A power grid device access authentication method, system and medium

Abstract

The application discloses a power grid equipment access authentication method, system and medium, and belongs to the technical field of power grid safety. The method comprises the following steps: receiving a negotiation start message sent by a power grid equipment; acquiring a real-time operation state of the power grid, combining access context information and pre-stored equipment registration information to generate an operation constraint set; generating a candidate strategy set according to the operation constraint set and equipment proof capability parameters and sending the candidate strategy set to the equipment; receiving a target proof strategy selected by the equipment; generating a session challenge value according to an equipment identity certificate, the operation constraint set, the target proof strategy and a current electrical state digest and issuing the session challenge value; receiving a zero-knowledge proof message generated by the equipment in response to the session challenge value; verifying the message according to the operation constraint set, and determining the access session permission through verification. Through implementation of the application, the problem that power grid equipment access authentication only depends on identity legality can be solved, and the consistency between power grid equipment access behavior and the operation state of the power grid is improved.

Description

Technical Field

[0001] This application relates to the field of power grid security technology, and in particular to a method, system and medium for power grid equipment access authentication. Background Technology

[0002] Power grid equipment access authentication, as a pre-entry security step for equipment entering the business system, directly impacts the security of subsequent data interaction and operational execution. With the expansion of power grid scale and the increasing complexity of its operation, the location of the equipment at the time of access—including its substation, feeder, and bay—as well as the compatibility between the intended operation and the real-time operating environment, all constitute factors that must be considered in access decisions. If access authentication only focuses on verifying the equipment's identity, legitimate equipment could still succeed in unauthorized operations from incorrect locations, threatening the order of power grid operation. Therefore, constructing an authentication mechanism that reflects the matching relationship between equipment access behavior and the current operating scenario is an inherent requirement for the continuous evolution of this technological field.

[0003] Existing access authentication schemes employ a two-way identity verification mechanism based on digital certificates. This mechanism bases authentication decisions on two conditions: the device's identity is genuine and the certificate status is normal. The authentication node assigns fixed operating permissions to verified devices according to a pre-defined permission rule table. However, this mechanism faces inherent difficulties in practical implementation: the permission rule table it relies on cannot be dynamically adjusted according to changes in the device's current access location and real-time operating environment. This means the authentication result only reflects the device's legitimate identity, failing to demonstrate whether the device's operational behavior in the current access scenario is compatible with its location, interval, or current operating mode. This creates a disconnect between identity attributes and the access scenario in access decisions, leading to a decoupling between access authorization and on-site operating conditions. This allows legitimate devices to still grant access to operational requests from non-home stations or within maintenance isolation zones. Therefore, how to ensure that access authentication results reflect the matching relationship between the device's current operational behavior and its operating environment at the time of access, and improve the consistency between power grid equipment access behavior and power grid operating status, is a pressing technical problem that needs to be solved. Summary of the Invention

[0004] This application provides a method, system, and medium for power grid equipment access authentication, which solves the problem that power grid equipment access authentication relies solely on identity legitimacy and improves the consistency between power grid equipment access behavior and power grid operation status.

[0005] This application provides a method for power grid equipment access authentication, including: Receive a negotiation start message sent by a power grid device; wherein the negotiation start message includes device identity credentials, access context information, device capability verification parameters, and a current electrical status summary; The real-time operating status of the power grid is obtained, and an operating constraint set is generated based on the real-time operating status of the power grid, the access context information, and the pre-stored equipment registration information of the power grid equipment. A candidate strategy set is generated based on the operational constraint set and the equipment proof capability parameters, and the candidate strategy set is sent to the power grid equipment; Receive the target proof strategy selected by the power grid equipment from the candidate strategy set; A session challenge value is generated based on the device identity credential, the set of operational constraints, the target proof strategy, and the current electrical state summary, and the session challenge value is sent to the power grid device; Receive the zero-knowledge proof message generated by the power grid equipment in response to the session challenge value; The zero-knowledge proof message is verified according to the set of operational constraints. If the verification passes, the session permissions of the access session of the power grid equipment are determined according to the target proof strategy.

[0006] This application obtains device identity, access location, operational intent, and a snapshot of the current electrical state by receiving negotiation initiation messages, providing basic input for subsequent authentication. It acquires the real-time operating status of the power grid and generates an operational constraint set by combining access context information and device registration information. This unifies the real-time operating conditions of the power grid, device ownership, operational boundaries, and proof requirements into authentication rules, extending the authentication benchmark from the device identity layer to the operational state adaptation layer. Based on the operational constraint set and device proof capability parameters, it generates a candidate strategy set for the device to select a target strategy. This ensures that strategy generation is driven by power grid constraints rather than simple algorithm negotiation, guaranteeing that the selected strategy matches the current operating rules. After generating a session challenge value and receiving zero-knowledge proof messages, it verifies the message content based on the operational constraint set and determines session permissions, ensuring that the authentication conclusion directly affects the permission boundaries rather than merely confirming identity. This application differs from conventional methods that only verify identity legitimacy by transforming the real-time operating status of the power grid into dynamic authentication rules and using these rules to drive strategy negotiation and permission determination. This allows device access permissions to adaptively adjust with power grid operating conditions, improving the consistency between power grid device access behavior and power grid operating status.

[0007] Further, the access context information includes the access domain identifier and the current access request; the real-time power grid operating status includes topology status, maintenance status, and dispatch control status; and the generation of an operating constraint set based on the real-time power grid operating status, the access context information, and the pre-stored equipment registration information of the power grid equipment includes: The location constraints of the power grid equipment are determined based on the access domain identifier, the device registration information, and the topology status. Based on the topology, determine the electrical state constraints of the power grid equipment; Based on the device registration information and the current access request, determine the candidate operational constraints of the power grid device; Based on the maintenance status and the dispatch control status, adjust the candidate operation constraints and determine the permissible operation constraints of the power grid equipment; Based on the permitted operation constraints, determine the proof condition constraints and attribute disclosure constraints for this access; The set of operational constraints is determined by combining the position constraints, electrical state constraints, permissible operation constraints, proof condition constraints, and attribute disclosure constraints.

[0008] This application determines location constraints by comprehensively considering access domain identifiers, device registration information, and topology status, upgrading location legitimacy verification from a single-source judgment to multi-source cross-verification. This prevents devices from passing verification solely based on identity when initiating access from incorrect sites or feeders. Determining electrical status constraints explicitly incorporates device operating condition adaptation requirements into the authentication benchmark, ensuring that authentication rules simultaneously cover the physical location of the device and its electrical condition compatibility. When determining candidate operation constraints, initial screening is performed based on device registration information and current access requests, followed by dynamic trimming of the constraint based on maintenance and dispatch control states to obtain permissible operation constraints. This allows operation permissions to adaptively scale with changes in grid conditions rather than being statically preset, preventing high-risk operations from being mistakenly executed during maintenance or lockout states. Proof condition constraints and attribute disclosure constraints are determined based on permissible operation constraints, translating differences in permission sensitivity into differentiated proof requirements and disclosure granularity. This ensures that high-risk operations correspond to stronger proof constraints and stricter privacy protection, while low-risk operations avoid excessive proof burdens. All constraints are combined into a unified set of operational constraints, ensuring that policy generation and subsequent verification share the same rule anchor point, guaranteeing consistency in the judgment benchmark across the entire authentication chain.

[0009] Further, the step of generating a candidate strategy set based on the operational constraint set and the device proof capability parameters includes: Based on the equipment proof capability parameters, a set of candidate circuit templates corresponding to the power grid equipment is selected from a preset proof circuit template library; Based on the aforementioned proof conditions, several proof circuit combinations are determined from the candidate circuit template set; Based on the attribute disclosure constraints, generate corresponding attribute disclosure masks and proof parameters for each of the proof circuit combinations; A set of candidate strategies is determined based on each of the aforementioned proof circuit combinations, the corresponding attribute disclosure mask, and the proof parameters.

[0010] This application selects a set of candidate circuit templates based on the equipment's proof capability parameters, aligning the proof requirements in the operational constraints with the actual computing power of the equipment. This avoids situations where the equipment cannot generate proofs due to template incompatibility or is forced to adopt mismatched solutions. Based on the proof condition constraints, several circuit combinations are determined from the candidate template set, embedding mandatory proof items as the essential skeleton of the combination rather than optional additions. This ensures that key proof dimensions in high-risk scenarios are not overlooked during the strategy selection process. Based on the attribute disclosure constraints, attribute disclosure masks and proof parameters are generated, synchronously binding privacy protection strategies and algorithm strength with the proof content. This allows the same proof content to output multiple differentiated solutions with different privacy costs and computational costs. Finally, the combinations, their masks, and parameters are summarized to form a set of candidate strategies, enabling a structured mapping between grid operation constraints and equipment capability differences at the strategy level.

[0011] Further, the zero-knowledge proof message includes consistency information and session binding information. The consistency information includes location information, electrical state information, and command authorization information. The verification of the zero-knowledge proof message based on the set of operational constraints includes: Verify whether the location information is consistent with the location constraints to obtain the location verification result; Verify whether the electrical state information is consistent with the electrical state constraints to obtain the electrical verification result; Verify whether the command permission information is consistent with the allowed operation constraints to obtain the permission verification result; Based on the location verification result, the electrical verification result, and the permission verification result, the constraint verification result is determined.

[0012] By separating location information, electrical status information, and command authority information into three independent dimensions and comparing them item by item with the corresponding constraints in the operational constraint set, the legality of location, matching of operating conditions, and operational boundaries are no longer packaged into a single judgment result, thus avoiding the obscuring of local overreach due to overall verification. After each of the three dimensions is independently verified, the results are summarized into a constraint verification result, transforming the composite judgment logic from the subjective comprehensive judgment of the verifier to an objective rule-driven item-by-item cumulative judgment. Any mismatch in any dimension can independently trigger a verification failure, preventing boundary situations from being mistakenly allowed due to ambiguity in the judgment logic.

[0013] Furthermore, the zero-knowledge proof message also includes a zero-knowledge proof credential and a session binding credential; the proof parameters include a verification algorithm and a verification strength level; and the verification of the zero-knowledge proof message further includes: Determine the target verification algorithm and target verification strength level corresponding to the target proof strategy; Based on the target verification algorithm and the target verification strength level, the zero-knowledge proof credential is cryptographically verified to obtain the cryptographic verification result. Verify whether the session binding credentials are consistent with the session challenge value to obtain the binding verification result; The password verification result is determined based on the cryptographic verification result and the binding verification result.

[0014] By determining the target verification algorithm and target verification strength level corresponding to the target proof strategy, the verifier uses the same algorithm and strength standard as when proving the device to perform the verification, avoiding misjudgments due to mismatched algorithm versions or security levels; cryptographic verification of zero-knowledge proof credentials ensures that the mathematical authenticity of the proof is examined independently of content compliance, forming a logically separate double defense with constraint verification, preventing messages with forged content but invalid mathematical proofs from slipping through; verifying whether the session binding credentials and session challenge values ​​are consistent ensures that the proof message is uniquely bound to the current session, preventing old messages from being intercepted and replayed in other sessions for reuse; summarizing the cryptographic verification results and binding verification results to determine the cryptographic verification result, ensuring that both the authenticity of the evidence and the uniqueness of the session are verified before the cryptographic verification result is determined to be passed.

[0015] Further, generating a session challenge value based on the device identity credential, the operational constraint set, the target proof strategy, and the current electrical state digest includes: Based on the device identity credentials, the set of operational constraints, the target proof strategy, and the current electrical state summary, session context data is obtained; The session context data is encrypted to generate the session challenge value.

[0016] This application uses four inputs—device identity credentials, operational constraint set, target proof strategy, and current electrical state summary—to converge into session context data. This makes the generation of challenge values ​​no longer dependent on isolated random numbers or timestamps, but rather bound to all key elements of this authentication. Cryptographic operations are performed on the session context data to generate challenge values, compressing multi-element inputs into a fixed-length anti-counterfeiting credential. Subsequent proof messages must contain this challenge value to pass verification, ensuring that the proof for each session is uniquely associated with the context and preventing old messages from being intercepted and reused in other sessions or under different operational constraints.

[0017] Further, determining the session permissions of the access session of the power grid equipment according to the target proof strategy includes: Determine the target session permission template corresponding to the target proof strategy; The first operating scope of the power grid equipment is determined based on the target session permission template; The second operating range of the power grid equipment is determined based on the permissible operating constraints; The session permission range of the power grid equipment is determined based on the intersection of the first operation range and the second operation range.

[0018] By determining the target session permission template corresponding to the target proof strategy, the policy-level permission preset is used as the source of the first operation scope, so that the permissions after authentication are anchored to the policy preset upper limit. The second operation scope is determined according to the allowed operation constraints, and the dynamic constraint boundary determined by the real-time operation status of the power grid is used as the source of the second operation scope, so that the permission scope simultaneously carries the risk control requirements of the power grid side. The intersection of the first operation scope and the second operation scope is taken as the final session permission scope, so that the final permission does not exceed the policy preset authorization upper limit, nor does it exceed the dynamic boundary allowed by the real-time status of the power grid. The two-layer constraints are effective at the same time, and the most stringent overlapping area is taken, so that the authentication conclusion directly affects the actual executable permission boundary.

[0019] Further, determining the location constraints of the power grid equipment based on the access domain identifier, the device registration information, and the topology status includes: Based on the operating domain mapping information in the equipment registration information, determine the operating domain mapping path corresponding to the power grid equipment; The location constraint is determined when the access domain identifier belongs to the running domain mapping path and the topology status indicates that the running domain mapping path is valid.

[0020] This application determines the operating domain mapping path based on the operating domain mapping information in the equipment registration information, upgrading the location verification from fuzzy regional matching to a structured judgment based on the hierarchical attribution chain of station → feeder → bay → access domain. This gives the location legality a clear boundary definition and a traceable hierarchical basis. When the access domain identifier belongs to the path and the topology status indicates that the path is valid, the location constraint is determined, so that the location verification simultaneously meets two independent conditions—the access domain is within the predetermined attribution chain and the chain is actually reachable in the current power grid topology. This avoids the equipment being misjudged as having a valid location even when the predetermined attribution chain is valid but the location is not reachable in the current power grid topology. This makes the location constraint a dual guarantee with both static attribution basis and dynamic reachability verification.

[0021] Another embodiment of this application provides a power grid equipment access authentication system, which is used to perform the power grid equipment access authentication method as described in this application.

[0022] Another embodiment of this application provides a computer-readable storage medium, characterized in that it includes: a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to perform the power grid equipment access authentication method as described in this application. Attached Figure Description

[0023] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0024] Figure 1 This is a flowchart illustrating one embodiment of the power grid equipment access authentication method provided in this application; Figure 2 This is a schematic diagram of the process for generating a runtime constraint set according to one embodiment of the present application. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0026] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0027] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0028] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0029] In power grid equipment access authentication, equipment must prove its identity legitimacy and operational compliance to edge authentication nodes upon grid connection. Existing methods primarily focus on verifying the trustworthiness of the equipment's identity. However, a legitimate identity does not guarantee the legitimacy of the current access behavior. The scope of executable operations for the same equipment may differ across different substations, feeders, or operating modes, and maintenance or dispatch interlocking states may temporarily alter permission boundaries. If the authentication process does not incorporate the real-time operating status of the power grid into its judgment criteria, issues such as equipment identity verification but location exceeding authority, mismatched operating conditions, or commands exceeding permissions may arise. To address these issues, this application provides a power grid equipment access authentication method that improves the consistency between power grid equipment access behavior and the power grid's operating status.

[0030] Please refer to Figure 1 , Figure 1 This is a flowchart illustrating one embodiment of the power grid equipment access authentication method provided in this application. To achieve joint authentication of power grid equipment access behavior and real-time power grid operating status, this application provides a power grid equipment access authentication method, which includes steps S1 to S7, each step as follows: Step S1: Receive the negotiation start message sent by the power grid equipment; wherein, the negotiation start message includes the equipment identity certificate, access context information, equipment proof capability parameters and current electrical status summary; Among them, the negotiation initiation message is a message sent by the power grid equipment to the edge authentication node when initiating access to start the authentication negotiation process. It carries information such as the equipment identity credentials, access context, proof capability parameters and current electrical status summary.

[0031] Device identity credentials are credential information held by power grid devices to prove their legitimate identity. They can be device identity commitment values ​​generated during the grid registration phase or other forms of identity identifiers, and are used to prove the legitimate identity of the device to edge authentication nodes during the authentication process.

[0032] Access context information describes the context data of the current access scenario for the power grid equipment, including the access domain identifier and the current access request. The access domain identifier is a unique identifier for the domain that the power grid equipment is currently requesting access to, indicating the substation domain, feeder domain, or bay domain range to which this access request belongs. The current access request is the operation content to be performed by the power grid equipment in this request, including the command type of the request (such as telemetry read, remote signaling read, setting value read, parameter write, remote control operation, etc.) and the data object (such as the specific data item to be read or the specific parameter value to be written).

[0033] The device proof capability parameter is a descriptive information about the proof capability of the power grid equipment itself. It is used to evaluate the proof circuit template versions and algorithm suites that the equipment can support during subsequent policy negotiation. It includes the secure storage area processing capacity, the supported algorithm suites, and the maximum proof data length.

[0034] The current electrical status summary is a compressed description of the electrical status generated by power grid equipment based on the current operating conditions. It includes the current voltage level identifier, current frequency status identifier, current switch position status identifier, current protection pressure plate status identifier, and current sampling time window, which is used to verify whether the current electrical status of the equipment matches the real-time operating status of the power grid.

[0035] Step S2: Obtain the real-time operating status of the power grid, and generate an operating constraint set based on the real-time operating status of the power grid, access context information, and pre-stored equipment registration information of the power grid equipment; Among them, the real-time operation status of the power grid is the power grid operation status information of the area corresponding to the access domain identifier at the current moment, including the power grid topology status (feeder connection relationship, bus operation mode, bay commissioning / discharging status, switch opening / closing status), maintenance status (equipment maintenance status, bay maintenance status, feeder maintenance status, station maintenance status), and dispatch control status (local control status, remote control status, dispatch interlocking status, emergency response status), which is used to provide the current power grid operation boundary conditions for this certification.

[0036] Equipment registration information is the archive information pre-stored in the power grid certification registration form during the power grid equipment registration stage. It includes equipment operation domain mapping table, equipment role identifier and command permission benchmark table, etc., and is used to provide the equipment's ownership scope, role positioning and basic permission benchmark during the certification process.

[0037] The operational constraint set is a set of rules that the edge authentication node must follow for this access, generated based on the real-time operating status of the power grid, access context information, and equipment registration information. It includes location constraints, electrical state constraints, permitted operation constraints, proof condition constraints, and attribute disclosure constraints, and is used to provide a unified rule benchmark for subsequent candidate policy generation, zero-knowledge proof message verification, and session permission determination.

[0038] Step S3: Generate a candidate strategy set based on the operating constraint set and the equipment proof capability parameters, and send the candidate strategy set to the power grid equipment; The candidate strategy set is a collection of several optional proof strategies generated by the edge authentication node based on the set of operating constraints and the device proof capability parameters. Each candidate strategy includes a proof circuit combination, an attribute disclosure mask, and proof parameters. Each strategy has differentiated configurations in terms of proof content completeness, computational complexity, and privacy disclosure level, which are used by power grid equipment to select an appropriate proof scheme according to its own capabilities and privacy preferences.

[0039] Step S4: Receive the target proof strategy selected by the power grid equipment from the candidate strategy set; The target proof strategy is a specific proof scheme selected by the power grid equipment from the candidate strategy set. This strategy is determined by the power grid equipment after matching its own proof capabilities, privacy preferences and the current access request, and is used as the common parameter basis for generating session challenge values ​​and determining session permissions.

[0040] Step S5: Generate a session challenge value based on the device identity credentials, operating constraint set, target proof strategy, and current electrical state summary, and send the session challenge value to the power grid device; Among them, the session challenge value is a one-time anti-counterfeiting credential generated by the edge authentication node after performing cryptographic operations on the key elements of this authentication (device identity credential, operating constraint set, target proof strategy, and current electrical state digest). It is used to ensure that subsequent zero-knowledge proof messages are uniquely bound to this authentication session and to prevent old proof messages from being replayed and reused in other sessions.

[0041] Step S6: Receive the zero-knowledge proof message generated by the power grid equipment in response to the session challenge value; Among them, the zero-knowledge proof message is the proof data generated by the power grid equipment in response to the session challenge value. It contains consistency information (location information, electrical status information, command permission information), zero-knowledge proof credentials and session binding credentials. It is used to prove the legitimacy of identity, location, electrical status matching and operation permission compliance to the edge authentication node without disclosing the device's privacy factors and sensitive attributes in plaintext.

[0042] Step S7: Verify the zero-knowledge proof message according to the set of operational constraints. If the verification is successful, determine the session permissions of the access session of the power grid equipment according to the target proof strategy.

[0043] The verification process includes the verification of zero-knowledge proof messages by the edge authentication node based on the set of operational constraints. This process is used to confirm whether the content claimed by the device (location, electrical status, command permissions) conforms to the rules, and whether the proof itself is authentic, credible, and uniquely bound to the current session.

[0044] Session permissions are the permission boundaries determined by the edge authentication node for the power grid equipment according to the target proof policy after successful verification. They are used to constrain the types of commands that can be executed and the scope of data access during this access session, so that subsequent business operations are always constrained by the permission boundaries determined by this authentication.

[0045] In some embodiments, before step S1, i.e. during the grid connection registration phase of the power grid equipment, step S0 is also included: During the grid equipment registration phase, the grid equipment generates equipment privacy factors, equipment public factors, equipment identity commitments, equipment attribute commitments, operating domain mapping commitments, and state baseline commitments. The equipment public factors, equipment identity commitments, equipment attribute commitments, operating domain mapping commitments, state baseline commitments, equipment operating domain mapping tables, equipment role identifiers, and command permission baseline tables are written into the grid authentication registration form, and the equipment privacy factors are stored in the secure storage area of ​​the grid equipment.

[0046] Among these, the device identity commitment is used to characterize the identity of power grid equipment without directly exposing sensitive identity information such as device asset number and device serial number. The device attribute commitment is used to characterize attributes such as device model, device function category, firmware baseline, device role, and its operating domain. The operating domain mapping commitment is used to bind the correspondence between power grid equipment and its respective substation, feeder, bay, and allowed access domain. The state baseline commitment is used to bind the trusted firmware state, trusted configuration state, or secure startup state of the power grid equipment.

[0047] The equipment operation domain mapping table includes the equipment asset number, its substation identifier, its feeder identifier, its bay identifier, equipment function category, permitted access domain identifier, and permitted operation mode identifier. The operation domain mapping commitment is obtained by the power grid equipment committing to the equipment asset number, its substation identifier, its feeder identifier, its bay identifier, and permitted access domain identifier in the equipment operation domain mapping table. The command permission baseline table includes telemetry read permissions, remote signaling read permissions, setting value read permissions, parameter write permissions, remote control operation permissions, and interlocking control permissions.

[0048] Through this registration process, edge authentication nodes can determine whether a device belongs to the current access domain by simply using the commitment and proof results during subsequent authentication processes, without requiring the power grid equipment to disclose in writing the complete equipment asset number, the substation identifier, the feeder identifier, the bay identifier, and the allowed access domain identifier.

[0049] In some embodiments, step S1 receives a negotiation start message sent by the power grid equipment; wherein the negotiation start message includes equipment identity credentials, access context information, equipment proof capability parameters, and current electrical state summary.

[0050] Among them, the equipment identity certificate is the credential information held by the power grid equipment to prove the legitimacy of its identity, and can be the equipment identity commitment.

[0051] The access context information includes the access domain identifier and the current access request. The access domain identifier is used to indicate the range of the station domain, feeder domain, or bay domain to which this access request belongs. The current access request includes the command type (telemetry read, teleindication read, setpoint read, parameter write, remote control operation, or interlocking control) and the data object.

[0052] The device proof capability parameters can be a list of device capabilities, including secure storage area processing capacity, supported algorithm suites, and maximum proof data length.

[0053] The current electrical status summary is a summary generated by the power grid equipment based on the current voltage level identifier, current frequency status identifier, current switch position status identifier, current protection switch status identifier, and current sampling time window. The negotiation initiation message may also include a list of proof circuit template versions, a commitment to the current firmware status, a first random number, and a first timestamp.

[0054] Specifically, the edge authentication node receives the negotiation start message, parses the device identity credential, access context information, device proof capability parameters and current electrical status summary from the message, and stores them locally for use in subsequent steps.

[0055] In some embodiments, please refer to Figure 2 , Figure 2 This is a schematic diagram of the operation constraint set generation process according to an embodiment of this application. Step S2 obtains the real-time operation status of the power grid, and generates an operation constraint set based on the real-time operation status of the power grid, access context information, and pre-stored equipment registration information of the power grid equipment, including steps S21 to S25, each step as follows: Step S21: Determine the location constraints of the power grid equipment based on the access domain identifier, equipment registration information, and topology status, including steps S201 to S202: Step S201: Determine the operating domain mapping path corresponding to the power grid equipment based on the operating domain mapping information in the equipment registration information; Step S202: When the access domain identifier belongs to the running domain mapping path and the topology status indicates that the running domain mapping path is valid, determine the location constraint.

[0056] Among them, the location constraint is a rule jointly determined by the access domain identifier, the operating domain mapping information in the equipment registration information, and the topology status. It is used to restrict the grid equipment to be connected in a legal home location (a combination of station, feeder, and bay), and that location is reachable in the current grid topology.

[0057] Specifically, edge authentication nodes acquire the real-time operating status of the power grid, which includes topology status, maintenance status, and dispatch control status. Topology status is generated by the edge authentication nodes based on feeder connection relationships, bus operation modes, bay activation / deactivation status, and switch activation / deactivation status. Maintenance status includes equipment maintenance status, bay maintenance status, feeder maintenance status, and substation maintenance status. Dispatch control status includes local control status, remote control status, dispatch interlocking status, and emergency response status.

[0058] Edge authentication nodes determine the location constraints of power grid equipment based on the access domain identifier, equipment registration information, and topology status. The equipment operation domain mapping table in the equipment registration information includes the equipment asset number, its substation identifier, its feeder identifier, its bay identifier, equipment function category, permitted access domain identifier, and permitted operation mode identifier. Based on the operation domain mapping information in the equipment registration information, the edge authentication node determines the corresponding operation domain mapping path for the power grid equipment (formed by the hierarchical relationship of the substation identifier, feeder identifier, bay identifier, and permitted access domain identifier, from substation to feeder, from feeder to bay, and from bay to access domain). When the access domain identifier belongs to the operation domain mapping path, and the topology status indicates that the operation domain mapping path is valid, the location constraints are determined.

[0059] Step S22: Determine the electrical state constraints of the power grid equipment based on the topology. Among them, electrical state constraints are used to ensure that the current electrical state of power grid equipment is consistent with the current power grid operating mode. The current electrical state includes at least voltage level, frequency, switch position, and protection switch status.

[0060] Specifically, the edge authentication node determines the operating mode identifier based on the topology status and uses the operating mode identifier as the criterion for determining electrical state constraints to determine the electrical state constraints of the power grid equipment.

[0061] Step S23: Determine candidate operation constraints for power grid equipment based on equipment registration information and current access requests; adjust candidate operation constraints based on maintenance status and dispatch control status to determine permissible operation constraints for power grid equipment; Among them, the candidate operation constraints are the operation range initially determined by combining the device role identifier and command permission benchmark table in the device registration information with the current access request. The permitted operation constraints are the final executable operation boundaries determined after the candidate operation constraints are adjusted by maintenance status and scheduling control status.

[0062] Specifically, the edge authentication node determines candidate operational constraints for power grid equipment based on device registration information and the current access request. The command permission baseline table in the device registration information includes telemetry read permissions, remote signaling read permissions, setpoint read permissions, parameter write permissions, remote control operation permissions, and interlocking control permissions. The edge authentication node selects the command category corresponding to the current access request from the command permission baseline table based on the device role identifier, forming candidate operational constraints.

[0063] Edge authentication nodes adjust candidate operation constraints based on maintenance and dispatch control status to determine the permissible operation constraints for power grid equipment. When the maintenance scope corresponding to the maintenance status covers the access domain identifier, the edge authentication node removes the command categories corresponding to remote control operation permissions and parameter write permissions from the candidate operation constraints. When the dispatch control status is in a dispatch interlocked state or an emergency response state, the edge authentication node restricts the corresponding command categories and data write range. After the above adjustments, the permissible operation constraints for the power grid equipment are determined.

[0064] Step S24: Determine the proof condition constraints and attribute disclosure constraints for this access based on the allowed operation constraints; The proof requirements constraints include mandatory proof items and certification time windows. The attribute disclosure constraints include required disclosure attributes, committed verification attributes, and prohibited disclosure attributes.

[0065] Specifically, the edge authentication node determines the proof condition constraints and attribute disclosure constraints for this access based on the allowed operation constraints. When the maintenance status covers the access domain identifier, the firmware baseline consistency proof circuit and the runtime domain consistency proof circuit are set as mandatory proof items; when the scheduling control status is in a scheduling lockout state or an emergency response state, the command permission boundary proof circuit is set as a mandatory proof item. The edge authentication node generates an attribute disclosure mask based on the allowed command category, allowed data range, and authentication time window.

[0066] Step S25: Combine the position constraints, electrical state constraints, permissible operation constraints, proof condition constraints, and attribute disclosure constraints to determine the set of operational constraints.

[0067] The set of operational constraints includes access domain identifier, access feeder identifier, station identifier, bay identifier, operation mode identifier, permitted command category, permitted data range, authentication time window, attribute disclosure rules, and mandatory proof items.

[0068] Specifically, edge authentication nodes combine location constraints, electrical state constraints, permitted operation constraints, proof condition constraints, and attribute disclosure constraints into a set of operational constraints.

[0069] In some embodiments, step S3 generates a candidate strategy set based on the operating constraint set and the device proof capability parameters, and sends the candidate strategy set to the grid device, including steps S301 to S304, each step as follows: Step S301: Based on the equipment certification capability parameters, select the candidate circuit template set corresponding to the power grid equipment from the preset certification circuit template library; Among them, the candidate circuit template set is a collection of proof circuit templates selected from the preset proof circuit template library that match the proof capabilities of the power grid equipment. It includes available template versions of various types of proof circuits that the equipment can support (identity consistency proof circuit, operating domain consistency proof circuit, electrical state consistency proof circuit, command authority boundary proof circuit, firmware baseline consistency proof circuit).

[0070] Specifically, the edge authentication node selects a set of candidate circuit templates corresponding to the power grid equipment from a pre-defined proof circuit template library based on the equipment's proof capability parameters. The equipment proof capability parameters can be a list of equipment capabilities, including secure storage processing capacity, supported algorithm suites, and maximum proof data length. The edge authentication node matches the proof circuit template versions supported by the power grid equipment with the template versions in the pre-defined proof circuit template library based on the equipment capability list and the proof circuit template version list, selecting the templates that the power grid equipment can support as the candidate circuit template set.

[0071] Step S302: Based on the proof conditions and constraints, determine several proof circuit combinations from the candidate circuit template set; Among them, the proof circuit combination is the scheme skeleton formed by selecting several proof circuit templates from the candidate circuit template set according to the proof condition constraints, including the proof circuit types and their combination methods actually used in this candidate strategy.

[0072] Specifically, the edge authentication node determines several proof circuit combinations from the candidate circuit template set based on the proof condition constraints. The proof condition constraints include mandatory proof items and authentication time windows. The mandatory proof items indicate the types of proof circuits that must be included. The edge authentication node determines different proof circuit combination methods based on the allowed command categories and mandatory proof items in the operation constraint package: (1) When the operation constraint package only contains telemetry reading permissions or remote signaling reading permissions, the proof circuit combination must include at least an identity consistency proof circuit, an operation domain consistency proof circuit, and an electrical state consistency proof circuit; (2) When the operation constraint package contains parameter writing permissions, remote control operation permissions, or interlocking control permissions, the proof circuit combination must also include a command permission boundary proof circuit and a firmware baseline consistency proof circuit; (3) When the maintenance status covers the access domain identifier, the proof circuit combination must include an operation domain consistency proof circuit and a firmware baseline consistency proof circuit. The edge authentication node selects the corresponding template from the candidate circuit template set according to the above rules and combines them into several proof circuit combinations.

[0073] Step S303: Based on the attribute disclosure constraints, generate corresponding attribute disclosure masks and proof parameters for each proof circuit combination; Among them, the attribute disclosure mask is a privacy disclosure strategy identifier generated for each proof circuit combination based on the attribute disclosure constraints. It is used to indicate which attributes must be disclosed in plaintext (required disclosure attributes), which attributes can be verified by zero-knowledge proof (committed verification attributes), and which attributes are prohibited from being disclosed (prohibited disclosure attributes) when the power grid equipment generates zero-knowledge proof messages.

[0074] The proof parameters are cryptographic execution parameters that accompany each proof circuit combination. They include the verification algorithm and the verification strength level, and are used to instruct the power grid equipment on which algorithm and what strength to use for proof when generating zero-knowledge proof messages.

[0075] Specifically, edge authentication nodes generate corresponding attribute disclosure masks and proof parameters for each proof circuit combination based on attribute disclosure constraints. Attribute disclosure constraints include attribute disclosure rules, which include required disclosure attributes, committed verification attributes, and prohibited disclosure attributes. Edge authentication nodes determine the attribute disclosure mask for each proof circuit combination based on allowed command categories, allowed data ranges, and authentication time windows. Edge authentication nodes configure corresponding proof parameters for each proof circuit combination. These proof parameters include the verification algorithm and verification strength level, determined based on the complexity of the proof circuit combination and the verification strength requirements in the runtime constraint package.

[0076] Step S304: Determine the candidate strategy set based on each proof circuit combination and its corresponding attribute disclosure mask and proof parameters.

[0077] The candidate strategy set is a collection of several candidate proof strategies. Each candidate proof strategy includes three parts of configuration information: proof circuit combination, attribute disclosure mask, and proof parameters. Power grid equipment selects the appropriate proof scheme based on its own capabilities and privacy preferences.

[0078] The edge authentication node determines a set of candidate strategies based on each proof circuit combination, its corresponding attribute disclosure mask, and proof parameters. Each candidate strategy contains three parts of configuration information: the proof circuit combination, the corresponding attribute disclosure mask, and the corresponding proof parameters. The edge authentication node then sends the set of candidate strategies to the power grid equipment.

[0079] In some embodiments, step S4 receives the target proof strategy selected by the power grid device from the candidate strategy set.

[0080] Specifically, after the edge authentication node sends the candidate policy set to the power grid equipment, the power grid equipment performs local matching on the candidate policy set.

[0081] The power grid equipment selects a suitable candidate proof strategy from the candidate strategy set as the target proof strategy based on its own secure storage capacity, supported proof circuit template versions, attribute disclosure mask requirements, and the current access request. Specifically, the power grid equipment first excludes unsupported proof circuit template versions and algorithm suites, then excludes candidate proof strategies that exceed the processing capacity of the secure storage, then excludes candidate proof strategies that require the disclosure of prohibited attributes, and finally selects the candidate proof strategy that contains mandatory proof items and has the smallest attribute disclosure range from the remaining candidate proof strategies as the target proof strategy. This matching process is performed locally by the power grid equipment; the edge authentication node does not directly obtain the complete attribute plaintext of the equipment.

[0082] After determining the target proof strategy, the power grid equipment sends a strategy confirmation message to the edge authentication node. The strategy confirmation message includes the strategy number of the target proof strategy, a second random number, and a commitment to accept the constraint packet.

[0083] The constraint package acceptance commitment is a set of commitment data generated by the secure storage area, which the power grid device uses to prove to the edge authentication node that the power grid device has accepted the operational constraint set for this access and that the constraint set has been bound to the selected target proof policy. Before generating the constraint package acceptance commitment, the secure storage area verifies whether the access domain identifier, authentication time window, mandatory proof items, and attribute disclosure mask in the power grid operational constraint package are acceptable; after the verification is passed, the secure storage area generates the constraint package acceptance commitment and binds the power grid operational constraint package to the target proof policy. This setting prevents the power grid device from bypassing the mandatory proof items and also avoids unauthorized replacement of the attribute disclosure mask or session permission template by intermediate nodes.

[0084] The edge authentication node receives the target proof strategy selected by the power grid equipment from the candidate strategy set, that is, it receives the strategy confirmation message, and parses the strategy number, second random number and constraint packet acceptance commitment of the target proof strategy from the message for use in subsequent steps.

[0085] In some embodiments, step S5 generates a session challenge value based on the device identity credentials, operational constraint set, target proof strategy, and current electrical state summary, including steps S501 and S502, each of which is as follows: Step S501: Obtain session context data based on device identity credentials, operational constraint set, target proof strategy, and current electrical state summary; The session context data is intermediate data composed of four inputs: device identity credentials, operational constraint set, target proof strategy, and current electrical state digest. It is used as input for cryptographic operations to generate session challenge values.

[0086] Specifically, after receiving the policy confirmation message sent by the power grid equipment, the edge authentication node concatenates the equipment identity credential, the set of operating constraints, the target proof policy, and the current electrical state summary to form session context data.

[0087] Step S502: Perform encryption operations on the session context data to generate a session challenge value.

[0088] Specifically, the edge authentication node performs cryptographic operations (such as hash operations or message authentication code operations) on the session context data to generate a session challenge value bound to the current authentication context. The session challenge value uniquely corresponds to the current authentication context, enabling the current proof process to be associated with a specific access domain, a specific power grid operation constraint package, a specific target proof strategy, and a specific electrical state digest, preventing old proof messages from being replayed and reused in other sessions. The edge authentication node then sends the session challenge value to the power grid equipment.

[0089] In some embodiments, after the edge authentication node generates the session challenge value in step S5, if the power grid topology state, maintenance state, dispatch control state, or current electrical state summary changes, the edge authentication node terminates the current session challenge value and regenerates the power grid operation constraint package and candidate proof strategy set based on the changed power grid topology state, maintenance state, dispatch control state, or current electrical state summary.

[0090] For example, if a feeder changes from normal operation to maintenance status during the authentication process, the grid operation constraint package that previously allowed the command category corresponding to the parameter write permission becomes invalid. The edge authentication node regenerates the grid operation constraint package after deleting the allowed command category corresponding to the parameter write permission, and requires the grid equipment to reselect the target proof strategy and regenerate the zero-knowledge proof message. This setting can prevent the authentication process from becoming disconnected from the actual grid operation status.

[0091] In some embodiments, step S6 receives a zero-knowledge proof message generated by the power grid device in response to the session challenge value.

[0092] After receiving the session challenge value sent by the edge authentication node, the power grid equipment generates a zero-knowledge proof message based on the device privacy factor, device attribute commitment, operating domain mapping commitment, state baseline commitment, current firmware state commitment, current electrical state summary, power grid operation constraint package, target proof strategy, and session challenge value.

[0093] Specifically, the power grid equipment calls upon the device privacy factors stored in the secure storage area, and combines them with the device attribute commitment, operating domain mapping commitment, state baseline commitment, current firmware state commitment, current electrical state summary, power grid operation constraint package, target proof strategy, and session challenge value to perform zero-knowledge proof calculation according to the proof circuit combination and verification algorithm specified in the target proof strategy, thereby generating a zero-knowledge proof message.

[0094] The zero-knowledge proof message includes a zero-knowledge proof value, a session binding value, an operational domain consistency commitment, an electrical state consistency commitment, and a command authority boundary commitment. The zero-knowledge proof value proves that the grid equipment possesses the equipment's private factors corresponding to its public factors, and proves that its attribute commitment, operational domain mapping commitment, and state baseline commitment meet the requirements of the target proof strategy. The session binding value proves that the zero-knowledge proof message is bound to the current session challenge value, the grid operation constraint package, and the target proof strategy. The operational domain consistency commitment proves that the allowed access domain identifier in the equipment's operational domain mapping table contains the current access domain identifier, and proves that the operational domain mapping path is consistent with the grid topology state. The electrical state consistency commitment proves that the current electrical state summary satisfies the consistency relationship between the operating mode identifier, access feeder identifier, station identifier, and bay identifier in the grid operation constraint package. The command authority boundary commitment proves that the command category in the current access request belongs to the allowed command category, and that the data object in the current access request belongs to the allowed data range.

[0095] Zero-knowledge proof messages may also include a header, a proof policy field, a public input field, a commitment field, a zero-knowledge proof field, and a session binding field. The header records the device identity commitment and the policy number of the target proof policy; the proof policy field records the identity consistency proof circuit, operational domain consistency proof circuit, electrical state consistency proof circuit, command authority boundary proof circuit, and firmware baseline consistency proof circuit used in this instance; the public input field records the access domain identifier, the grid operation constraint packet summary, the current electrical state summary, and the session challenge value; the commitment field records the operational domain consistency commitment, the electrical state consistency commitment, and the command authority boundary commitment; the zero-knowledge proof field records the zero-knowledge proof value; and the session binding field records the session binding value.

[0096] After generating a zero-knowledge proof message, the power grid equipment sends it to the edge authentication node. The edge authentication node receives the zero-knowledge proof message.

[0097] In some embodiments, in step S7, before the edge authentication node verifies the zero-knowledge proof message, it first performs version and revocation status verification.

[0098] The power grid certification registration form also includes the device status version number, firmware baseline version number, proof circuit template version number, and revocation status identifier. The edge certification node matches the current firmware status commitment with the status baseline commitment corresponding to the firmware baseline version number, and matches the proof circuit template version list with the proof circuit template version number. If the revocation status identifier is "revoked," or if the current firmware status commitment does not match the status baseline commitment corresponding to the firmware baseline version number, or if the proof circuit template version list does not match the proof circuit template version number, an certification rejection result is generated, and the verification process is terminated.

[0099] After the version and revocation status verification passes, the edge authentication node then performs constraint consistency verification and cryptographic validity verification.

[0100] In some embodiments, in step S7, the zero-knowledge proof message includes consistency information and session binding information. The consistency information includes location information, electrical state information, and command authorization information. The zero-knowledge proof message is verified according to the set of operational constraints, including steps S711 to S714, each of which is as follows: Step S711: Verify whether the location information is consistent with the location constraints to obtain the location verification result; Specifically, the edge authentication node obtains location information from the consistency information of the zero-knowledge proof message. For example, the location information can be a runtime domain consistency commitment, and the location constraints are obtained from the runtime constraint set. The location constraints include the station identifier, feeder identifier, and bay identifier of the legitimate home location of the device.

[0101] The edge authentication node verifies whether the following sub-items in the location information are consistent with the location constraints: (1) whether the allowed access domain identifier in the location information includes the current access domain identifier; (2) whether the operation domain mapping path in the location information is consistent with the power grid topology (i.e., the feeder connection relationship, bay activation / deactivation status, and switch activation / deactivation status in the path match the current power grid topology). If all the above sub-items are consistent, the location verification result is passed; otherwise, it is failed.

[0102] Step S712: Verify whether the electrical state information is consistent with the electrical state constraints to obtain the electrical verification result; Specifically, edge authentication nodes obtain electrical state information from the consistency information of zero-knowledge proof messages. Optionally, the electrical state information can be an electrical state consistency commitment, and electrical state constraints are obtained from the operational constraint set. The electrical state constraints include the voltage level range, frequency range, expected state of switch positions, and expected state of protection plates corresponding to the current power grid operating mode.

[0103] The edge authentication node verifies whether the following sub-items in the electrical status information are consistent with the electrical status constraints: (1) whether the voltage level identifier in the electrical status information is consistent with the voltage level range in the operating mode constraints; (2) whether the frequency status identifier in the electrical status information is consistent with the frequency range in the operating mode constraints; (3) whether the switch position status identifier in the electrical status information is consistent with the expected switch position status in the operating mode constraints; and (4) whether the protection pressure plate status identifier in the electrical status information is consistent with the expected protection pressure plate status in the operating mode constraints. If all the above sub-items are consistent, the electrical verification result is passed; otherwise, it is failed.

[0104] Step S713: Verify whether the command permission information is consistent with the allowed operation constraints, and obtain the permission verification result; Edge authentication nodes obtain command permission information from the consistency information of zero-knowledge proof messages. For example, the command permission information can be a command permission boundary commitment. They also obtain permitted operation constraints from the set of operational constraints. Permitted operation constraints include permitted command categories and permitted data ranges; optionally, they include data read ranges and data write ranges.

[0105] The edge authentication node verifies whether the following sub-items in the command permission information are consistent with the allowed operation constraints: (1) whether the command category in the command permission information belongs to the allowed command category in the allowed operation constraints; (2) whether the data object in the command permission information belongs to the allowed data range in the allowed operation constraints. If all the above sub-items are consistent, the permission verification result is passed; otherwise, it is failed.

[0106] Step S714: Determine the constraint verification result based on the location verification result, electrical verification result, and permission verification result.

[0107] The edge authentication node aggregates the location verification results, electrical verification results, and permission verification results. If all three are passed, the constraint verification result is considered passed; otherwise, it is considered failed.

[0108] In some embodiments, in step S7, the zero-knowledge proof message further includes a zero-knowledge proof credential and a session binding credential. The proof parameters include a verification algorithm and a verification strength level. Verifying the zero-knowledge proof message further includes steps S721 to S724, each of which is as follows: Step S721: Determine the target verification algorithm and target verification strength level corresponding to the target verification strategy; Specifically, the edge authentication node obtains the target proof strategy selected by the power grid equipment, and extracts the configured target verification algorithm and target verification strength level from the proof parameters of the target proof strategy. The target verification algorithm is the verification algorithm corresponding to the cryptographic algorithm used by the power grid equipment when generating zero-knowledge proof credentials; the target verification strength level is the verification strength level used by the power grid equipment when generating zero-knowledge proof credentials.

[0109] Step S722: Based on the target verification algorithm and the target verification strength level, perform cryptographic verification on the zero-knowledge proof credential to obtain the cryptographic verification result; Specifically, edge authentication nodes obtain zero-knowledge proof credentials from the zero-knowledge proof message. The edge authentication nodes employ a target verification algorithm and a target verification strength level to perform cryptographic verification on the zero-knowledge proof credentials. This involves calling the corresponding verification function according to the target verification algorithm, setting verification parameters according to the target verification strength level, and performing verification operations on the zero-knowledge proof credentials. The verification determines whether the credentials were generated from the correct private factors and whether they satisfy the constraints defined by the proof circuit, thus confirming that the power grid equipment indeed possesses the private factors corresponding to the equipment's public factors. If the verification passes, the cryptographic verification result is considered successful; otherwise, it is considered unsuccessful.

[0110] Step S723: Verify whether the session binding credentials and the session challenge value are consistent, and obtain the binding verification result; Among them, the session binding credentials are binding data carried by the power grid equipment in the zero-knowledge proof message, which is used to prove that the zero-knowledge proof message is bound to the current session challenge value, the power grid operation constraint package and the target proof strategy.

[0111] Specifically, the edge authentication node retrieves the session binding credential from the zero-knowledge proof message and obtains the locally stored session challenge value. The edge authentication node verifies whether the session binding credential and the session challenge value are consistent (i.e., whether their values ​​are the same or meet a preset correspondence) to confirm that the zero-knowledge proof message was generated for this authentication session, and not an old message reused or replayed from other sessions. If they are consistent, the binding verification result is successful; otherwise, it is unsuccessful.

[0112] Step S724: Determine the password verification result based on the cryptographic verification result and the binding verification result.

[0113] The edge authentication node aggregates the cryptographic verification results and the binding verification results. If both are successful, the cryptographic verification result is considered successful; otherwise, it is considered unsuccessful.

[0114] In some embodiments, in step S7, the session permissions of the access session of the power grid equipment are determined according to the target proof strategy, including steps S731 to S734, each of which is as follows: Step S731: Determine the target session permission template corresponding to the target proof strategy; Specifically, the edge authentication node obtains the target proof strategy selected by the power grid equipment and extracts the target session permission template from the configuration parameters of the target proof strategy. The target session permission template is a permission template pre-configured when the candidate proof strategy is generated (each candidate proof strategy is configured with a corresponding session permission template when it is generated; after the device selects the target proof strategy, the session permission template corresponding to that strategy becomes the target session permission template). It is used to indicate the permission configuration that can be obtained after passing the strategy, including permission boundary information such as allowed command categories and allowed data ranges.

[0115] Step S732: Determine the first operating scope of the power grid equipment based on the target session permission template; Specifically, the edge authentication node uses the permission boundaries defined in the target session permission template as the first operational scope. The first operational scope represents the upper limit of permissions preset at the policy level, including allowed command categories and allowed data ranges.

[0116] Step S733: Determine the second operating range of the power grid equipment based on the permissible operating constraints; Specifically, the edge authentication node obtains the permitted operation constraints from the set of operational constraints and uses the permission boundaries defined by the permitted operation constraints as the second operation range. The permitted operation constraints are the final executable operation boundaries (including permitted command categories and permitted data ranges, with the permitted data range including data read range and data write range) determined after the candidate operation constraints are adjusted by maintenance status and scheduling control status, representing the dynamic constraint boundaries determined by the real-time operating status of the power grid.

[0117] Step S734: Determine the session permission range of the power grid equipment based on the intersection of the first operation range and the second operation range.

[0118] Specifically, the edge authentication node takes the overlapping portion of the first and second operating ranges as the session permission range. The session permission range neither exceeds the policy-preset authorization limit (first operating range) nor the dynamic boundary allowed by the real-time state of the power grid (second operating range). The allowed command categories are the intersection of the allowed command categories in the first and second operating ranges; the allowed data range is the overlapping portion of the allowed data ranges in the first and second operating ranges.

[0119] Edge authentication nodes establish access sessions for power grid devices based on session permission scope. The access session can include allowed command categories, data read range, data write range, session validity period, authentication time window, whether re-authentication is required, and prohibited command categories.

[0120] In some embodiments, after the access session is established, step S8 is further included to generate session re-proof conditions.

[0121] Specifically, the edge authentication node generates session re-proof conditions based on the authentication time window, power grid topology status, maintenance status, dispatch control status, and the command type of the current access request.

[0122] The session re-proof conditions include at least one of the following: the authentication time window expires, the power grid topology status changes, the maintenance status changes, the dispatch control status changes, the current access request changes from a read command to a write command, or the current access request changes from a normal data access to a remote control operation or a parameter writing operation.

[0123] When the session reproof condition is met, the edge authentication node retains the verification result of the device identity commitment and regenerates the power grid operation constraint package, enabling the power grid device to regenerate a zero-knowledge proof message containing the operation domain consistency commitment, electrical state consistency commitment, and command authority boundary commitment.

[0124] This method can perform lightweight re-proof of operating domain, electrical status, and command permission boundaries without repeating complete identity authentication, making it suitable for access scenarios where the power grid operating status changes frequently.

[0125] In an optional implementation, to verify the technical effectiveness of this embodiment, a simulation test environment is constructed. The test environment includes one edge authentication node, 20 power grid equipment simulation terminals, a power grid authentication registration form, and a set of simulated power grid topology state data. The 20 power grid equipment simulation terminals are configured with different device role identifiers, device operating domain mapping tables, and command permission baseline tables, including data acquisition devices, protection and control devices, and control devices. Test scenarios include normal operation scenarios, interval maintenance scenarios, feeder maintenance scenarios, dispatch interlocking scenarios, and emergency response scenarios.

[0126] The comparative example employs a traditional two-way authentication method based on digital certificates. This method bases authentication decisions on two conditions: the device's identity is genuine and the certificate status is normal. The authentication node assigns fixed operating permissions to verified devices according to a preset permission rule table. The authentication process involves authentication request, challenge, response, and verification. This embodiment uses a power grid operation constraint package, a combination of multiple proof circuits, a self-negotiating target proof strategy, and command permission boundary verification. The test data above are statistical results obtained under the same number of devices, the same number of access requests, and the same proportion of abnormal scenarios. The test results are used to illustrate the technical effectiveness of this embodiment relative to the comparative example in a simulation environment. The test results are shown in Table 1 below.

[0127] Table 1 Comparison of Performance Test Results of Certification Methods The test data above shows that, while slightly increasing the average authentication latency, this embodiment significantly reduces the false pass rate of legitimate devices in the erroneous access domain, the false pass rate of parameter write requests in maintenance mode, the false pass rate of remote control operation requests in scheduling lockout mode, and the false pass rate of devices with abnormal firmware status executing high-risk control commands involving remote control operation permissions or parameter write permissions. Simultaneously, this embodiment reduces the number of device attribute fields that need to be disclosed in plaintext during the authentication process, enabling unified verification of device identity, device operating domain, current electrical status, and command permission boundaries with less disclosure of sensitive attributes.

[0128] The beneficial effects of this embodiment are as follows: by integrating grid topology, maintenance, scheduling, electrical status, and command permission benchmarks into the authentication context through the operation constraint package, the authentication result simultaneously reflects the legality of the device identity and the matching relationship between the current access behavior and the grid operation status; by selecting the target strategy through a candidate strategy set and device self-negotiation, devices with different proof capabilities can obtain proof schemes that are compatible with their own computing power and current operation constraints; by verifying the three-dimensional commitment of the operation domain, electrical status, and command permission boundaries, edge authentication nodes can complete joint authentication without obtaining the plaintext of sensitive device attributes; by dynamically pruning operation permissions based on maintenance and scheduling status, the risk of erroneous execution of high-risk operations under abnormal operating conditions is reduced; and by using a session re-proof mechanism, established sessions remain consistent with real-time operating conditions even after changes in grid status.

[0129] In some embodiments, this application provides a power grid equipment access authentication system, which is used to perform the power grid equipment access authentication method as described in this application.

[0130] It is understood that the above system item embodiments correspond to the method item embodiments of this application, and can implement the power grid equipment access authentication method provided by any of the above method item embodiments of this application.

[0131] Based on the above-described method embodiments, another embodiment of this application provides a computer-readable storage medium, including: a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the power grid equipment access authentication method as described in any of the above-described method embodiments of this application.

[0132] The modules / units integrated into the device / terminal equipment, if implemented as software functional units and sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0133] The above are preferred embodiments of this application. It should be noted that, for those skilled in the art, several improvements and modifications can be made without departing from the principles of this application, and these improvements and modifications are also considered to be within the scope of protection of this application.

Claims

1. A method for power grid equipment access authentication, characterized in that, include: Receive a negotiation start message sent by a power grid device; wherein the negotiation start message includes device identity credentials, access context information, device capability verification parameters, and a current electrical status summary; The real-time operating status of the power grid is obtained, and an operating constraint set is generated based on the real-time operating status of the power grid, the access context information, and the pre-stored equipment registration information of the power grid equipment. A candidate strategy set is generated based on the operational constraint set and the equipment proof capability parameters, and the candidate strategy set is sent to the power grid equipment; Receive the target proof strategy selected by the power grid equipment from the candidate strategy set; A session challenge value is generated based on the device identity credential, the set of operational constraints, the target proof strategy, and the current electrical state summary, and the session challenge value is sent to the power grid device; Receive the zero-knowledge proof message generated by the power grid equipment in response to the session challenge value; The zero-knowledge proof message is verified according to the set of operational constraints. If the verification passes, the session permissions of the access session of the power grid equipment are determined according to the target proof strategy.

2. The power grid equipment access authentication method according to claim 1, characterized in that, The access context information includes the access domain identifier and the current access request; the real-time power grid operating status includes topology status, maintenance status, and dispatch control status; and the generation of an operating constraint set based on the real-time power grid operating status, the access context information, and the pre-stored equipment registration information of the power grid equipment includes: The location constraints of the power grid equipment are determined based on the access domain identifier, the device registration information, and the topology status. Based on the topology, determine the electrical state constraints of the power grid equipment; Based on the device registration information and the current access request, determine the candidate operational constraints of the power grid device; Based on the maintenance status and the dispatch control status, adjust the candidate operation constraints and determine the permissible operation constraints of the power grid equipment; Based on the permitted operation constraints, determine the proof condition constraints and attribute disclosure constraints for this access; The set of operational constraints is determined by combining the position constraints, electrical state constraints, permissible operation constraints, proof condition constraints, and attribute disclosure constraints.

3. The power grid equipment access authentication method according to claim 2, characterized in that, The step of generating a candidate strategy set based on the operational constraint set and the device proof capability parameters includes: Based on the equipment proof capability parameters, a set of candidate circuit templates corresponding to the power grid equipment is selected from a preset proof circuit template library; Based on the aforementioned proof conditions, several proof circuit combinations are determined from the candidate circuit template set; Based on the attribute disclosure constraints, generate corresponding attribute disclosure masks and proof parameters for each of the proof circuit combinations; A set of candidate strategies is determined based on each of the aforementioned proof circuit combinations, the corresponding attribute disclosure mask, and the proof parameters.

4. The power grid equipment access authentication method according to claim 2, characterized in that, The zero-knowledge proof message includes consistency information and session binding information. The consistency information includes location information, electrical state information, and command authorization information. The verification of the zero-knowledge proof message based on the set of operational constraints includes: Verify whether the location information is consistent with the location constraints to obtain the location verification result; Verify whether the electrical state information is consistent with the electrical state constraints to obtain the electrical verification result; Verify whether the command permission information is consistent with the allowed operation constraints to obtain the permission verification result; Based on the location verification result, the electrical verification result, and the permission verification result, the constraint verification result is determined.

5. The power grid equipment access authentication method according to claim 3, characterized in that, The zero-knowledge proof message also includes a zero-knowledge proof credential and a session binding credential. The proof parameters include a verification algorithm and a verification strength level. Verifying the zero-knowledge proof message further includes: Determine the target verification algorithm and target verification strength level corresponding to the target proof strategy; Based on the target verification algorithm and the target verification strength level, the zero-knowledge proof credential is cryptographically verified to obtain the cryptographic verification result. Verify whether the session binding credentials are consistent with the session challenge value to obtain the binding verification result; The password verification result is determined based on the cryptographic verification result and the binding verification result.

6. The power grid equipment access authentication method according to claim 1, characterized in that, The step of generating a session challenge value based on the device identity credential, the operational constraint set, the target proof strategy, and the current electrical state digest includes: Based on the device identity credentials, the set of operational constraints, the target proof strategy, and the current electrical state summary, session context data is obtained; The session context data is encrypted to generate the session challenge value.

7. The power grid equipment access authentication method according to claim 2, characterized in that, The step of determining the session permissions of the access session of the power grid equipment according to the target proof strategy includes: Determine the target session permission template corresponding to the target proof strategy; The first operating scope of the power grid equipment is determined based on the target session permission template; The second operating range of the power grid equipment is determined based on the permissible operating constraints; The session permission range of the power grid equipment is determined based on the intersection of the first operation range and the second operation range.

8. The power grid equipment access authentication method according to claim 2, characterized in that, The step of determining the location constraints of the power grid equipment based on the access domain identifier, the device registration information, and the topology status includes: Based on the operating domain mapping information in the equipment registration information, determine the operating domain mapping path corresponding to the power grid equipment; The location constraint is determined when the access domain identifier belongs to the running domain mapping path and the topology status indicates that the running domain mapping path is valid.

9. A power grid equipment access authentication system, characterized in that, The power grid equipment access authentication system is used to execute the power grid equipment access authentication method as described in any one of claims 1-8.

10. A computer-readable storage medium, characterized in that, include: A stored computer program, wherein, when the computer program is executed, it controls the device containing the computer-readable storage medium to perform the power grid equipment access authentication method as described in any one of claims 1-8.

Images