security monitoring center platform is used to match authentication security events with at least one detection rule; the detection rule includes at least one of the following: if the number of consecutive authentication failures of the same user or the same source network address within a preset time window exceeds a preset authentication failure number threshold, it is determined to be a brute-force attack; if an authentication login event occurs outside of maintenance periods, it is determined to be an abnormal time login; if the same user successfully logs into multiple different devices within a preset time, it is determined to be a lateral movement; if the authentication request comes from an unauthorized network address segment, it is determined to be an abnormal source network address access; if multiple source network addresses collaboratively initiate low-frequency authentication requests, it is determined to be a distributed slow attack; if any detection rule is matched, the attack behavior is identified.

[0117] Therefore, by matching authentication security events with various attack detection rules, it is possible to automatically identify attack behaviors such as brute-force attacks, abnormal login times, lateral movement, abnormal source network address access, and distributed slow attacks from different dimensions, thereby improving the ability to detect security threats during the login authentication process and the timeliness of response.

[0118] Furthermore, in another possible implementation of this application embodiment, the remote security monitoring center platform is further configured to, after determining that an attack has been identified, classify the attack into high-risk, medium-risk, or low-risk alarms according to the attack type corresponding to the hit detection rule; in the case of a high-risk alarm, push an alarm via at least one of SMS, application push, or audible and visual alarms, and initiate a linkage handling instruction issuance process; in the case of a medium-risk alarm, push an alarm via SMS or application push, display the medium-risk alarm information on the monitoring interface, and record audit logs; in the case of a low-risk alarm, record audit logs and provide a notification on the monitoring interface.

[0119] Therefore, by classifying and alerting identified attack behaviors and implementing differentiated push and handling processes based on the alert level, operations and maintenance personnel can prioritize high-risk threats while avoiding excessive occupation of operations and maintenance resources by low-risk events, thereby improving the efficiency of security operations and maintenance.

[0120] Furthermore, in another possible implementation of this application embodiment, the above-mentioned processing execution module 1504 may specifically include the following units: The instruction receiving unit is used to receive disposal instructions issued by the remote security monitoring center platform. The disposal instructions include at least one of the following: forcing users offline, locking accounts, blocking source network addresses, and switching authentication policies.

[0121] The rule writing unit is used to write the blocking rules corresponding to the handling instructions into the local non-volatile storage of the substation secondary equipment so that the blocking rules remain effective after the substation secondary equipment is restarted.

[0122] The blocking execution unit is used to execute corresponding blocking operations according to the handling instructions. Among them, the blocking operation corresponding to the instruction to force the user offline is to terminate the user's current session and log out; the blocking operation corresponding to the instruction to lock the account is to prevent the user from logging in later; the blocking operation corresponding to the instruction to block the source network address is to add the source network address to the local blacklist and reject the authentication request initiated by the source network address; and the blocking operation corresponding to the instruction to switch the authentication policy is to switch the authentication mode to the enhanced authentication mode.

[0123] The receipt return unit is used to return an execution confirmation message to the remote security monitoring center platform after the blocking operation is completed.

[0124] Therefore, by persistently writing the blocking rules corresponding to the handling instructions into the local non-volatile storage of the substation secondary equipment, and performing corresponding blocking operations for different types of handling instructions, the blocking effect can still be maintained after the equipment is restarted, effectively preventing attackers from bypassing the blocking by restarting the equipment, thus improving the reliability and durability of the handling.

[0125] Furthermore, in another possible implementation of this application embodiment, the above-mentioned device authentication and monitoring device may further include the following modules: The alarm and blocking management module is used to prevent the repeated reporting of the same downgrade alarm after determining that the authentication service is unreachable and reporting a downgrade alarm, until the authentication service becomes reachable again. Specifically, for alarms from multiple substation secondary devices within the same substation indicating that the same authentication service is unreachable, the local security monitoring forwarding unit aggregates and reports them to the remote security monitoring center platform, so that the remote security monitoring center platform only displays a single alarm and avoids frequent alarms for repeated events. After the authentication service is first marked as unreachable, the substation secondary device reports an alarm after a preset delay period. If the authentication service becomes reachable again during the delay period, no alarm is generated. Handling instructions include temporary blocking instructions or permanent blocking instructions. Temporary blocking instructions are automatically lifted after a preset effective period, while permanent blocking instructions are lifted upon receiving a lift instruction from the remote security monitoring center platform. The remote security monitoring center platform maintains a list of blocking rules for the entire network and periodically synchronizes the blocking status with each substation secondary device.

[0126] Therefore, the alarm suppression mechanism avoids the interference of a large number of repeated alarms to the operation and maintenance personnel, and the blocking status management mechanism ensures the continuous effectiveness and accurate synchronization of blocking rules, thereby improving the reliability of monitoring and handling.

[0127] Furthermore, in another possible implementation of this application embodiment, the above-mentioned device authentication and monitoring device may further include the following modules: The local authentication processing module receives user permission data and stores it locally on the substation secondary equipment. At least two authentication services are included: a first authentication service and a second authentication service. User permission data is pushed from the first authentication service to the second authentication service via a one-way synchronization method, and then forwarded to the substation secondary equipment by the second authentication service. One-way synchronization includes periodic full synchronization and change-triggered incremental synchronization. During the local authentication process, the module retrieves the locally stored user permission data, compares and verifies the username and password entered by the user with the user permission data, and allows the user to log in if the verification is successful. Operation permissions are assigned according to the user's corresponding operation role recorded in the user permission data. Operation roles include at least one of read-only, operator, administrator, and auditor.

[0128] Therefore, by pre-caching user permission data locally on the substation's secondary equipment and performing verification and role allocation based on the cached data during local equipment authentication, effective identity verification and access control can still be completed based on the latest permission information even in extreme cases where communication is completely interrupted and all authentication services are unavailable, ensuring the availability of emergency operation and maintenance.

[0129] Furthermore, in another possible implementation of this application embodiment, the above-mentioned process management module 1502 may specifically include the following units: The first execution unit is configured to send a first authentication request to the first authentication service when the connectivity status indicates that both the first authentication service and the second authentication service are reachable; if an authentication acceptance response is received from the first authentication service, then send a second authentication request to the second authentication service; and if an authentication acceptance response is received from the second authentication service, then perform the device local authentication process.

[0130] The second execution unit is used to send a second authentication request to the second authentication service when the connectivity status indicates that the first authentication service is unreachable and the second authentication service is reachable. If an authentication acceptance response is received from the second authentication service, the device local authentication process is executed.

[0131] The third execution unit is used to directly execute the local authentication process of the device when the connectivity status indicates that neither the first authentication service nor the second authentication service is reachable.

[0132] Therefore, by automatically switching between three processes—full multi-level authentication, downgraded authentication, and pure local authentication—based on the accessibility combination of the first and second authentication services, the device can adapt to different communication states to the greatest extent possible while ensuring security, and ensure that the device can complete the necessary authentication under various network conditions.

[0133] Furthermore, in another possible implementation of this application embodiment, the aforementioned status acquisition module 1501 may specifically include the following units: The probe sending unit is used to send probe messages to the authentication service. The probe messages do not carry usernames and passwords.

[0134] The unreachability determination unit is used to retransmit if no valid response is received from the authentication service within a preset timeout period. If no valid response is received after the number of retransmissions reaches a preset detection retransmission threshold, the authentication service is determined to be unreachable. Valid responses include authentication acceptance responses or status server response messages.

[0135] Correspondingly, the aforementioned equipment authentication and monitoring device may also include the following modules: The switchback processing module is used to send probe messages to the authentication services marked as unreachable at preset time intervals; after receiving a valid response from the authentication services marked as unreachable to the probe messages, it marks the connectivity status of the authentication services as reachable and switches to the target authentication process corresponding to all reachable authentication services.

[0136] Therefore, by setting a timeout retransmission mechanism to detect the connectivity status of the authentication service, and automatically switching the degradation process back to the normal process after the authentication service is restored, the system can accurately identify service unreachability and restore security protection strength in a timely manner after the service is restored, without the need for manual intervention, thus achieving a dynamic balance between high security and high availability.

[0137] Furthermore, in another possible implementation of this application embodiment, the above-mentioned device authentication and monitoring device may further include the following modules: The protocol encapsulation module is used to encapsulate at least one of the authentication requests sent to the first authentication service and the authentication requests sent to the second authentication service into a remote authentication dial-up user service protocol message for transmission. The remote authentication dial-up user service protocol message includes user name attribute, user password attribute, client identifier attribute and device identifier attribute.

[0138] Therefore, by encapsulating authentication requests into standardized Remote Authentication Dial-up User Service Protocol (RAD) messages for transmission, the compatibility and standardization of authentication interactions between devices and authentication services are improved, facilitating integration with existing network devices and authentication systems.

[0139] The device authentication and monitoring device provided in this application embodiment can be applied in the foregoing method embodiment. For details, please refer to the description of the above method embodiment, which will not be repeated here.

[0140] Figure 16 This is a schematic diagram of the structure of the electronic device provided in an embodiment of this application. For example... Figure 16 As shown, the electronic device 1600 of this embodiment includes: at least one processor 1610 ( Figure 16 The diagram shows only one processor, a memory 1620, and a computer program 1621 stored in the memory 1620 and executable on the at least one processor 1610. When the processor 1610 executes the computer program 1621, it implements the steps in the above-described device authentication and monitoring method embodiments.

[0141] The electronic device 1600 can be a desktop computer, laptop, handheld computer, cloud server, or other computing device. This electronic device may include, but is not limited to, a processor 1610 and a memory 1620. Those skilled in the art will understand that... Figure 16 This is merely an example of electronic device 1600 and does not constitute a limitation on electronic device 1600. It may include more or fewer components than shown, or combine certain components, or different components, such as input / output devices, network access devices, etc.

[0142] The processor 1610 may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0143] In some embodiments, the memory 1620 may be an internal storage unit of the electronic device 1600, such as a hard disk or memory of the electronic device 1600. In other embodiments, the memory 1620 may be an external storage device of the electronic device 1600, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the electronic device 1600. Furthermore, the memory 1620 may include both internal and external storage units of the electronic device 1600. The memory 1620 is used to store operating systems, applications, boot loaders, data, and other programs, such as the program code of computer programs. The memory 1620 can also be used to temporarily store data that has been output or will be output.

[0144] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0145] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0146] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0147] In the embodiments provided in this application, it should be understood that the disclosed devices / electronic devices and methods can be implemented in other ways. For example, the device / electronic device embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual couplings or direct couplings or communication connections may be through some interfaces; indirect couplings or communication connections between devices or units may be electrical, mechanical, or other forms.

[0148] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0149] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0150] If the integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0151] The implementation of all or part of the processes in the methods of the above embodiments can also be accomplished by a computer program product. When the computer program product is run on an electronic device, the electronic device can implement the steps in the various method embodiments described above.

[0152] The embodiments described above are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A device authentication and monitoring method, characterized in that, include: In response to a login request initiated by a user on a substation secondary device, obtain the connectivity status of at least two authentication services; Based on the connectivity status, a target authentication process is determined from a variety of pre-configured authentication processes and executed. The various authentication processes all use the device local authentication step based on the permission data stored locally on the substation secondary equipment as the final authentication step, and the combination of authentication steps included before the device local authentication step in different authentication processes is different. During the execution of the target authentication process, authentication security events are collected and reported to the remote security monitoring center platform, wherein the remote security monitoring center platform is used to monitor and analyze abnormal behavior based on the authentication security events from various substations. When the remote security monitoring center platform identifies an attack based on the abnormal behavior analysis and issues a response command, the substation secondary equipment receives and executes the response command to block the user login and the attack. During the execution of the target authentication process, if an authentication rejection response is received from any of the authentication services, the current authentication process is terminated and the user login is rejected; if the connectivity status indicates that there is an unreachable authentication service, the selected target authentication process is a downgraded authentication process, which includes an authentication step initiated to a reachable authentication service and a local authentication step of the device.

2. The method according to claim 1, characterized in that, The collection and reporting of authentication security events to the remote security monitoring center platform includes: During the execution of the target authentication process, corresponding authentication security events are generated based on the authentication actions that occur. These authentication security events include at least one of the following: authentication request events, authentication result events, downgrade switching events, server status events, and user operation events. The authentication request event carries at least the username, device identifier, source network address, and authentication method. The authentication result event carries at least the authentication pass / fail result and the reason for failure. The downgrade switching event carries at least the switching time, the authentication level before and after downgrade, and an unreachable authentication service identifier. The server status event carries at least information about the status change of the authentication service, whether it has been restored or interrupted. The user operation event carries at least the operation log after successful login. The authentication security event is encapsulated into a security event message and sent to the remote security monitoring center platform.

3. The method according to claim 1, characterized in that, The abnormal behavior analysis includes: Match the authentication security event with at least one detection rule; The detection rules include at least one of the following: if the number of consecutive authentication failures of the same user or the same source network address exceeds a preset authentication failure threshold within a preset time window, it is determined to be a brute-force attack; if an authentication login event occurs outside of maintenance periods, it is determined to be an abnormal time login; if the same user successfully logs into multiple different devices within a preset time, it is determined to be a lateral movement attack; if the authentication request comes from an unauthorized network address range, it is determined to be access from an abnormal source network address; if multiple source network addresses coordinate to initiate low-frequency authentication requests, it is determined to be a distributed slow attack. If any of the aforementioned detection rules is matched, an attack is identified.

4. The method according to claim 3, characterized in that, After identifying the attack behavior, the method further includes: Based on the attack type corresponding to the detection rule that was hit, the attack behavior is classified into high-risk alarm, medium-risk alarm or low-risk alarm. In the event that the attack behavior is a high-risk alarm, an alarm will be pushed through at least one of the following methods: SMS, application push, and audible and visual alarm, and the process of issuing joint handling instructions will be initiated. In the event that the attack behavior is a medium-risk alarm, an alarm will be pushed via SMS or application push, and the alarm information of the medium-risk alarm will be displayed on the monitoring interface, as well as recorded in the audit log. If the attack behavior is flagged as a low-risk alert, an audit log is recorded and highlighted on the monitoring interface.

5. The method according to claim 1, characterized in that, The substation secondary equipment receives and executes the handling instructions to block the user login and attacks, including: Receive processing instructions issued by the remote security monitoring center platform, wherein the processing instructions include at least one of the following: forcing the user offline, locking the account, blocking the source network address, and switching the authentication policy; Write the blocking rule corresponding to the handling instruction into the local non-volatile storage of the substation secondary equipment so that the blocking rule remains effective after the substation secondary equipment is restarted; The corresponding blocking operation is executed according to the handling instruction. The blocking operation corresponding to the instruction to force the user offline is to terminate the user's current session and log out. The blocking operation corresponding to the instruction to lock the account is to prevent the user from logging in later. The blocking operation corresponding to the instruction to block the source network address is to add the source network address to the local blacklist and reject the authentication request initiated by the source network address. The blocking operation corresponding to the instruction to switch the authentication strategy is to switch the authentication mode to the enhanced authentication mode. After the blocking operation is completed, an execution confirmation message is returned to the remote security monitoring center platform.

6. The method according to claim 1, characterized in that, The method further includes: After the substation secondary equipment determines that the authentication service is unreachable and reports a degradation alarm, it will not report the same degradation alarm again until the authentication service is restored to reachability. For multiple substation secondary equipment alarms for the same authentication service being unreachable within the same substation, the alarms will be aggregated by the local security monitoring forwarding unit and reported to the remote security monitoring center platform, so that the remote security monitoring center platform will only display a single alarm and avoid frequent alarms for repeated events. After the authentication service is marked as unreachable for the first time, the secondary equipment of the substation will report an alarm after a preset delay period. If the authentication service becomes reachable again during the delay period, no alarm will be generated. The handling instructions include temporary blocking instructions or permanent blocking instructions. The temporary blocking instructions are automatically lifted after a preset effective duration, and the permanent blocking instructions are lifted after receiving a release instruction issued by the remote security monitoring center platform. The remote security monitoring center platform maintains a list of blocking rules for the entire network and periodically synchronizes the blocking status with the secondary equipment of each substation.

7. The method according to claim 1, characterized in that, The method further includes: The system receives user permission data and stores the user permission data locally on the substation secondary equipment. The at least two authentication services include a first authentication service and a second authentication service. The user permission data is pushed from the first authentication service to the second authentication service via a one-way synchronization method, and then forwarded to the substation secondary equipment by the second authentication service. The one-way synchronization includes periodic full synchronization and change-triggered incremental synchronization. When performing the device local authentication process, the user permission data stored locally is obtained, and the username and password entered by the user are compared and verified with the user permission data. If the verification is successful, the user is allowed to log in, and operation permissions are assigned according to the operation role corresponding to the user recorded in the user permission data. The operation role includes at least one of read-only, operator, administrator and auditor.

8. The method according to claim 1, characterized in that, The at least two authentication services include a first authentication service and a second authentication service. The step of determining and executing a target authentication process from a pre-configured set of authentication processes based on the connectivity state includes: When the connectivity status indicates that both the first authentication service and the second authentication service are reachable, a first authentication request is sent to the first authentication service. If an authentication acceptance response is received from the first authentication service, a second authentication request is sent to the second authentication service. If an authentication acceptance response is received from the second authentication service, the device local authentication process is executed. If the connectivity status indicates that the first authentication service is unreachable and the second authentication service is reachable, a second authentication request is sent to the second authentication service. If an authentication acceptance response is received from the second authentication service, the local device authentication process is executed. If the connectivity status indicates that both the first authentication service and the second authentication service are unreachable, the local device authentication process is executed directly. In this process, both the first authentication request and the second authentication request are encapsulated by the substation secondary equipment into a remote authentication dial-up user service protocol message and sent to the corresponding authentication service to request authentication.

9. The method according to claim 1, characterized in that, The step of obtaining the connectivity status of at least two authentication services includes: Send a probe message to the authentication service, wherein the probe message does not carry a username and password; If no valid response is received from the authentication service within the preset timeout period, a retransmission is performed. If no valid response is received after the number of retransmissions reaches the preset detection retransmission threshold, the authentication service is determined to be unreachable. The valid response includes an authentication acceptance response or a status server response message. The method further includes: Send probe messages to the authentication service marked as unreachable at preset time intervals; Upon receiving a valid response from the authentication service marked as unreachable to the probe message, the connectivity status of the authentication service is marked as reachable, and the process is switched to the target authentication process corresponding to all reachable authentication services indicated by the connectivity status.

10. A device authentication and monitoring device, characterized in that, include: The status acquisition module is used to respond to login requests initiated by users in the secondary equipment of the substation and obtain the connectivity status of at least two authentication services. The process management module is used to determine and execute a target authentication process from a variety of pre-configured authentication processes based on the connectivity status. Each of the various authentication processes uses a device-local authentication step based on permission data stored locally on the substation's secondary equipment as the final authentication step, and the combinations of authentication steps preceding the device-local authentication step are different in each authentication process. If the connectivity status indicates the existence of an unreachable authentication service, the selected target authentication process is a downgraded authentication process, which includes an authentication step initiated to a reachable authentication service and the device-local authentication step. The event acquisition module is used to collect authentication security events and report them to the remote security monitoring center platform during the execution of the target authentication process. The remote security monitoring center platform is used to monitor and analyze abnormal behavior based on the authentication security events from various substations. The handling execution module is used to receive and execute the handling instructions to block the user login and attack when the remote security monitoring center platform identifies the attack behavior based on the abnormal behavior analysis and issues the handling instructions in a coordinated manner. The termination processing module is used to terminate the current authentication process and refuse the user's login if an authentication rejection response is received from any of the authentication services during the execution of the target authentication process.

Images