Power grid terminal-oriented quantum-resistant secure boot method and related device

Abstract

The power grid terminal-oriented quantum-resistant security starting method and related equipment provided by the application first evaluates a security threat level based on real-time business context information of a power grid, and selects a security starting mode according to the security threat level; a signature verification mode is configured in combination with a pre-determined quantum computing threat situation; a security starting permission is configured based on a continuous trust measurement value of the power grid terminal; in the security starting mode, the signature verification mode is used to perform signature verification on a to-be-started component of the power grid terminal, and after verification passes, the use of a corresponding function module of the power grid terminal is controlled according to the security starting permission. In summary, the application implements a hierarchical security starting mechanism based on context perception, quantum threat adaptation and continuous trust driving, and effectively improves the starting security and reliability of the power grid terminal in a potential quantum computing threat environment.

Description

Technical Field

[0001] This application relates to the field of power information security technology, and in particular to a quantum-resistant secure startup method and related equipment for power grid terminals. Background Technology

[0002] Power grid terminals include smart meters, distribution terminals, protection devices, and converged terminals, which are responsible for power data acquisition, processing, and transmission. To ensure the firmware security and reliable operation of these critical terminals in complex industrial environments, a secure boot mechanism for the control chip is typically used to build a defense perimeter.

[0003] However, most existing secure boot schemes rely on traditional public-key cryptography algorithms such as RSA and ECC to build trust chains, which are ill-equipped to address the potential security threats posed by quantum computing. Therefore, developing a quantum-resistant secure boot scheme for power grid terminals has become a pressing technical challenge. Summary of the Invention

[0004] The purpose of this application is to at least address one of the aforementioned technical deficiencies, particularly the technical deficiencies in the prior art regarding how to implement a secure startup scheme for a power grid terminal with quantum security capabilities.

[0005] In a first aspect, this application provides a quantum-resistant secure startup method for power grid terminals, the method comprising:

[0006] The security threat level is assessed based on real-time power grid business context information, and a secure startup mode is selected according to the security threat level.

[0007] Configure signature verification modes based on a pre-determined quantum computing threat landscape;

[0008] Configure secure startup permissions based on the continuous trust metric value of the power grid terminal;

[0009] In secure startup mode, a signature verification mode is used to verify the signatures of the components to be started in the power grid terminal, and after successful verification, the corresponding functional modules of the power grid terminal are enabled according to the secure startup permissions.

[0010] Optionally, the security threat level is assessed based on real-time power grid business context information, including:

[0011] Construct an input feature vector based on real-time power grid business context information;

[0012] A lightweight neural network model was determined. The lightweight neural network model was distilled from a large threat assessment model. The large threat assessment model was obtained by collaboratively training multiple terminal security startup records within the power grid domain where the power grid terminal is located through a federated learning algorithm.

[0013] The input feature vector is fed into a lightweight neural network model to obtain the security threat level.

[0014] Optionally, based on the security threat level, a secure boot mode can be selected, including:

[0015] Obtain the power grid topology fingerprint information corresponding to the power grid terminal;

[0016] The system performs compliance verification on the power grid topology fingerprint information. If a topology anomaly is detected, the security threat level is increased, and an enhanced startup security startup mode is triggered.

[0017] Optionally, the signature verification mode can be configured in conjunction with a pre-determined quantum computing threat landscape, including:

[0018] Based on intelligence on the development of quantum computing and early warning information on power grid security, the threat situation of quantum computing is determined;

[0019] When the threat situation of quantum computing is low, classical cryptographic algorithms are used as the signature verification mode.

[0020] When the threat situation of quantum computing is at medium risk, the post-quantum signature algorithm is used as the signature verification mode.

[0021] When the threat posed by quantum computing is considered high-risk, a signature verification mode that combines classical cryptographic algorithms and post-quantum signature algorithms is adopted.

[0022] Optionally, secure startup permissions are configured based on the continuous trust metric of the power grid terminal, including:

[0023] Obtain trust evidence from multiple dimensions of the power grid terminal, and determine the weight of each dimension based on the power grid status;

[0024] Based on trust evidence and its corresponding weights in each dimension, a continuous trust metric is calculated.

[0025] Based on the continuous trust metric, determine the corresponding secure boot permissions.

[0026] Optionally, based on the trust evidence and corresponding weights of each dimension, a continuous trust metric is calculated, including:

[0027] Based on the weights of each dimension, the trust evidence from each dimension is weighted and fused to obtain an initial trust metric.

[0028] Obtain the timestamp of the last successful safe startup of the power grid terminal; and determine the time decay factor based on the time interval between the current time and the timestamp using the trust decay function;

[0029] The initial trust metric is corrected based on the time decay factor to obtain a continuous trust metric.

[0030] Optionally, the method further includes:

[0031] Detecting power grid fault events;

[0032] Determine the fault stage of the power grid based on power grid fault events;

[0033] In response to changes in the fault phase, adjust the secure boot mode, signature verification mode, or secure boot permissions;

[0034] Secure boot is performed based on the adjusted secure boot mode, signature verification mode, and secure boot permissions.

[0035] Secondly, this application provides a quantum-safe startup device for power grid terminals, the device comprising:

[0036] The secure startup mode selection module is used to assess the security threat level based on real-time power grid business context information and select the secure startup mode according to the security threat level.

[0037] The signature verification mode configuration module is used to configure the signature verification mode in conjunction with a pre-determined quantum computing threat landscape.

[0038] The secure startup permission configuration module is used to configure secure startup permissions based on the continuous trust metric value of the power grid terminal.

[0039] The power grid terminal secure startup module is used to verify the signatures of the components to be started in the power grid terminal using a signature verification mode in secure startup mode, and to control the activation of the corresponding functional modules of the power grid terminal according to the secure startup permissions after successful verification.

[0040] Thirdly, this application provides a storage medium storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of any of the above embodiments of the quantum-resistant secure boot method for a power grid terminal.

[0041] Fourthly, this application provides a computer device, including: one or more processors, and a memory;

[0042] The memory stores computer-readable instructions that, when executed by one or more processors, perform the steps of any of the quantum-resistant secure startup methods for power grid terminals described in the above embodiments.

[0043] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0044] The quantum-resistant secure startup method and related equipment for power grid terminals provided in this application firstly assess the security threat level based on real-time power grid business context information and select a secure startup mode accordingly. This allows the startup strategy to dynamically adjust according to business scenarios and risk levels, thereby improving the adaptability and targeting of the startup mechanism. Secondly, a signature verification mode is configured in conjunction with a pre-determined quantum computing threat situation, enabling the signature verification method to adapt to the development of quantum computing threats, thus enhancing the verification mechanism's protection against potential quantum attacks. Furthermore, secure startup permissions are configured based on the continuous trust metric of the power grid terminal, allowing startup permissions to dynamically adjust according to changes in the terminal's trust status, thereby achieving differentiated startup control and improving the rationality and security of permission allocation. Finally, in the secure startup mode, a signature verification mode is used to verify the signatures of the components to be started. After successful verification, the functional modules are activated according to the secure startup permissions, creating a linkage constraint relationship between component verification and module activation, thereby improving the overall security and controllability of the startup process. In summary, this application implements a hierarchical secure startup mechanism based on context awareness, quantum threat adaptation, and continuous trust driving, effectively improving the startup security and reliability of power grid terminals in potential quantum computing threat environments. Attached Figure Description

[0045] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 A flowchart illustrating a quantum-resistant secure startup method for power grid terminals provided in an embodiment of this application;

[0047] Figure 2 A schematic diagram of the structure of a quantum-safe startup device for power grid terminals provided in an embodiment of this application;

[0048] Figure 3 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0049] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0050] This application provides a quantum-resistant secure startup method for power grid terminals. The following embodiments illustrate this method applied to a control chip. It is understood that the control chip can be any chip device with data processing and control execution functions, including, but not limited to, security control chips, embedded processing chips, and dedicated control processor chips used in power grid terminals. Figure 1 As shown, the method may include the following steps:

[0051] S101: Assess the security threat level based on real-time power grid business context information, and select the secure startup mode according to the security threat level.

[0052] Among them, the real-time power grid business context information refers to a set of dynamic data that the control chip can acquire during startup, reflecting the current operating environment and business characteristics of the power grid terminal. Examples include the currently executed business type, power grid operating parameters, the urgency of external commands, and environmental risk indicators. The security threat level is a quantitative classification result derived by the control chip based on a comprehensive evaluation of the aforementioned business context information, used to characterize the severity of security risks in the current startup scenario. The secure startup mode is a differentiated startup strategy pre-configured by the control chip for different security threat levels. The signature verification strength, verification range, and whether cache usage is allowed differ between different modes.

[0053] In one specific implementation, the control chip first acquires real-time service context information. Taking a distribution terminal as an example, the control chip obtains the grid topology status, such as feeder connection relationships, by communicating with the distribution master station. Simultaneously, it collects load levels using local sensors and analyzes signals reported by fault indicators. Another acquisition method is for the control chip to actively subscribe to status messages published by the dispatch system, which carry maintenance mode identifiers, such as "line under maintenance" or "normal operation." The control chip aggregates the topology status, load level, fault indication signals, and maintenance mode identifiers into a context snapshot for subsequent security threat level calculations.

[0054] After obtaining the business context information, it is necessary to comprehensively calculate the current security threat level, considering both grid operation risks and safe startup risks. One approach is to use a weighted summation method: assigning scores to grid operation risk factors such as topology anomalies, load exceeding limits, valid fault indications, and maintenance mode activation, as well as scores to safe startup risks such as the previous startup trust metric and firmware update records. The weighted sum is then compared with a threshold to determine three levels: low, medium, and high. Another approach is to construct a decision tree: if a fault indication signal is valid or the maintenance mode identifier is true, it is directly classified as a high threat level; otherwise, if the load level exceeds 80% of the rated value or there is an island in the topology, it is classified as a medium threat level; the rest are classified as low threat levels. The decision tree method has low computational complexity and is suitable for control chips in feeder automation terminals with limited computing power.

[0055] The secure boot strategy is dynamically selected based on the calculated security threat level. When the security threat level is low, a fast boot mode is used, employing lightweight signature verification algorithms such as HMAC or Ed25519, and allowing caching of previously verified component hash values. If a component hasn't changed during boot, verification is skipped. Another way to achieve fast boot is to perform signature verification only on a few core components in a whitelist, loading the remaining components directly. When the security threat level is medium, a standard boot mode is used, performing full signature verification on each component to be booted using Dilithium post-quantum signatures, without relying on any caching. Specifically, the control chip pre-stores the public key and signature value of each component, calculating and comparing hashes one by one during boot; or a chained verification structure is used, verifying the next component only after the previous one has passed signature verification. When the security threat level is high, an enhanced boot mode is used, performing deep signature verification on each component using Dilithium post-quantum signatures. One way to perform full deep signature verification is to perform two independent signature verifications on the bootloader, kernel, driver, and application, using different key pairs; another way is to introduce timestamp verification to prevent replay attacks.

[0056] During startup, the control chip continuously monitors changes in the business context. The control chip can be set with a timer to re-collect topology status, load level, fault indication signals, and maintenance mode identifiers every 200 milliseconds and compare them with the previous data. When a fault signal changes from zero to present or the load suddenly increases, the threat level is determined to have changed. One way to dynamically switch secure startup strategies is to use a state machine: at the entry point of each startup phase, the level is recalculated. If the level increases, the process immediately jumps to the verification entry point of a more stringent strategy; if it decreases, the level is downgraded based on the importance of the remaining components. Another approach is to use a callback mechanism. After the monitoring thread detects a level change, it sends a signal to the startup process. The startup process pauses its current operation, reloads the new level's strategy configuration, and restarts verification from the current component.

[0057] In this step, the security threat level is assessed by acquiring business context information in real time, and the security startup mode is dynamically selected based on the assessment results. This ensures that the startup behavior matches the actual business risks. By differentiating between different threat levels and adapting startup strategies of different strengths, the startup delays and resource waste caused by using the highest strength verification in all scenarios are avoided, achieving dynamic adaptation of security startup strength to power grid business risks.

[0058] S102: Configure signature verification mode in conjunction with a pre-determined quantum computing threat landscape.

[0059] The quantum computing threat profile refers to the quantitative level or numerical value derived from a preliminary assessment of the potential quantum attack risks to power grid terminals in the near future, based on publicly available quantum computing technology development roadmaps, research progress in cryptanalysis, and security warnings issued by the power grid industry. The signature verification mode refers to the set of algorithm parameters, verification strength, and redundancy verification strategies used by the control chip during secure boot to verify the signatures of firmware components.

[0060] In one specific implementation, the control chip reads a pre-written quantum computing threat state value from a dedicated secure storage area within the chip. This state value can be an integer level, such as levels 1 to 5, or a normalized risk score, such as 0 to 100. Taking the control chip in a power distribution terminal as an example, when the quantum computing threat state level is level 1 or the risk score is below 20, it indicates that a quantum attack is not yet realistic. The control chip is configured with a single lightweight signature verification mode, using the Ed25519 algorithm and the default signature length. When the quantum computing threat state level rises to level 3 or the risk score is between 40 and 60, the control chip upgrades the signature verification mode to enhanced verification. Specifically, it adopts the Dilithium post-quantum signature algorithm and selects its higher security parameter set, for example, increasing the dimension of the modulus from the default 4x4 to 6x6. This increases the computational complexity of signature verification but significantly improves the quantum security boundary. Another way to enhance verification is to perform two independent signature verifications using public keys from different derivation paths. Verification is considered successful only if both results pass, thus reducing the risk of probabilistic attacks due to a single signature verification. When the quantum computing threat level reaches level 5 or the risk score exceeds 80, the control chip is configured with deep redundancy verification. In addition to using the Dilithium algorithm with the highest security parameter set, a feature value generated by the chip's Physically Unclonable Function (PUF) is embedded in the signature data. Verification requires matching this feature value simultaneously; failure to meet either condition results in rejection.

[0061] Another way to configure signature verification modes does not rely on a fixed level threshold, but instead uses a continuous function mapping. The control chip internally maintains a linear or piecewise function that directly maps the input quantum computing threat state value to the number of iteration rounds in the signature verification process. For example, for every 10 points increase in the threat state value, the number of iteration rounds for signature verification increases by one. During verification, multiple rounds of hash comparisons are performed on the signature of the same component, each round using a different random offset. The advantage of this approach is that the signature verification strength changes continuously and smoothly with the quantum threat state, avoiding performance fluctuations that may result from step-wise switching. Another way to achieve continuous mapping is to adjust the rejection sampling threshold during the signature verification process. Lattice-based signature algorithms such as Dilithium involve norm comparisons during verification. The control chip can dynamically tighten or loosen this threshold based on the threat state; the higher the threat, the stricter the threshold, forcing higher signature quality requirements and effectively resisting lattice basis reduction attacks by quantum computers.

[0062] This step dynamically configures the signature verification mode by combining a pre-determined quantum computing threat landscape, enabling the quantum resistance capability of secure boot to evolve in sync with the development of technological threats, and upgrading the defense capability without replacing hardware or re-flashing firmware.

[0063] S103: Configure secure startup permissions based on the continuous trust metric value of the power grid terminal.

[0064] The continuous trust metric refers to a dynamic trust score accumulated by the control chip during multiple startups or operations of the power grid terminal. This score is obtained by performing step-by-step hash calculations and signature verifications on the bootloader, operating system kernel, application programs, and various configuration parameters. It reflects the complete trust status change of the terminal from its last secure startup to the current moment. Secure startup permissions refer to the range of functional modules and operational levels that the control chip is allowed to enable after the power grid terminal completes signature verification. Different permission levels correspond to different degrees of functional openness. For example, full permissions allow all functions to run, limited permissions only allow data acquisition and prohibit the issuance of control commands, and minimum permissions only allow secure communication and log reporting.

[0065] In one specific implementation, the control chip first reads the trust metric base value saved at the end of the previous startup from non-volatile memory. This base value is the final output of a hash chain. During the current startup process, the control chip measures each component to be loaded sequentially according to the startup order. It concatenates the hash value of each component with the previous measurement result and then hashes it again, forming a continuous trust chain, ultimately obtaining a new trust metric value. The control chip then compares this new value with the previous base value to calculate the degree of difference. For example, a difference threshold can be used: if the continuous trust metric value is completely consistent with the previous base value, it indicates that all components have not been tampered with, and the control chip grants full startup permissions, allowing the power grid terminal to enable all functions, including data acquisition, remote control, and fault protection. If the degree of difference is less than a preset minor deviation threshold, for example, only the hash value of non-critical configuration files has changed while the core firmware remains unchanged, the control chip grants restricted permissions. In this case, the terminal is allowed to start normally but remote upgrades or control command issuance are prohibited; only data acquisition and local recording functions are enabled. If the difference exceeds the severe deviation threshold, such as a mismatch between the bootloader or kernel hash values, the control chip will only grant the minimum privileges. In this case, the terminal can only start the secure communication module to report the abnormal status to the master station, and all other functions will be locked.

[0066] Besides permission configuration based on degree of difference, control chips can also employ a hierarchical mapping method using continuous trust metrics. The range of trust metrics is pre-divided into multiple continuous intervals, each corresponding to a secure boot permission level. After calculating the current trust metric, the control chip directly determines which interval the value falls into and then loads the corresponding permission configuration file for that interval. One implementation of hierarchical mapping is using linear interpolation: the higher the trust metric, the more complete the permissions. Another implementation is non-linear mapping, such as using an exponential segmentation method: for every order of magnitude decrease in the trust metric, the permission level decreases by two levels, ensuring that high-trust regions maintain a wide range of permission retention, while low-trust regions quickly converge to the minimum permissions. This design avoids frequent permission jumps caused by slight fluctuations in trust values, while ensuring that the terminal quickly enters the most secure restricted state when trust is severely compromised.

[0067] This step dynamically configures secure startup permissions based on continuous trust metrics, ensuring that the permission allocation for power grid terminals is closely linked to their own trust status.

[0068] S104: In secure startup mode, the signature verification mode is used to verify the signature of the components to be started in the power grid terminal, and after the verification is successful, the corresponding functional modules of the power grid terminal are enabled according to the secure startup permissions.

[0069] Among them, components to be started refer to binary entities such as bootloaders, operating system kernels, drivers, and application firmware that need to be loaded and executed sequentially. Functional modules refer to hardware or software units in the power grid terminal that perform specific tasks, such as data acquisition units, remote communication units, control output units, and fault protection units.

[0070] In one specific implementation, after entering the secure boot mode, the control chip sequentially performs signature verification on each component to be started according to the currently configured signature verification mode. Taking a power distribution terminal as an example, if it is currently in standard boot mode and the signature verification mode is Dilithium post-quantum signature verification, the control chip reads the pre-stored component public key and signature value from non-volatile memory, calculates the component's real-time hash and compares it with the signature; if the comparison matches, the verification is successful. If it is in fast boot mode and the signature verification mode is cache verification, the control chip first checks whether the component hash matches the cache record; if it matches, it skips the full signature verification. After successful verification, the control chip controls the activation of the corresponding functional modules according to the current secure boot permissions. For example, when the secure boot permission is full, the control chip allows the data acquisition unit, remote communication unit, control output unit, and fault protection unit to all power on and operate. When the permission is limited, the control chip only enables the data acquisition unit and remote communication unit, while prohibiting the control output unit from responding to any instructions. When the permission is minimum, the control chip only activates the remote communication unit to report abnormal states, while the other units remain powered off.

[0071] Furthermore, in this embodiment, digital twin technology can be introduced to pre-verify and optimize the aforementioned startup process. Specifically, the control chip collaborates with a host computer or edge computing node to construct a digital twin model of the power grid terminal equipment. This model is a digital mapping of the actual terminal hardware configuration, firmware version, trust measurement history, and network topology. Before actual startup, the control chip synchronizes the startup parameters to be executed, including the secure startup mode, signature verification mode, and current trust measurement value, to the digital twin environment. The digital twin environment independently pre-executes the complete secure startup process, simulating the signature verification results and access control logic for each component to be started. During pre-execution, the digital twin environment detects potential risks such as inconsistent signatures, abnormal decay of trust measurement values, or conflicting access configurations. If the pre-execution passes without any risks, the digital twin environment feeds back the pre-verification results to the actual control chip, which then optimizes the startup parameters accordingly, for example, confirming that the currently selected secure startup mode is reasonable and can be executed directly. If the digital twin detects a potential startup risk, such as simulating that the Dilithium signature of a component to be started is about to expire or the trust metric value falls within the critical region for permission switching, the digital twin environment issues an early warning to the actual control chip. Upon receiving the warning, the actual control chip adjusts its startup strategy, specifically by switching to a stricter signature verification mode or temporarily increasing the security startup permission level to avoid startup failure. Optionally, the digital twin environment can also provide optimization suggestions, such as suggesting updating the component's signature certificate through a secure channel before performing signature verification, or suggesting downgrading startup permissions from full permissions to restricted permissions to prevent risk propagation. The actual control chip decides whether to adopt the suggestion based on its own strategy. In this way, the pre-execution of the digital twin can avoid repeated restarts or startup failures caused by improper parameters during the actual startup process, improving the success rate and robustness of the first startup of the power grid terminal.

[0072] Furthermore, in this embodiment, the trust evidence generated during the secure boot process can be associated with power grid business data. The control chip stores the verification results and timestamps, among other evidence, in a trusted storage area and establishes the association through extended business data metadata or hash chain binding. The trust root established during secure boot, such as a derived key, is used to protect the integrity of the business data. When a secure boot anomaly is detected, the relevant business data is automatically isolated, for example, by marking it as untrusted and moving it to an isolation area. Fine-grained access control based on the secure boot state is also supported: full trust allows reading all business data, basic trust allows reading only non-sensitive data, and restricted trust denies all read requests. This prevents sensitive data leakage or contaminated data from entering the scheduling system.

[0073] This embodiment verifies the components to be started by using a signature verification mode in the secure startup mode, and combines it with the activation of the secure startup permission control function module configured with continuous trust metric values. This enables the power grid terminal to perform step-by-step verification of component integrity and trust status during the startup phase, while dynamically binding permission allocation with trust status to prevent high-risk operations from being performed in a low-trust state.

[0074] In the above embodiments, firstly, the security threat level is assessed based on real-time power grid business context information, and a secure startup mode is selected accordingly. This allows the startup strategy to be dynamically adjusted according to business scenarios and risk levels, thereby improving the adaptability and targeting of the startup mechanism. Secondly, a signature verification mode is configured in conjunction with a pre-determined quantum computing threat situation, enabling the signature verification method to adapt to the development of quantum computing threats, thereby enhancing the verification mechanism's ability to protect against potential quantum attacks. Furthermore, secure startup permissions are configured based on the continuous trust metric of the power grid terminal, allowing startup permissions to be dynamically adjusted according to changes in the terminal's trust status, thereby achieving differentiated startup control and improving the rationality and security of permission allocation. Finally, in the secure startup mode, a signature verification mode is used to verify the signatures of the components to be started. After successful verification, the functional modules are activated according to the secure startup permissions, creating a linkage constraint relationship between component verification and module activation, thereby improving the overall security and controllability of the startup process. In summary, this application implements a hierarchical secure startup mechanism based on context awareness, quantum threat adaptation, and continuous trust drive, effectively improving the startup security and reliability of power grid terminals in potential quantum computing threat environments.

[0075] In one embodiment, assessing the security threat level based on real-time power grid business context information includes:

[0076] Construct an input feature vector based on real-time power grid business context information;

[0077] A lightweight neural network model was determined. The lightweight neural network model was distilled from a large threat assessment model. The large threat assessment model was obtained by collaboratively training multiple terminal security startup records within the power grid domain where the power grid terminal is located through a federated learning algorithm.

[0078] The input feature vector is fed into a lightweight neural network model to obtain the security threat level.

[0079] The input feature vector refers to a one-dimensional array formed by concatenating the real-time business context information of the power grid after numerical processing. The lightweight neural network model is a neural network structure deployed within the control chip, with fewer than 100 kilobytes of parameters and a single inference time of less than 5 milliseconds. This model is compressed from a large threat assessment model using knowledge distillation technology. A large threat assessment model refers to a teacher model with a large number of parameters, obtained through collaborative training using federated learning algorithms based on the security startup records of multiple terminals within the power grid domain. Federated learning is a distributed framework that allows multiple participants to collaboratively train a global model without exchanging original data. Distillation refers to a model compression technique that transfers the hidden knowledge of a large teacher model to a small student model.

[0080] In this embodiment, the control chip constructs an input feature vector from the collected business context information, historical startup records, and environmental parameters. It then calls a locally deployed lightweight neural network model for forward inference and directly outputs the security threat level. This lightweight model is distilled and compressed from a large model co-trained through federated learning, balancing the storage and real-time requirements of resource-constrained terminals.

[0081] In terms of specific implementation, the control chip can adopt two optional schemes when constructing the input feature vector. One is to encode the topology status, load level, and fault indication signal in the business context as 0-1 flag bits or floating-point values, and concatenate them with the hash matching rate of the last 5 historical startup results and the current ambient temperature value to form a 32-dimensional vector. The other is to select only the two most critical dimensions in the business context, namely business type priority and fault indication, and then merge them with the trust metric value of the last startup to form an 8-dimensional simplified vector, which is suitable for terminals with lower computing power. Regarding the inference of the lightweight neural network model, one approach is to use a three-layer fully connected network, with 32 nodes in the input layer, 48 nodes in the hidden layer, and 3 nodes in the output layer corresponding to low, medium, and high levels, using 8-bit fixed-point arithmetic throughout. Another approach is to use a depthwise separable convolutional network, rearranging the input vector into a 4x8 pseudo-image and then sequentially passing it through depthwise convolution and pointwise convolution, achieving stronger feature extraction capabilities with the same number of parameters.

[0082] Regarding the specific applications of model distillation and federated training, one option is to use a large teacher model to generate soft labels for a large number of unlabeled samples offline, and then use these soft labels as supervision signals to train a lightweight student model. Another option is to use intermediate feature distillation, forcing the intermediate layer features of the student model to align with the corresponding layer features of the teacher model, thereby improving the accuracy of the compressed model. For federated training, one implementation uses the FedAvg algorithm, where each terminal uploads its local gradient updates, and the server aggregates them to generate a new global model. Another implementation introduces differential privacy, where each terminal adds random noise before uploading gradients to prevent the reverse engineering of individual terminal's security startup records from the model.

[0083] It is understandable that constructing input feature vectors based on real-time power grid business context information allows threat level assessments to dynamically align with actual business risks, avoiding misjudgments caused by static configurations. By employing federated learning to collaboratively train a large model and then distilling it into a lightweight model, the privacy of data from each terminal is protected, while resource-constrained control chips inherit global knowledge, achieving a balance between high accuracy and low overhead. Finally, the feature vectors are input into the lightweight model to quickly infer the security threat level. This end-to-end automatic learning of nonlinear relationships is more accurate and stable without affecting real-time startup performance.

[0084] In one embodiment, selecting a secure boot mode based on the security threat level includes:

[0085] Obtain the power grid topology fingerprint information corresponding to the power grid terminal;

[0086] The system performs compliance verification on the power grid topology fingerprint information. If a topology anomaly is detected, the security threat level is increased, and an enhanced startup security startup mode is triggered.

[0087] Among them, grid topology fingerprint information refers to a set of data that can uniquely identify the location and connection relationship of a grid terminal in the current grid topology structure. Specifically, it can include the device's location identifier in the network, neighbor node information, and topology hash value. Compliance verification refers to comparing the currently collected grid topology fingerprint information with the pre-stored baseline topology fingerprint to determine whether the terminal starts from the expected location. Topology anomaly refers to the state where the current topology fingerprint does not match the baseline fingerprint or the neighbor node information has changed unexpectedly. Enhanced startup security startup mode refers to a startup mode that adds additional verification steps or adopts a stronger signature verification algorithm on the basis of conventional signature verification.

[0088] Specifically, the control chip incorporates grid topology fingerprint information as a dynamic adjustment factor when assessing security threat levels. Specifically, the control chip first acquires the current grid topology fingerprint information and then verifies its compliance. If a topology anomaly is detected during verification, indicating that the terminal may have been moved to an unexpected location or that the network topology has been tampered with, the control chip proactively increases the current security threat level and triggers an enhanced security boot mode to address potential location hijacking or man-in-the-middle attack risks.

[0089] In this embodiment, there are several ways to obtain power grid topology fingerprint information. One way is to exchange neighbor discovery messages with neighboring terminals, collect the identifiers and link states of each neighboring device, and then calculate the hash value of this information as the topology hash value. Another way is to send a query request to the distribution master station or topology management server, receive the returned topology snapshot containing device location identifiers and upstream node information, and verify the authenticity of the snapshot signature using the local private key. Regarding the specific implementation of compliance verification, one option is to directly compare the collected topology hash value with the baseline hash value pre-programmed at the factory; if they are inconsistent, it is determined to be a topology anomaly. Another option is to use dynamic baseline verification: the control chip maintains the topology fingerprint history of the most recent N successful startups, compares the current fingerprint with the weighted average of the history, and determines an anomaly when the deviation exceeds a preset threshold, such as 15%. This method can adapt to planned adjustments to the power grid topology, such as temporary changes during maintenance. When a topology anomaly is detected, the control chip can increase the security threat level by directly raising the level by one level, for example, from medium threat to high threat. Another approach is to use incremental adjustments, adding a risk increment value to the original level. This increment value is positively correlated with the severity of topology anomalies. For example, for every additional mismatched neighbor node, the security threat level increases by 0.2 points. Once the maximum score threshold is exceeded, enhanced activation is triggered.

[0090] It is understandable that acquiring power grid topology fingerprint information incorporates the terminal's location and neighbor connectivity into the security threat level assessment. Compared to solutions that rely solely on business context, this adds a physical topology dimension for authenticity verification. Compliance verification of power grid topology fingerprint information proactively identifies whether a terminal is starting from the expected location, effectively preventing devices from being maliciously migrated to unauthorized nodes and bypassing standard secure startup. If topology anomalies are detected, the security threat level is increased and an enhanced startup mode is triggered, ensuring that security defense strength increases in tandem with the risk of topology tampering. Before attackers can exploit location substitution to launch man-in-the-middle attacks or forge node access, stricter signature verification strategies are enabled in advance, significantly enhancing the power grid terminal's ability to resist physical location spoofing and topology hijacking.

[0091] In one embodiment, configuring a signature verification mode in conjunction with a pre-determined quantum computing threat posture includes:

[0092] Based on intelligence on the development of quantum computing and early warning information on power grid security, the threat situation of quantum computing is determined;

[0093] When the threat situation of quantum computing is low, classical cryptographic algorithms are used as the signature verification mode.

[0094] When the threat situation of quantum computing is at medium risk, the post-quantum signature algorithm is used as the signature verification mode.

[0095] When the threat posed by quantum computing is considered high-risk, a signature verification mode that combines classical cryptographic algorithms and post-quantum signature algorithms is adopted.

[0096] Classical cryptographic algorithms refer to traditional signature algorithms based on large integer factorization or the discrete logarithm problem, such as SM2 or RSA. Post-quantum signature algorithms refer to signature algorithms that can resist known quantum computing attacks, such as Dilithium. Hybrid signature verification mode refers to a mode that uses both classical cryptographic algorithms and post-quantum signature algorithms for dual signature verification; verification is considered successful only if both algorithms pass the verification.

[0097] Specifically, the control chip dynamically determines the current quantum computing threat landscape based on intelligence on quantum computing development and early warning information on power grid security. When the threat landscape is at different levels, the control chip adaptively selects a matching signature verification mode, thereby achieving a balance between security and computational overhead. Specifically, for low-risk situations, classical cryptographic algorithms are used alone to reduce overhead; for medium-risk situations, a post-quantum signature algorithm is switched to enhance quantum resistance; and for high-risk situations, a hybrid verification mode is employed to achieve dual protection.

[0098] In this embodiment, there are several ways to determine the threat situation of quantum computing. One way is for the control chip to periodically obtain situation reports from the power grid security situation awareness platform. These reports categorize quantum computing threats into low, medium, and high levels, and the control chip directly reads these levels. Another way is for the control chip to have a built-in time-based assessment model. For example, based on the industry-recognized quantum computing development roadmap, the period before 2026 is designated as a low-risk period, 2027 to 2030 as a medium-risk period, and after 2031 as a high-risk period. This model is then dynamically adjusted in conjunction with correction factors in power grid security early warning information. For instance, when the keyword "quantum computing breakthrough" appears in the early warning information, the level is automatically raised by one level.

[0099] Regarding the configuration and switching of signature verification modes, one option is to use a lookup table. The control chip maintains a mapping table in non-volatile memory, which specifies that low risk corresponds to the SM2 algorithm, medium risk corresponds to Dilithium level 2 parameters, and high risk corresponds to both SM2 and Dilithium verification. After looking up the table, the control chip directly loads the corresponding signature verification function pointer. Another option is to switch states based on security levels. The control chip uses the current threat situation as input to the state machine. When the situation jumps from medium risk to high risk, the state machine automatically triggers the initialization of the hybrid verification mode, including loading the public key of the classic cryptographic algorithm and the Dilithium public key, and setting the signature verification order to lightweight first and then heavy, in order to intercept obviously invalid signatures as early as possible.

[0100] It should be noted that by determining the threat landscape based on intelligence on quantum computing development and early warning information about power grid security, the configuration of the signature verification mode is forward-looking and can proactively adjust in response to advancements in external quantum computing technology, without passively responding after an attack occurs. In low-risk situations, classical cryptographic algorithms are used to avoid the additional computational overhead and power consumption of post-quantum algorithms, maintaining efficient startup of the power grid terminal. In medium-risk situations, post-quantum signature algorithms are used to effectively resist the threat of future quantum computers breaking traditional cryptographic systems, ensuring the long-term security of firmware signatures. In high-risk situations, a hybrid signature verification mode combining classical and post-quantum methods is employed. This dual verification further increases the difficulty for attackers to simultaneously overcome two different mathematical problems, maintaining a reliable security boundary even when quantum attack methods are relatively mature. The dynamic switching between these modes allows the power grid terminal to automatically match the most appropriate protection strength during different threat periods, achieving adaptive optimization of security and resource consumption.

[0101] In one embodiment, configuring secure startup permissions based on the continuous trust metric of the power grid terminal includes:

[0102] Obtain trust evidence from multiple dimensions of the power grid terminal, and determine the weight of each dimension based on the power grid status;

[0103] Based on trust evidence and its corresponding weights in each dimension, a continuous trust metric is calculated.

[0104] Based on the continuous trust metric, determine the corresponding secure boot permissions.

[0105] Trust evidence refers to raw data collected from multiple dimensions, such as cryptographic verification, physical environment, behavioral patterns, and temporal context, used to assess the trustworthiness of a terminal.

[0106] Specifically, the control chip first acquires trust evidence from multiple dimensions, and dynamically determines the weight of each dimension based on the current power grid operating status. Then, a continuous trust metric is calculated based on a weighted fusion algorithm. Finally, the corresponding security startup permission level is determined based on the threshold range in which this metric falls. This approach makes terminal permissions no longer fixed, but adaptively adjusted according to the dynamic changes in multi-dimensional trust evidence.

[0107] In this embodiment, there are several ways to obtain multi-dimensional trust evidence. One method is for the control chip to read the success rate of each component's signature verification during this startup and the number of days since the key was last updated from the cryptographic signature verification unit, read the voltage fluctuation range and chip temperature from the sensors, and statistically analyze the consistency of startup time and whether the code execution path deviates from expectations from the startup record. Another method is for the control chip to additionally collect evidence from the time context dimension, such as whether the current startup time belongs to the device's historical normal startup period, such as 2:00 AM to 5:00 AM, and whether the time interval between this startup and the last startup is within the normal range. Regarding the determination of weights, one option is for the control chip to dynamically adjust according to the power grid operating status. When the power grid is operating stably and there are no fault indications, the weight of the cryptographic verification dimension can be set higher, for example, 0.5, while the weight of the physical environment dimension can be lower, for example, 0.1. When the power grid experiences a voltage drop or high temperature alarm, the control chip automatically increases the weight of the physical environment dimension to 0.4, because abnormal environments may affect the reliability of the signature verification hardware. Another option is to use adaptive weights based on historical data. The control chip records the correlation strength between evidence from various dimensions in previous startups and the final actual security event. Simple linear regression is used to adjust the weights in real time, so that the continuous trust metric can better reflect the real failure risk.

[0108] When calculating the continuous trust metric, one approach is to use a weighted summation method, multiplying the normalized evidence values ​​of each dimension by their corresponding weights and summing them to obtain a continuous score between 0 and 100. Another approach is to use multiplicative fusion, multiplying the trust sub-scores of each dimension and then taking the square root. This method is more sensitive to extremely low trust values ​​in any single dimension and can reduce the overall metric more quickly. When determining secure startup permissions based on the continuous trust metric, one option is to preset two thresholds: above 85 points for full trust, between 60 and 85 points for basic trust, and below 60 points for restricted trust. Another option is to use a fuzzy range, setting a 10% hysteresis zone near the threshold to prevent frequent permission switching caused by slight fluctuations in the trust metric near the critical point. When the continuous trust metric falls below the preset threshold, such as 60 points, the control chip can trigger a progressive degradation startup, first disabling sensitive operation modules and retaining only core functions. If the trust value further drops below 40 points, it is further downgraded to minimal diagnostic functions. This gradual approach is more user-friendly than directly locking down the terminal, while effectively controlling the spread of risk.

[0109] It is understandable that acquiring trust evidence from multiple dimensions and dynamically determining the weights of each dimension based on the power grid status enables trust assessment to integrate information from cryptography, physical environment, behavioral patterns, and temporal context. Furthermore, it adaptively adjusts the importance of each dimension based on the power grid's operational status, thus more accurately reflecting the current trust level of the terminal. Calculating a continuous trust metric based on trust evidence and its corresponding weights integrates multi-source heterogeneous evidence into a comprehensive score, effectively reducing the probability of false positives and improving the accuracy and robustness of trust assessment. Determining corresponding secure startup permissions based on the continuous trust metric dynamically binds the terminal's functional scope to its continuous trust status, ensuring a minimum level of security while avoiding a blanket denial of startup, achieving a reasonable balance between risk and availability.

[0110] In one embodiment, a continuous trust metric is calculated based on trust evidence and its corresponding weights across various dimensions, including:

[0111] Based on the weights of each dimension, the trust evidence from each dimension is weighted and fused to obtain an initial trust metric.

[0112] Obtain the timestamp of the last successful safe startup of the power grid terminal; and determine the time decay factor based on the time interval between the current time and the timestamp using the trust decay function;

[0113] The initial trust metric is corrected based on the time decay factor to obtain a continuous trust metric.

[0114] The initial trust metric is a base score obtained by weighted fusion of trust evidence from multiple dimensions, reflecting the degree of terminal trustworthiness represented by the evidence from each dimension at the current startup time. The time decay factor is a coefficient that decreases as the time interval between the last successful secure startup increases. It is calculated by the trust decay function and is used to simulate the physical law that terminal trustworthiness naturally decreases as idle or running time increases.

[0115] Specifically, the control chip first weights and fuses the trust evidence according to the weights of each dimension to obtain an initial trust metric. Then, it reads the timestamp of the last successful secure boot from the local record and calculates the time interval between the current time and that timestamp. Next, it calculates the corresponding time decay factor using a predefined trust decay function, and finally uses this factor to correct the initial trust metric, obtaining the final continuous trust metric. This approach ensures that the terminal's trustworthiness assessment not only relies on the multi-dimensional evidence at the time of boot but also incorporates the natural decay factor over time.

[0116] In this embodiment, there are several ways to obtain the initial trust metric value through weighted fusion. One method is to use linear weighted summation, multiplying the normalized evidence values ​​of the cryptographic verification dimension, physical environment dimension, behavioral pattern dimension, and temporal context dimension by their respective dynamic weights and then summing them to obtain an initial score between 0 and 100. Another method is to use multiplicative weighted fusion, which performs a weighted geometric average on the trust sub-scores of each dimension, i.e., multiplying each sub-score by its weight as an exponent and then taking the total weight power. This method is more sensitive to low scores in any dimension and can more conservatively reflect the overall trust level. Regarding the design of the trust decay function, one option is to use an exponential decay model, where the continuous trust metric value is equal to the initial trust metric value multiplied by e raised to the power of negative λ times the time interval, where λ is the decay rate constant, for example, 0.01 per hour. In this way, the trust value decays by half every approximately 69 hours, which conforms to the empirical law that the probability of failure gradually increases after long-term operation of electronic products. Another option is to use a piecewise linear decay function. For example, the time interval has no decay within 24 hours, then linearly decays from 1 to 0.8 between 24 and 168 hours, and finally settles at 0.5 after 168 hours. This method avoids the inability to resume normal operation due to excessively low trust values ​​caused by prolonged inactivity. After calculating the time decay factor, the control chip multiplies it by the initial trust metric to obtain the continuous trust metric. Optionally, the control chip can also set a lower limit for the trust value, such as a continuous trust metric that is no less than 10 points, to prevent complete failure to start due to extremely long periods of inactivity.

[0117] Understandably, the initial trust metric is obtained by weighting and fusing various dimensions, integrating heterogeneous evidence from multiple sources to make the basic score more comprehensive and accurate. Introducing the timestamp of the last successful startup and a trust decay function reflects the objective law of natural decay in terminal trust over time, avoiding the security risks caused by maintaining the same high trust value after prolonged inactivity or operation as immediately after verification. The initial trust metric is corrected based on a time decay factor to obtain a continuous trust metric, allowing startup permission configuration to automatically tighten over time. For example, when a terminal restarts after being idle for several months, even with good evidence across all dimensions, the corrected trust value will decrease due to time decay, automatically triggering a stricter secure startup process such as mandatory full signature verification or downgrading permissions, effectively preventing firmware tampering or key leakage risks that may occur during long periods of inactivity.

[0118] In one embodiment, the method further includes:

[0119] Detecting power grid fault events;

[0120] Determine the fault stage of the power grid based on power grid fault events;

[0121] In response to changes in the fault phase, adjust the secure boot mode, signature verification mode, or secure boot permissions;

[0122] Secure boot is performed based on the adjusted secure boot mode, signature verification mode, and secure boot permissions.

[0123] Among them, a power grid fault event refers to an abnormal situation that occurs during the operation of the power grid, which may include line faults, equipment faults, or communication interruptions. Fault phases refer to the different periods that a power grid fault goes through from its occurrence to its recovery, such as the fault isolation phase, the fault recovery phase, and the post-fault reconstruction phase.

[0124] Specifically, the control chip monitors fault events occurring in the power grid in real time and determines the current fault stage based on these events. When the fault stage changes, the control chip proactively adjusts at least one of the following: secure startup mode, signature verification mode, or secure startup permissions. Subsequently, the control chip executes secure startup according to the adjusted parameters. This approach enables the power grid terminal to adaptively change its secure startup strategy during fault occurrence and recovery, thereby supporting rapid fault location and self-healing while ensuring safety.

[0125] In this embodiment, there are several ways to detect power grid fault events. One method is for the control chip to parse the signals reported by the fault indicator or read the action flags of the local protection device, and determine a line fault when it detects features such as single-phase grounding, phase-to-phase short circuit, or overcurrent. Another method is for the control chip to monitor the communication heartbeat between the distribution master station or adjacent terminals, and determine a communication interruption when three consecutive heartbeat timeouts or the received message verification fails. One optional method for determining the fault stage is to use a finite state machine. The control chip maintains a fault stage state machine, initially in normal operation. When a valid fault indication signal is detected, the state machine enters the fault isolation stage. When a recovery command is received from the master station and the fault point has been isolated, the state machine transitions to the fault recovery stage. After the recovery command is executed and the power grid parameters return to normal, the state machine enters the post-fault reconstruction stage. Another optional method is to use a timer to assist in the determination. After detecting a fault signal, the control chip starts a timer, for example, the first 30 seconds are considered the isolation stage, 30 to 60 seconds are considered the recovery stage, and after 60 seconds are considered the reconstruction stage. This approach is simple to implement and is suitable for handling fault scenarios with relatively fixed timing.

[0126] There are several ways to adjust the secure boot strategy in response to changes during the fault phase. During the fault isolation phase, to accelerate the booting of devices in non-faulty areas and support rapid fault location, the control chip can appropriately relax security verification requirements. One approach is to downgrade the signature verification mode from post-quantum signature to lightweight HMAC verification, while adjusting the secure boot permission from full trust to basic trust, allowing core communication functions to be quickly brought online. During the fault recovery phase, devices participating in the recovery operation are responsible for issuing control commands, requiring higher security. The control chip can switch the signature verification mode to a hybrid verification mode at this stage, using both SM2 and Dilithium, and restrict secure boot permissions to only open functional modules related to recovery commands, keeping other modules locked. During the post-fault reconstruction phase, since the power grid has largely returned to normal, but some devices may have experienced temporary power outages or network reconnections, the control chip can perform a full trust chain reconstruction. One implementation is to force a full hash check on all components to be booted, without relying on any cache, and reset the continuous trust metric value to re-accumulate. Another approach is to invoke a separate trust reconstruction subroutine. This subroutine verifies the hardware trust root level by level and generates a new trust anchor point for subsequent boot cycles upon successful verification. Finally, the control chip executes the actual secure boot process based on the adjusted secure boot mode, signature verification mode, and secure boot permissions, ensuring that the boot behavior under the current fault stage matches the security requirements.

[0127] It is understandable that by detecting power grid fault events and determining the fault stage, the safe startup strategy can be linked with the power grid fault handling process, avoiding the response lag or over-protection caused by using a fixed startup strategy during a fault. The safe startup mode, signature verification mode, or safe startup permission are dynamically adjusted in response to changes in the fault stage, thus ensuring both safety and fault handling efficiency. After adjustment, safe startup is executed based on the new parameters, achieving real-time alignment between the safety strategy and the power grid operating status. This allows power grid terminals to flexibly switch roles during fault self-healing, avoiding both prolonged high-risk states and excessive conservatism that hinders recovery speed.

[0128] The following describes a quantum-safe startup device for a power grid terminal provided in an embodiment of this application. The quantum-safe startup device described below corresponds to and can be referred to in conjunction with the quantum-safe startup method for a power grid terminal described above. Figure 2 As shown, this application provides a quantum-safe startup device for power grid terminals, the device comprising:

[0129] The secure startup mode selection module 201 is used to assess the security threat level based on the real-time business context information of the power grid, and select the secure startup mode according to the security threat level.

[0130] The signature verification mode configuration module 202 is used to configure the signature verification mode in conjunction with a pre-determined quantum computing threat situation.

[0131] The secure startup permission configuration module 203 is used to configure secure startup permissions based on the continuous trust metric value of the power grid terminal.

[0132] The power grid terminal secure startup module 204 is used to perform signature verification on the components to be started in the power grid terminal in secure startup mode, and to control the activation of the corresponding functional modules of the power grid terminal according to the secure startup permissions after the verification is successful.

[0133] In one embodiment, the secure boot mode selection module 201 includes:

[0134] The input feature vector construction unit is used to construct input feature vectors based on real-time power grid business context information;

[0135] The lightweight neural network model determination unit is used to determine the lightweight neural network model, which is distilled from the large threat assessment model. The large threat assessment model is obtained by collaboratively training multiple terminal security startup records in the power grid domain where the power grid terminal is located through a federated learning algorithm.

[0136] The security threat level determination unit is used to input the input feature vector into a lightweight neural network model to obtain the security threat level.

[0137] In one embodiment, the secure boot mode selection module 201 includes:

[0138] The power grid topology fingerprint information acquisition unit is used to acquire the power grid topology fingerprint information corresponding to the power grid terminal;

[0139] The compliance verification unit is used to verify the compliance of the power grid topology fingerprint information. If a topology anomaly is detected, the security threat level is increased and the enhanced startup security startup mode is triggered.

[0140] In one embodiment, the signature verification mode configuration module 202 includes:

[0141] The quantum computing threat situation determination unit is used to determine the quantum computing threat situation based on intelligence on quantum computing development and early warning information on power grid security.

[0142] The first signature verification mode configuration unit is used to adopt classical cryptographic algorithms as the signature verification mode when the quantum computing threat situation is low risk.

[0143] The second signature verification mode configuration unit is used to adopt the post-quantum signature algorithm as the signature verification mode when the quantum computing threat situation is of medium risk.

[0144] The third signature verification mode configuration unit is used to employ a hybrid signature verification mode that combines classical cryptographic algorithms and post-quantum signature algorithms when the quantum computing threat situation is high-risk.

[0145] In one embodiment, the secure boot permission configuration module 203 includes:

[0146] The trust evidence acquisition unit is used to acquire trust evidence from multiple dimensions of the power grid terminal and determine the weight of each dimension based on the power grid status.

[0147] The continuous trust metric calculation unit is used to calculate the continuous trust metric based on trust evidence and corresponding weights in each dimension.

[0148] The secure boot permission determination unit is used to determine the corresponding secure boot permissions based on the continuous trust metric value.

[0149] In one embodiment, the continuous trust metric calculation unit includes:

[0150] The initial trust metric determination sub-unit is used to weight and fuse the trust evidence of each dimension according to the weight of each dimension to obtain the initial trust metric.

[0151] The time decay factor determination subunit is used to obtain the timestamp of the last successful safe start-up of the power grid terminal; and to determine the time decay factor based on the time interval between the current time and the timestamp through the trust decay function.

[0152] The continuous trust metric calculation subunit is used to correct the initial trust metric based on the time decay factor to obtain the continuous trust metric.

[0153] In one embodiment, the apparatus further includes:

[0154] A power grid fault time detection module is used to detect power grid fault events;

[0155] The fault stage determination module is used to determine the fault stage of the power grid based on power grid fault events.

[0156] The fault change response module is used to adjust the secure boot mode, signature verification mode, or secure boot permissions in response to changes in the fault phase.

[0157] The Secure Boot module is used to perform a secure boot based on the adjusted secure boot mode, signature verification mode, and secure boot permissions.

[0158] In one embodiment, this application also provides a storage medium storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of the quantum-resistant secure boot method for power grid terminals as described in any of the above embodiments.

[0159] In one embodiment, this application also provides a computer device storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of the quantum-resistant secure boot method for a power grid terminal as described in any of the above embodiments.

[0160] Indicatively, such as Figure 3 As shown, Figure 3 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of this application. (Refer to...) Figure 3 The computer device 300 includes a processing component 302, which further includes one or more processors, and memory resources represented by memory 301 for storing instructions, such as application programs, that can be executed by the processing component 302. The application programs stored in memory 301 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 302 is configured to execute instructions to perform the quantum-resistant secure boot method for grid terminals according to any of the above embodiments.

[0161] The computer device 300 may also include a power supply component 303 configured to perform power management of the computer device 300, a wired or wireless network interface 304 configured to connect the computer device 300 to a network, and an input / output (I / O) interface 305. The computer device 300 may operate on an operating system stored in memory 301, such as Windows Server™, Mac OS X™, Unix™, Linux™, Free BSD™, or similar.

[0162] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0163] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. In this document, "a," "an," "the," "the," and "its" may also include plural forms unless the context clearly indicates otherwise. "Multiple" refers to at least two, such as 2, 3, 5, or 8, etc. "And / or" includes any and all combinations of the related listed items.

[0164] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can be referred to each other.

[0165] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A quantum-resistant secure startup method for power grid terminals, characterized in that, The method includes: The security threat level is assessed based on real-time power grid business context information, and a secure startup mode is selected based on the security threat level. Configure signature verification modes based on a pre-determined quantum computing threat landscape; Configure secure startup permissions based on the continuous trust metric value of the power grid terminal; In the secure startup mode, the signature verification mode is used to verify the signature of the components to be started in the power grid terminal, and after the verification is successful, the activation of the corresponding functional modules of the power grid terminal is controlled according to the secure startup permission.

2. The method according to claim 1, characterized in that, The assessment of security threat levels based on real-time power grid service context information includes: Construct an input feature vector based on real-time power grid business context information; A lightweight neural network model is determined, which is obtained by distillation from a large threat assessment model. The large threat assessment model is obtained by collaborative training using multiple terminal security startup records within the power grid domain where the power grid terminal is located through a federated learning algorithm. The input feature vector is fed into the lightweight neural network model to obtain the security threat level.

3. The method according to claim 1, characterized in that, The step of selecting a secure boot mode based on the security threat level includes: Obtain the power grid topology fingerprint information corresponding to the power grid terminal; The compliance of the power grid topology fingerprint information is verified. If a topology anomaly is detected, the security threat level is increased and an enhanced startup security startup mode is triggered.

4. The method according to claim 1, characterized in that, The configuration of the signature verification mode based on the pre-determined quantum computing threat situation includes: Based on intelligence on the development of quantum computing and early warning information on power grid security, the threat situation of quantum computing is determined; When the quantum computing threat situation is low-risk, classical cryptographic algorithms are used as the signature verification mode. When the quantum computing threat situation is at medium risk, a post-quantum signature algorithm is used as the signature verification mode. When the quantum computing threat situation is high-risk, a signature verification mode that combines the classical cryptographic algorithm and the post-quantum signature algorithm is adopted.

5. The method according to claim 1, characterized in that, The configuration of secure startup permissions based on the continuous trust metric value of the power grid terminal includes: Obtain trust evidence from multiple dimensions of the power grid terminal, and determine the weight of each dimension based on the power grid status; Based on the trust evidence and corresponding weights of each dimension, a continuous trust metric is calculated. Based on the continuous trust metric value, the corresponding secure startup permission is determined.

6. The method according to claim 5, characterized in that, The calculation of continuous trust metrics based on trust evidence and corresponding weights for each dimension includes: Based on the weights of each dimension, the trust evidence for each dimension is weighted and fused to obtain an initial trust metric. Obtain the timestamp of the last successful safe startup of the power grid terminal; and determine the time decay factor based on the time interval between the current time and the timestamp using a trust decay function; The initial trust metric is corrected based on the time decay factor to obtain the continuous trust metric.

7. The method according to any one of claims 1 to 6, characterized in that, The method further includes: Detecting power grid fault events; The fault stage of the power grid is determined based on the aforementioned power grid fault events; In response to changes in the fault phase, adjust the secure boot mode, the signature verification mode, or the secure boot permissions; Secure boot is performed based on the adjusted secure boot mode, signature verification mode, and secure boot permissions.

8. A quantum-safe start-up device for power grid terminals, characterized in that, The device includes: The secure startup mode selection module is used to assess the security threat level based on real-time power grid business context information and select the secure startup mode according to the security threat level. The signature verification mode configuration module is used to configure the signature verification mode in conjunction with a pre-determined quantum computing threat landscape. The secure startup permission configuration module is used to configure secure startup permissions based on the continuous trust metric value of the power grid terminal. The power grid terminal secure startup module is used to perform signature verification on the components to be started of the power grid terminal using the signature verification mode in the secure startup mode, and to control the activation of the corresponding functional modules of the power grid terminal according to the secure startup permission after the verification is successful.

9. A storage medium, characterized in that: The storage medium stores computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of the quantum-resistant secure boot method for a power grid terminal as described in any one of claims 1 to 7.

10. A computer device, characterized in that, include: One or more processors, and memory; The memory stores computer-readable instructions that, when executed by the one or more processors, perform the steps of the quantum-resistant secure boot method for a power grid terminal as described in any one of claims 1 to 7.

Images