A black start method, system and device of power network security capability and a storage medium

Abstract

The present application relates to the technical field of power system network security protection, and discloses a black start method, system and device for power network security capability and a storage medium, wherein the present application constructs an independent trusted verification anchor point by relying on a heterogeneous trusted anchor point cluster and a hardware level benchmark trust root, and realizes security capability priority reconstruction by majority voting and hierarchical chain recovery mechanism. Through independent out-of-band network isolation control, various abnormal nodes are disposed in stages, and the problem of traditional disaster recovery trust environment being polluted and the recovery process being attacked again is avoided. Two-level hardware write protection storage guarantees that the trust benchmark and audit logs are not tamperable, and the whole process dynamically identifies and blocks attacks and completes node self-healing, which deeply fits the power safety partition protection specification, and the network security capability self-start recovery can be completed without an external trusted environment, and the system high availability and the power industry compliance landing demand are considered.

Description

Technical Field

[0001] This invention relates to the field of power system network security protection technology, specifically to a black-start method, system, device, and storage medium for power system network security capabilities. Background Technology

[0002] Black boot is a crucial emergency measure for power systems to cope with large-scale power outages. Its core logic is a self-bootstrapping, progressive network reconstruction and trust transfer. With the advancement of new power system construction, the power system's cybersecurity architecture is shifting towards openness and interaction. The attack exposure of critical power equipment and business systems has increased dramatically. APT attacks, ransomware attacks, and supply chain attacks targeting the power industry are frequent. In extreme cases, catastrophic events may occur, such as the complete breach of the security control system, malicious implantation of the system's root of trust, and large-scale equipment hijacking. This can lead to the paralysis of core network security capabilities, the inability to verify the reliability of online and offline backups, and the failure of traditional disaster recovery methods.

[0003] Current black-start technologies for power systems mainly focus on restoring power supply to the physical power grid, lacking dedicated black-start solutions for network security capabilities. General information system disaster recovery technologies generally prioritize business and data recovery, with security capabilities only serving as a supplementary measure. Under extreme power attack scenarios, these technologies have the following shortcomings: disaster recovery relies on a compromised and compromised controlled environment, lacks independent trusted verification anchors, cannot complete backup trustworthiness verification in extreme scenarios, and faces the risk of secondary attacks during the recovery process. This leads to the easy paralysis of the security system under extreme attacks, the failure of traditional disaster recovery, and the inability to reliably rebuild security capabilities. Summary of the Invention

[0004] This invention provides a black boot method, system, device, and storage medium for power network security capabilities, in order to solve the problems that security systems are easily paralyzed under extreme attacks, traditional disaster recovery fails, and security capabilities cannot be reliably bootstrapped and rebuilt.

[0005] In a first aspect, the present invention provides a black-start method for power network security capabilities, the method comprising: Trigger a black start, power on multiple heterogeneous trusted anchor execution entities in the trusted anchor cluster, and bootstrap and vote on the corresponding anchor trust roots to generate the first voting result; When the first voting result meets the preset majority voting pass condition, cross-validation is performed on the heterogeneous security control plane, and voting is conducted according to the cross-validation result to generate the second voting result. The heterogeneous security control plane that passed the vote in the second voting result is activated, and the security nodes in each security partition are progressively restored and voted on according to the preset security level priority. When all security nodes within all security partitions pass the vote, the service nodes are progressively restored according to the preset service priority, and a vote is held on each of the service nodes. If each of the aforementioned business nodes passes the vote, then the global steady-state operation criterion strategy generated by each of the aforementioned heterogeneous trusted anchor executors is voted on, and the black start is completed and the normalized intrinsic security operation mode is executed based on the voting result of the global steady-state operation criterion strategy.

[0006] This invention relies on a heterogeneous trusted anchor cluster and a hardware-level baseline trust root to construct independent trusted verification anchors, achieving priority reconstruction of security capabilities through majority voting and a layered chain recovery mechanism. Through independent out-of-band network isolation and management, it handles various abnormal nodes in a tiered manner, avoiding the problems of traditional disaster recovery trusted environments being contaminated and secondary attacks occurring during the recovery process. Two levels of hardware write-protected storage ensure the trust baseline and the immutability of audit logs. The entire process dynamically identifies and blocks attacks and completes node self-healing, deeply aligning with power security partitioning protection specifications. It can achieve self-bootstrapping and recovery of network security capabilities without an external trusted environment, balancing system high availability with the compliance requirements of the power industry.

[0007] In one optional implementation, the triggering of the black boot involves powering on multiple heterogeneous trusted anchor executions within the trusted anchor cluster and bootstrapping and voting on the corresponding anchor trust roots to generate a first voting result, including: Trigger a black start and simultaneously power on multiple heterogeneous trusted anchor executions in the trusted anchor cluster; The hardware trusted module firmware and the master device boot firmware within the execution bodies of each heterogeneous trusted anchor point are bootstrapped. After the bootstrapping is successful, the complete file of the baseline root of trust in the local hardware write-protected storage area is extracted and combined with the anchor root of trust in the physically immutable hardware storage area. The trust measurement of the anchor root of trust is then performed to generate standardized measurement results. The first voting result is generated by voting on each of the standardized metric results.

[0008] This invention relies on a physically immutable hardware storage area to solidify the root of trust hash, and combines it with a hardware trusted module to complete the underlying firmware self-verification, constructing an independent hardware trusted anchor point. By combining a local same-source benchmark root of trust measurement with a cluster voting mechanism, it eliminates the risk of the root of trust being implanted and tampered with, avoiding the shortcomings of traditional disaster recovery that relies on polluted environments for verification and backup. The hardware-level isolation verification process has no dependence on an external trust system, can accurately identify damaged execution entities and isolate alarms, and solidify the underlying trusted foundation for the entire black boot process.

[0009] In one optional implementation, the voting rules used to generate the first voting result include flexible voting rules: If less than half of the trusted anchor executions fail the verification, a physical power-off isolation command is issued to the abnormal executions and a security alarm is triggered. The remaining executions are then switched to a voting rule where all results are completely consistent. The verification is considered successful only if all the remaining trusted anchor executions output consistent results. If half or more of the trusted anchor executions fail the verification, the entire cluster is immediately powered off to terminate the process and a security alarm is triggered.

[0010] This invention introduces flexible voting rules to differentiate the handling of anomalies based on their scale. When a small number of execution units malfunction, the faulty unit is isolated and voting conditions are tightened to prevent single-point anomalies from interfering with the judgment. If there is a risk of half or more execution units failing, the cluster is directly powered off to terminate the black start. This approach balances system fault tolerance and security baseline, effectively resisting coordinated attacks against trusted anchor clusters and preventing the recovery process from proceeding when the foundation of trust is compromised.

[0011] In one optional implementation, when the first voting result meets the preset majority voting pass condition, cross-validation is performed on the heterogeneous security control plane, and voting is conducted according to the cross-validation result to generate a second voting result, including: When the first voting result meets the preset majority voting pass condition, the trusted reference of the heterogeneous security control plane of each heterogeneous trusted anchor executor is retrieved; The credibility determination result is obtained by using the credibility benchmark of the heterogeneous security control plane of each heterogeneous trusted anchor executor and the heterogeneous security control plane stored in the local hardware write-protected storage area to perform credibility measurement. Cross-validate the credibility determination result corresponding to any of the heterogeneous trusted anchor execution entities with the credibility determination results corresponding to the remaining heterogeneous trusted anchor execution entities, and output the cross-validation result; A second voting result is generated by voting on each of the credibility determination results and each of the cross-validation results. When the first voting result does not meet the preset majority voting pass condition, it is determined that the bootstrap verification of each heterogeneous trusted anchor executor fails, and the trusted anchor cluster is stopped from powering on.

[0012] This invention employs a dual verification mechanism—independent measurement across a heterogeneous control plane and cross-validation within the cluster—along with hardware majority voting to achieve trustworthiness determination. This effectively identifies instances of single-point execution entities forging verification results. Measurements are conducted based on a trusted benchmark of hardware write-protected storage, mitigating the risk of image tampering. A cluster power-off mechanism is implemented if a vote fails, promptly blocking recovery processes with potential security vulnerabilities. This strengthens the trust protection capabilities of the middle layer during black boot by resisting secondary attacks at the control plane loading stage.

[0013] In one optional implementation, the step of activating the heterogeneous security control plane that passed the vote in the second voting result, and performing progressive recovery and voting on security nodes in each security partition according to a preset security level priority, includes: Initiate the heterogeneous security control plane that passed the vote in the second voting result; According to the preset security level priority, perform progressive recovery on the security nodes in each security zone; The original measurement data of the recovered secure node is sent to all the heterogeneous trusted anchor execution entities; Each heterogeneous trusted anchor execution entity performs a full-dimensional, multi-modal trusted measurement verification on each of the security nodes, and votes on the first verification result.

[0014] This invention follows a priority-based chain recovery logic for power grid security partitions, rebuilding security nodes before allowing services to access the grid. Security node metric data is synchronized to all heterogeneous anchor points for multi-mode trusted verification, relying on cluster voting to uniformly determine the node's trusted status. During the recovery phase, only out-of-band channels are opened, while service ports are closed to prevent attacks from being introduced during the recovery process. The layered and progressive recovery mechanism ensures that security partition boundaries are closed first, blocking malicious devices from infiltrating at the node access level and enhancing the security protection strength during the power grid recovery phase.

[0015] In one optional implementation, the step of performing progressive recovery of service nodes and voting on each service node according to a preset service priority when all security nodes within the security partition pass the vote includes: Physically isolate and reconstruct security nodes that failed to pass the vote within each of the aforementioned security partitions; When all security nodes within the aforementioned security partition pass the vote, the service nodes are gradually restored according to the preset service priority. Send the access requests of each of the aforementioned business nodes to all of the aforementioned heterogeneous trusted anchor execution entities; Each heterogeneous trusted anchor execution entity performs a full-dimensional, multi-modal trusted measurement verification on each business node, and votes on the second verification result.

[0016] This invention implements physical isolation and mirror reconstruction of verification-abnormal security nodes to block the spread of attacks. Business nodes are only allowed access after all security nodes have completed trusted verification. Business access requests are synchronized to all heterogeneous anchor points for multi-mode trusted measurement and cluster voting. Strictly adhering to a security-first recovery logic, only trusted business nodes are allowed access with minimal privileges to prevent compromised business nodes from accessing and polluting the security network, thus complying with the power system's security zoning management requirements.

[0017] In one optional implementation, if each of the service nodes passes the vote, the global steady-state operation criterion strategy generated by each of the heterogeneous trusted anchor executors is voted on, and the black start and normalized intrinsic security operation mode are determined based on the voting result of the global steady-state operation criterion strategy, including: If each of the aforementioned business nodes passes the vote, then the global steady-state operation criterion strategy generated by each of the aforementioned heterogeneous trusted anchor execution entities is retrieved; Each of the aforementioned global steady-state operation criteria and strategies is cross-validated and voted on sequentially. When the global steady-state operation criterion strategy is approved, the black start is completed and the normalized intrinsic safety operation mode is executed. When the global steady-state operation criterion strategy votes against the decision, the steady-state operation process is terminated and a safety alarm is triggered.

[0018] After all business nodes have undergone trusted verification, this invention uniformly performs cross-validation and cluster voting on the overall steady-state security policy. Only when the policy verification passes can the black start process officially end and transition to normal secure operation; if the verification fails, the process is directly terminated and an alarm is triggered. This effectively prevents malicious tampering with core security configurations such as control policies and audit rules, ensuring the overall security policy is trusted and unified after the power grid is restored, and completing a trusted closed loop for the entire black start chain.

[0019] In an optional implementation, the method further includes: Collect consistent running data throughout the entire black boot process; Based on the aforementioned whole-process homogeneous operation data, attack identification and attack tracing are performed on the corresponding heterogeneous trusted anchor execution entities to obtain corresponding handling strategies. Each of the proposed handling strategies is subject to a majority vote, and closed-loop handling and system self-healing are carried out in stages according to the majority vote results.

[0020] This invention collects homogeneous operational data throughout the entire process, relies on heterogeneous trusted anchors to complete real-time attack identification and path tracing, generates differentiated handling strategies, and takes effect through a cluster majority vote. It can perform self-healing measures such as node isolation, attack surface convergence, and mirror reconstruction in a tiered manner, promptly blocking the lateral spread of attacks. This mechanism runs through the entire black start phase, making up for the shortcomings of traditional power grid black start systems lacking dynamic security defenses, achieving real-time management of security risks during the recovery process, and constructing a complete intrinsic security closed loop.

[0021] Secondly, the present invention provides a black-start system for power network security capabilities, the system comprising: The Trusted Anchor Cluster Module is used to trigger a black start, power on multiple heterogeneous trusted anchor execution entities in the Trusted Anchor Cluster, and perform bootstrapping and voting on the corresponding anchor trust roots to generate the first voting result. The independent voting module is used to perform cross-validation on the heterogeneous security control plane when the first voting result meets the preset majority voting pass condition, and to vote according to the cross-validation result to generate a second voting result. The hierarchical chain recovery module is used to initiate the heterogeneous security control plane that passed the vote in the second voting result, and to perform progressive recovery and voting on the security nodes in each security partition according to the preset security level priority. The trusted on-time control module is used to perform progressive recovery of business nodes and vote on each business node according to the preset business priority when all security nodes in all security partitions pass the vote. The steady-state switching module is used to vote on the global steady-state operation criteria strategy generated by each of the heterogeneous trusted anchor execution entities if each of the business nodes passes the vote, and determine the completion of black start and execution of normalized intrinsic security operation mode based on the voting result of the global steady-state operation criteria strategy.

[0022] In one optional implementation, the trusted anchor cluster module is equipped with a two-level hardware write-protected storage system, which includes: The first-level storage unit is a local hardware write-protected storage area for heterogeneous trusted anchor execution entities. It belongs to a single heterogeneous trusted anchor execution entity and is used to store the baseline trust root, the heterogeneous security control plane mirror, the local copy of the node trusted baseline library, and the full-process audit log of black boot. The second-level storage unit is a global hardware write-protected storage unit for the Trusted Anchor Cluster. It belongs to the entire Trusted Anchor Cluster and is used to store a global redundant backup copy of the trusted benchmark library of the storage node, multiple sets of heterogeneous pure benchmark images of each security node, and a global backup of the audit logs of the entire cluster black boot process. Both levels of storage units are in a hardware write-protected read-only state by default, and audit log appending can only be performed after a majority vote.

[0023] Thirdly, the present invention provides a black-start device for enhancing power network security capabilities, the device comprising: The heterogeneous trusted anchor execution unit is used to trigger black start, power on multiple heterogeneous trusted anchor execution units in the trusted anchor cluster, and perform bootstrapping and voting on the corresponding anchor trust roots to generate the first voting result. The first independent voting unit outside the band is used to perform cross-validation on the heterogeneous security control plane when the first voting result meets the preset majority voting pass condition, and to vote according to the cross-validation result to generate the second voting result. The second independent voting unit outside the second zone is used to activate the heterogeneous security control plane that passed the vote in the second voting result, and to perform progressive recovery and voting on the security nodes in each security partition according to the preset security level priority. The third independent voting unit outside the band is used to perform progressive recovery of business nodes and vote on each of the business nodes according to the preset business priority when all security nodes in the security partition pass the vote. The fourth independent voting unit is used to vote on the global steady-state operation criteria strategy generated by each of the heterogeneous trusted anchor execution entities if each of the aforementioned business nodes passes the vote, and to determine the completion of black start and execution of normalized intrinsic security operation mode based on the voting result of the global steady-state operation criteria strategy.

[0024] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the black-start method for power network security capabilities described in the first aspect or any corresponding embodiment thereof. Attached Figure Description

[0025] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0026] Figure 1 This is a schematic flowchart of a first method for black-starting power network security capabilities according to an embodiment of the present invention. Figure 2 This is a schematic diagram of a second method for black-starting power network security capabilities according to an embodiment of the present invention; Figure 3 This is a schematic diagram of the third black-start method for power network security capabilities according to an embodiment of the present invention. Figure 4 This is a schematic diagram of the architecture of a black-start system for power network security capabilities according to an embodiment of the present invention; Figure 5 This is a schematic diagram of the hardware structure of a black-start device for power network security capabilities according to an embodiment of the present invention. Detailed Implementation

[0027] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0028] It is understood that before using the technical solutions disclosed in the various embodiments of the present invention, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in the present invention and their authorization should be obtained in accordance with relevant laws and regulations through appropriate means.

[0029] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0030] This invention provides a black-boot method for power network security capabilities. It constructs independent trusted verification anchors based on a heterogeneous trusted anchor cluster and a hardware-level baseline trust root, achieving priority reconstruction of security capabilities through majority voting and a layered chain recovery mechanism. Through independent out-of-band network isolation and control, it handles various abnormal nodes in a tiered manner, avoiding the problems of traditional disaster recovery trusted environments being contaminated and secondary attacks occurring during the recovery process. Two levels of hardware write-protected storage ensure the trust baseline and the immutability of audit logs. The entire process dynamically identifies and blocks attacks and completes node self-healing, deeply aligning with power security partitioning protection specifications. It can achieve self-bootstrapping and recovery of network security capabilities without an external trusted environment, balancing system high availability with the compliance requirements of the power industry.

[0031] This embodiment provides a black-start method for enhancing power network security capabilities, which can be used in the aforementioned system. Figure 1 This is a flowchart of a black-start method for power network security capabilities according to an embodiment of the present invention, such as... Figure 1 As shown, the process includes the following steps: Step S101: Trigger black boot, power on multiple heterogeneous trusted anchor execution entities in the trusted anchor cluster and bootstrap and vote on the corresponding anchor trust roots to generate the first voting result.

[0032] It should be noted that "black start" refers to the emergency recovery process in which, when the entire power grid is lost and there is no external power supply, the power grid is restored independently by relying on a self-contained power source, and the network security protection system is rebuilt simultaneously. "Trusted anchor cluster" refers to a hardware trusted management cluster composed of multiple heterogeneous trusted anchor executors, which serves as the sole trusted verification benchmark carrier throughout the black start process. "Heterogeneous trusted anchor executor" refers to a trusted computing execution unit with independently designed hardware architecture and firmware programs, used to provide underlying measurement, cross-validation, and cluster voting capabilities. "Anchor root of trust" refers to a trusted benchmark source solidified in a physically immutable hardware storage area, which is the underlying trust basis for device bootstrapping and image verification. "Bootstrapping" refers to the startup process in which the device performs integrity trusted verification of the hardware firmware, underlying programs, and local trusted benchmarks after power-on. "Majority voting" refers to a trusted judgment mechanism in which, after each executor in the cluster outputs the verification results, the overall verification is judged based on a preset pass threshold to determine whether it is compliant. "First voting result" refers to the overall judgment conclusion of the trust root verification generated by the cluster after each heterogeneous trusted anchor executor completes the trust root bootstrapping measurement.

[0033] In this embodiment of the invention, a black start process of the power grid is triggered by issuing a start command through a physical out-of-band channel. At the same time, at least three heterogeneous trusted anchor point executors in the trusted anchor point cluster are powered on. Each executor calls its internal hardware trusted module to read the anchor point trust root solidified in the physically immutable hardware storage area to complete the underlying bootstrap verification. It outputs its own standardized measurement data and uploads it to an independent hardware voting module for aggregation and comparison. After being judged by a preset majority voting rule, the corresponding first voting result is generated.

[0034] Step S102: When the first voting result meets the preset majority voting pass condition, cross-validate the heterogeneous security control plane, vote according to the cross-validation result, and generate the second voting result.

[0035] It should be noted that the preset majority vote passing condition refers to the number of trusted verification passing results output by heterogeneous trusted anchor executors within the cluster reaching a preset threshold. This invention adopts a cluster 2 / 3 majority judgment standard, meaning that more than two-thirds of the executor measurement results are trusted and pass, thus satisfying the voting passing condition. The heterogeneous security control plane refers to the differentiated security control program mirrors deployed on trusted anchor executors, carrying the functions of partitioned security node control and trusted measurement scheduling; cross-verification refers to the two-way verification mechanism in which each trusted anchor executor synchronizes its local measurement data and verifies the authenticity of the calculation process and judgment results; the second voting result refers to the trusted judgment conclusion of the control plane obtained by the cluster after completing the cross-verification of the heterogeneous security control plane.

[0036] In this embodiment of the invention, after the first voting result reaches the preset majority pass standard, each heterogeneous trusted anchor execution entity retrieves the heterogeneous security control plane trusted benchmark stored in the local hardware write-protected storage area to complete the trusted measurement one by one, synchronizes the trusted judgment result obtained by each entity to the other execution entities in the cluster for bidirectional cross-verification, summarizes all verification information and sends it to the independent hardware voting module for calculation and judgment, and finally generates the second voting result.

[0037] Step S103: Activate the heterogeneous security control plane that passed the vote in the second voting result, and perform progressive recovery and voting on the security nodes in each security partition according to the preset security level priority.

[0038] It should be noted that the security level priority refers to the order of restoration based on the division of power security zones, with the production control zone having a higher priority than the management information zone; a security zone refers to the network area of ​​the power system divided according to the protection level, which is divided into the production control zone and the management information zone, and is subject to zone isolation protection; a security node refers to the security management and control equipment such as boundary protection, monitoring and auditing, and access control deployed in each security zone.

[0039] In this embodiment of the invention, after the second voting result is compliant, the heterogeneous security control plane that passed the voting verification is loaded and started. Based on the control plane, the security nodes in each security partition are sorted from high to low according to the preset security level priority. The security nodes in each security partition are gradually restored in a chain. At the same time, each heterogeneous trusted anchor execution entity performs trust measurement and cluster voting on the security nodes in each round of restoration, and completes the trust verification and judgment of the security node restoration stage.

[0040] Step S104: When all security nodes in all security partitions pass the vote, the service nodes are gradually restored according to the preset service priority and a vote is taken on each service node.

[0041] It should be noted that business priority refers to the order in which core and auxiliary businesses of the power grid are restored, with priority given to restoring critical production businesses; business nodes refer to business equipment such as servers and terminals that carry out business functions such as power grid dispatching, monitoring, and operation and maintenance.

[0042] In this embodiment of the invention, after all security nodes in the security partitions have completed the reconstruction of the underlying security protection capabilities through cluster trusted voting, the system sorts according to the preset business priority and gradually restores each business node from core business to ordinary business. At the same time, each heterogeneous trusted anchor execution entity performs full-dimensional trusted measurement verification on each restored business node and summarizes the verification results to complete the cluster voting, thereby realizing trusted control and verification of the business node restoration process.

[0043] Step S105: If each business node passes the vote, then the global steady-state operation criterion strategy generated by each heterogeneous trusted anchor executor is voted on, and the black start is completed and the normalized intrinsic security operation mode is executed based on the voting result of the global steady-state operation criterion strategy.

[0044] It should be noted that the global steady-state operation criterion strategy refers to the set of node trust benchmarks, security control rules, and audit monitoring specifications uniformly generated by the cluster, which serve as the basis for the normal operation and safety of the power grid; the normalized endogenous safety operation mode refers to the normal operation state in which the power grid continuously conducts real-time monitoring and trust verification based on the unified safety strategy after the black start complete verification process is closed.

[0045] In this embodiment of the invention, after all business nodes pass the cluster trusted voting, each heterogeneous trusted anchor execution entity synchronously generates a global steady-state operation criterion policy that includes node trusted benchmarks, access control rules and audit specifications. Each execution entity synchronizes the policy data to complete cross-verification and sends it to the hardware voting module for unified judgment. If the policy voting result is passed, the entire black start trusted recovery process is closed, and the system switches to the normalized intrinsic security operation mode of continuous trusted monitoring.

[0046] This embodiment provides a black-start method for enhancing power network security capabilities. Figure 2 This is a flowchart of a black-start method for power network security capabilities according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps: Step S201: Trigger black boot, power on multiple heterogeneous trusted anchor execution entities in the trusted anchor cluster and bootstrap and vote on the corresponding anchor trust roots to generate the first voting result.

[0047] Specifically, step S201 includes: Step S2011: Trigger black boot and synchronously power on multiple heterogeneous trusted anchor execution entities of the trusted anchor cluster.

[0048] In this embodiment of the invention, black start triggering and anchor point synchronous power-on: black start is triggered by physical out-of-band method, and at least 3 heterogeneous trusted anchor point executors of the trusted anchor point cluster are synchronously powered on.

[0049] Specifically, the triggering scenario involves a provincial power dispatch center suffering an APT attack and a supply chain attack, resulting in a complete paralysis of its core network security capabilities. Online backups are compromised, traditional disaster recovery methods are rendered ineffective, and the security domain lacks a usable trusted environment. Maintenance personnel use an encrypted serial port Ukey with a built-in security chip, ensuring the private key never leaves the hardware's dedicated authorization medium, to issue black-boot authorization commands and signatures in a physical out-of-band manner. After successful signature verification, three heterogeneous trusted anchor execution units and an independent voting module are simultaneously powered on, physically isolated from the production business network throughout the process, with no access to the production network.

[0050] Step S2012: Bootstrap the hardware trusted module firmware and master device boot firmware within each heterogeneous trusted anchor execution body.

[0051] In this embodiment of the invention, anchor bootstrapping and root of trust voting: after the three heterogeneous trusted anchor execution bodies are powered on, they first complete the self-verification of the hardware trusted module firmware, and then complete the integrity verification of the master device startup firmware through the root hash solidified in the physically immutable hardware storage area. Only after the verification is passed can the anchor hardware initialization be completed.

[0052] Step S2013: After the bootstrapping is successful, extract the complete file of the baseline root of trust in the local hardware write-protected storage area and combine it with the anchor root of trust in the physically immutable hardware storage area to perform a trust measurement of the anchor root of trust and generate a standardized measurement result.

[0053] In this embodiment of the invention, after the anchor point hardware initialization is completed, the system reads the solidified integrity verification hash value of the benchmark trust root from the physically immutable hardware storage area through its own hardware trusted module, then reads the complete file of the benchmark trust root from the local hardware write protection storage area, calculates its integrity hash and compares it with the solidified value in the physically immutable hardware storage area, completes the trust measurement of the benchmark trust root, confirms that the contents of the three sub-trust roots within the benchmark trust root have not been tampered with and are completely from the same source, outputs the standardized measurement result, and sends it to the independent voting module through the out-of-band dedicated voting bus.

[0054] Step S2014: Generate the first voting result by voting on each standardized metric result.

[0055] In this embodiment of the invention, the 2 / 3 majority voting rule is executed through the independent voting module, and the following scenarios are handled: If all three trusted anchor executors output trusted results, the full bootstrap verification passes, and all trusted anchor executors proceed to the next stage. If two trusted anchor executors output trusted results and one bootstrap verification fails, a physical power-off isolation command is immediately issued to the trusted anchor executor that failed bootstrap, cutting off its connection with all out-of-band channels; the remaining two trusted anchor executors first complete two-way identity authentication based on the benchmark trust root. After confirming that both parties are legitimate and from the same source, they automatically switch to the full result completely consistent verification rule. After completing the cross-verification of the solidified benchmark reading results and the dynamic state synchronization, they enter the next stage and trigger a security alarm simultaneously.

[0056] If two or more trusted anchor point executors fail to perform bootstrapping verification, the entire cluster will immediately power off to terminate the process and trigger a security alarm.

[0057] In some optional implementations, the voting rules used to generate the first voting result include flexible voting rules: if less than half of the trusted anchor executions fail the verification, a physical power-off isolation command is issued to the abnormal executions and a security alarm is triggered, and the remaining executions switch to the voting rule that the full results are completely consistent; the verification is deemed to have passed only when the full verification results output by all remaining trusted anchor executions are consistent; if half or more of the trusted anchor executions fail the verification, the entire cluster is immediately powered off to terminate the process and a security alarm is triggered.

[0058] In this embodiment of the invention, after each heterogeneous trusted anchor executor completes the baseline trust root measurement and uploads the verification results to the independent hardware voting module, the module's built-in elastic voting rules take effect simultaneously. If the number of trusted anchor executors that fail verification is less than half of the cluster, a physical power-off isolation command is issued to the faulty executor and a security alarm is pushed. The remaining normal executors automatically switch to the strict full result consistency verification rule. Only when the complete set of verification data output by all remaining executors is completely matched is the bootstrap verification considered to have passed. If the number of failed verification executors reaches half or more, the hardware voting module directly issues a full cluster power-off command to terminate the black boot process and triggers a security alarm simultaneously.

[0059] Specifically, a 2 / 3 majority voting rule is used by default, and the verification is considered successful only when more than half of the trusted anchor executors output consistent and trustworthy results. A supplementary flexible voting rule is also used, where the verification is considered successful only when all remaining trusted anchor executors output consistent full verification results. Taking a typical cluster with 3 executors as an example, if one executor is isolated, the remaining 2 executors switch to the full consistency verification rule.

[0060] Step S202: When the first voting result meets the preset majority voting pass condition, cross-validation is performed on the heterogeneous security control plane, and voting is conducted according to the cross-validation result to generate the second voting result.

[0061] Specifically, step S202 includes: Step S2021: When the first voting result meets the preset majority voting pass condition, retrieve the trusted benchmark of the heterogeneous security control plane of each heterogeneous trusted anchor point executor.

[0062] In this embodiment of the invention, after the bootstrapping and benchmark library verification are passed, the local independent measurement process is executed: each heterogeneous trusted anchor point executor retrieves the trusted benchmark corresponding to its own heterogeneous security control plane mirror from the node trusted benchmark library.

[0063] Step S2022: The trust benchmark of the heterogeneous security control plane of each heterogeneous trusted anchor execution entity and the heterogeneous security control plane stored in the local hardware write-protected storage area are used to perform a trust measurement to obtain the trustworthiness judgment result.

[0064] In this embodiment of the invention, each heterogeneous trusted anchor execution entity retrieves the trusted benchmark corresponding to its own heterogeneous security control plane image from the node trusted benchmark library, performs a trusted measurement on the heterogeneous security control plane image stored in the local hardware write-protected storage area, and outputs a trustedness judgment result.

[0065] Step S2023: Cross-validate the credibility determination result corresponding to any heterogeneous trusted anchor execution body with the credibility determination results corresponding to the remaining heterogeneous trusted anchor execution bodies, and output the cross-validation result.

[0066] In this embodiment of the invention, cross-validation is performed: each heterogeneous trusted anchor execution entity, through an independent out-of-band management network, synchronously transmits the credibility judgment results containing the measurement basis to the other heterogeneous trusted anchor execution entities, mutually verifying the authenticity of the results and the compliance of the calculation process, and outputting cross-validation conclusions.

[0067] Step S2024: Vote on each credibility judgment result and each cross-validation result to generate a second voting result.

[0068] In this embodiment of the invention, the final voting process involves synchronizing the credibility determination result and the cross-validation conclusion to the independent voting module via an out-of-band dedicated voting bus to perform majority voting. Result handling: If the vote is passed, a security control plane start authorization will be issued to the heterogeneous trusted anchor execution entity.

[0069] After the vote is passed, the heterogeneous trusted anchor executor initiates the heterogeneous security control plane and built-in functional components; the control conclusions and execution instructions output by each component shall only take effect after being approved by a vote.

[0070] Step S2025: When the first voting result does not meet the preset majority voting pass condition, it is determined that the bootstrap verification of each heterogeneous trusted anchor executor has failed, and the trusted anchor cluster is stopped from being powered on.

[0071] In this embodiment of the invention, for heterogeneous trusted anchor execution entities that produce abnormal voting results, physical power-off isolation is performed and a security alarm is triggered; if half or more of the trusted anchor execution entities fail verification, the entire cluster is immediately powered off to terminate the process.

[0072] Specifically, anchor root trust voting and bootstrapping: Each heterogeneous trusted anchor executor performs a trust measurement on the system's unique baseline trust root through its own hardware trusted module with a physically immutable hardware storage area. The measurement result is sent to the independent voting module, and bootstrapping is completed after a majority vote. For trusted anchor executors that fail the bootstrapping verification, a physical power-off isolation command is issued and a security alarm is triggered. The voting rules of the independent voting module are factory preset and the execution command cannot be bypassed.

[0073] Security control plane verification and startup: After bootstrapping, each trusted anchor execution body first completes the compliance and integrity verification of the node trusted benchmark library based on the benchmark trust root, and then performs trusted measurement on the heterogeneous security control plane image stored in the local hardware write-protected storage area. After cross-validation and majority voting, the corresponding heterogeneous security control plane is started. The heterogeneous security control plane has built-in multi-mode trusted measurement, access control, malicious code detection and situational awareness functional components.

[0074] In other words, after the bootstrapping is completed, each trusted anchor execution first retrieves the exclusive signature verification public key of the trusted benchmark library based on the identity trusted root in the benchmark trust root, and completes the digital signature verification and integrity verification of the local node trusted benchmark library. Then, it completes the compliance verification of the loading permission based on the authorization control root. After both verifications are passed, it is confirmed that the benchmark library is legal, compliant and has not been tampered with. Each trusted anchor execution entity retrieves the corresponding trusted benchmark from the node trusted benchmark library, performs trusted measurement on the heterogeneous security control plane mirror stored in the local hardware write-protected storage area of ​​its own trusted anchor execution entity, compares the measurement result with the trusted benchmark to complete the trusted verification, and outputs the trustedness judgment result. Each trusted anchor execution entity synchronizes the trustworthiness judgment results, including the measurement basis, to the other trusted anchor execution entities through an independent out-of-band management network, performs cross-validation, and outputs the cross-validation conclusion; The credibility determination results and cross-validation conclusions are synchronously sent to the independent voting module via an out-of-band dedicated voting bus to execute majority voting. If the vote passes, a security control plane startup authorization is issued to the trusted anchor executor; for trusted anchor executors that output abnormal results, physical power-off isolation is performed and a security alarm is triggered; if half or more of the trusted anchor executors fail verification, the entire cluster is immediately powered off to terminate the process.

[0075] Step S203: Activate the heterogeneous security control plane that passed the vote in the second voting result, and perform progressive recovery and voting on the security nodes in each security partition according to the preset security level priority.

[0076] Specifically, step S203 includes: Step S2031: Activate the heterogeneous security control plane that passed the vote in the second voting result.

[0077] In this embodiment of the invention, after the second voting result is passed, the heterogeneous trusted anchor executor starts the heterogeneous security control plane and built-in functional components; the control conclusions and execution instructions output by each component can only take effect after being voted on.

[0078] Step S2032: Perform progressive recovery on the security nodes in each security partition according to the preset security level priority.

[0079] In this embodiment of the invention, after the heterogeneous security management plane is started, a progressive chain recovery is performed according to the security level priority of the power system security partitions. The recovery channel for the next partition will not be opened until all security nodes in the previous partition have completed verification and recovery. The security level priority is set so that the power system production control area takes precedence over the management information area.

[0080] The specific recovery process is as follows: The recovery process of each security node is completed through an independent out-of-band management network, which is completely isolated from the production business network: First, the node is powered on through the out-of-band interface. The node only starts the out-of-band management module and the trusted measurement agent, while the production business port remains closed throughout the process, and the node's raw measurement data is obtained.

[0081] It is worth mentioning that within the same security zone, the recovery sequence follows the order of first boundary protection, then internal control, and finally monitoring and auditing. Taking the production control zone as an example, priority is given to restoring boundary protection equipment such as power-specific horizontal unidirectional security isolation devices and power-specific vertical encryption authentication devices to complete the closed loop of the zone's security boundary first.

[0082] It should be noted that, according to the "Regulations on Security Protection of Power Monitoring Systems", the production control area (divided into Security Zone I and Security Zone II) and the management information area (divided into Security Zone III and Security Zone IV) are defined. Power companies can then further subdivide the area according to their actual situation within the above framework. For example, in addition to the two major areas, the State Grid also has an Internet area, which would be ranked after the management information area.

[0083] Step S2033: Send the original measurement data of the recovered security node to all heterogeneous trusted anchor execution entities.

[0084] In this embodiment of the invention, the original measurement data of the recovered security node is synchronized to all heterogeneous trusted anchor execution entities.

[0085] Step S2034: Perform full-dimensional multi-modal trust measurement verification on each security node through each heterogeneous trusted anchor execution entity, and vote on the first verification result.

[0086] In this embodiment of the invention, each heterogeneous trusted anchor execution entity independently completes full-dimensional multi-mode trusted measurement based on the corresponding benchmark of the node trusted benchmark library. Only after the verification result is approved by a majority vote can the start authorization be issued to unlock the business communication port and be incorporated into the global security management system.

[0087] Step S204: When all security nodes in all security partitions pass the vote, the service nodes are gradually restored according to the preset service priority and a vote is taken on each service node.

[0088] Specifically, step S204 includes: Step S2041: Physically isolate and reconstruct the security nodes that failed to pass the vote within each security partition.

[0089] In this embodiment of the invention, step S2042 is executed for the security nodes that pass the vote in each security partition, and physical isolation and reconstruction are performed for the security nodes that fail the vote in each security partition.

[0090] Step S2042: When all security nodes in all security partitions pass the vote, the service nodes are gradually restored according to the preset service priority.

[0091] In this embodiment of the invention, when all security nodes in all security partitions pass the vote, that is, after the global security capability network is rebuilt, the business nodes are gradually restored according to the business priority, strictly following the principles of measurement first, admission later, and least privilege.

[0092] Step S2043: Send the access requests of each business node to all heterogeneous trusted anchor execution entities.

[0093] In this embodiment of the invention, the access requests of the business nodes are synchronized to all heterogeneous trusted anchor execution entities.

[0094] Step S2044: Perform full-dimensional multi-mode trust measurement verification on each business node through each heterogeneous trust anchor execution entity, and vote on the second verification result.

[0095] In this embodiment of the invention, the access request of the service node is synchronized to all heterogeneous trusted anchor execution entities. After passing the multi-modal trust measurement and majority voting, the minimum necessary access permissions are allocated to it, and the access authorization is completed.

[0096] After the business node is connected, the heterogeneous trusted anchor execution entity continuously performs dynamic multi-mode trust measurement on it through an independent out-of-band management and control network. If an anomaly is detected, the anomaly judgment result is approved by a majority vote, and a security alarm is immediately triggered and pushed to the business management side for handling to block the spread of the attack.

[0097] Specifically, the security capability architecture employs a layered chain recovery mechanism: Based on the security level priority of each power system security partition, progressive recovery of security nodes in each partition is executed. The recovery channel for the next security level partition is not opened until all security nodes in the previous security level partition have completed multi-mode trust measurement and passed a majority vote. The entire security node recovery process is executed through an independent out-of-band management network. Before a node passes a vote, all business communication ports are closed, and only the out-of-band management interface is opened to complete the multi-mode trust measurement. After the measurement result passes a majority vote, the business ports are unlocked and the node is incorporated into the global security management system. This layered chain recovery mechanism follows a strong dependency progression logic of trusted anchor clusters, heterogeneous security management planes, high-security-level partitions, and low-security-level partitions. The next step cannot be initiated until the previous step completes measurement and passes a vote, forming an irreversible trust transmission chain. Security level priorities are set according to the power system production control area taking precedence over the management information area. Within the same security partition, the recovery order follows: boundary protection security nodes first, internal control security nodes second, and monitoring and audit security nodes last. If a security node's measurement result fails to pass a vote, node reconstruction is executed according to the classification and closed-loop handling rules.

[0098] Trusted Access and Access Control for Business Nodes: After the global security capability architecture is rebuilt, business nodes are accessed according to business priority. Access requests are synchronized to all trusted anchor execution entities, and after passing multi-modal trusted metrics and majority voting, minimum necessary access permissions are assigned to them, completing the access authorization. Among them, multi-modal trusted metrics refer to selecting multiple dimensions of metrics to perform trustworthiness data collection and calculation based on the type of target object and verification scenario; the metrics include static trusted benchmark verification, dynamic behavior legality verification, compliance baseline verification, and vulnerability threat intelligence verification.

[0099] Step S205: If each business node passes the vote, then the global steady-state operation criterion strategy generated by each heterogeneous trusted anchor executor is voted on, and the black start is completed and the normalized intrinsic security operation mode is executed based on the voting result of the global steady-state operation criterion strategy.

[0100] Specifically, step S205 includes: Step S2051: If each business node passes the vote, then retrieve the global steady-state operation criterion strategy generated by each heterogeneous trusted anchor execution body.

[0101] In this embodiment of the invention, after all security nodes and business nodes have completed trusted verification and access authorization, each heterogeneous trusted anchor execution entity independently generates a trusted node state benchmark, a unified security control strategy, and audit monitoring rules for the global steady-state operation criterion strategy based on the trusted result passed by the full-process voting and the preset rules of the benchmark trust root.

[0102] Step S2052: Perform cross-validation and voting on each global steady-state operation criterion strategy in sequence.

[0103] In this embodiment of the invention, after each heterogeneous trusted anchor execution entity completes content generation, it performs cross-verification across heterogeneous trusted anchor execution entities through an independent out-of-band management and control network. The verification results and hash values ​​are then sent to the independent voting module via an out-of-band dedicated voting bus to perform majority voting.

[0104] Step S2053: When the global steady-state operation criterion strategy voting result is passed, the black start is determined to be completed, and the normalized endogenous safe operation mode is executed.

[0105] In this embodiment of the invention, the content after a majority vote takes effect synchronously across the entire system, serving as a unified benchmark for normal operation. That is, once the black start process is completed, the system enters a normalized, inherently secure operation mode.

[0106] All operations, voting results, and handling logs throughout the entire black boot process are appended to the dedicated audit partition of the local hardware write-protected storage area of ​​the corresponding heterogeneous trusted anchor execution body. At the same time, they are synchronized to the global audit partition of the global hardware write-protected storage unit of the cluster to complete redundant backup, forming a complete audit traceability chain. The system switches to the normalized intrinsic security operation mode, and the physical isolation architecture of out-of-band control and voting channels is maintained throughout the process. This black boot process is officially over.

[0107] Step S2054: When the voting result of the global steady-state operation criterion strategy is that the vote fails, the steady-state operation process is terminated and a safety alarm is triggered.

[0108] In this embodiment of the invention, if the majority vote fails, the steady-state switching process is immediately terminated and a security alarm is triggered.

[0109] Steady-state switching and process closed-loop: After all security nodes and service nodes complete trusted verification and admission, each trusted anchor point executive independently generates a trusted node state benchmark and a unified security control policy for global steady-state operation based on the node admission results passed by full-process voting, security disposal records, and compliance rules preset by the benchmark trust root; after the generated content is cross-verified across the trusted anchor point executives, the independent voting module performs majority voting, and the generated content officially takes effect across the entire system after passing; the system switches to the normalized endogenous security operation mode, and the full-process audit log of the black start is archived to the hardware write-protection storage system supporting the trusted anchor point cluster to complete the black start process. Wherein, the hardware write-protection storage system supporting the trusted anchor point cluster is divided into two levels of independent storage units with complementary and redundant functional boundaries: The first level is the local hardware write-protection storage area of the heterogeneous trusted anchor point executive, which belongs to a single heterogeneous trusted anchor point executive, is directly connected to the hardware trusted module of the trusted anchor point executive, and is used to store the benchmark trust root required for the bootstrapping of the trusted anchor point executive, the heterogeneous security control plane image, the local copy of the node trusted benchmark library, and the full-process audit log of the black start of the corresponding trusted anchor point executive; The second level is the global hardware write-protection storage unit of the trusted anchor point cluster, which belongs to the entire trusted anchor point cluster, is physically isolated from all heterogeneous trusted anchor point executives, and is used to store the global redundant fallback copy of the node trusted benchmark library, multiple sets of heterogeneous pure benchmark images of each security node, and the global backup of the full-process audit log of the black start of the entire cluster.

[0110] The two-level redundant archiving mechanism for the full-process audit log of the black start is: first, the audit log is appended and written to the dedicated audit partition of the local hardware write-protection storage area of the corresponding trusted anchor point executive, and then synchronized to the global audit partition of the cluster global hardware write-protection storage unit to complete the fallback backup; the audit log writing operation can only be performed after passing the majority voting, and the modification, deletion and overwriting of the archived log are prohibited through a hardware mechanism.

[0111] In some optional embodiments, the method further comprises: Step a1: Collect full-process homologous operation data during the black start process.

[0112] In the embodiment of the present invention, during the full process of the black start, the situational awareness component of each heterogeneous trusted anchor point executive acquires the full-process homologous operation data synchronized through the independent out-of-band management and control network.

[0113] Step a2: Perform attack identification and attack traceability on the corresponding heterogeneous trusted anchor point executive based on the full-process homologous operation data, so as to obtain a corresponding disposal strategy.

[0114] In this embodiment of the invention, based on the same source operation data throughout the entire process, attack behaviors are independently identified, attack paths are traced, and attack judgment results, handling instructions, and recovery path adjustment schemes are output, i.e., relevant handling strategies.

[0115] Step a3: Perform a majority vote on each disposal strategy, and carry out closed-loop disposal and system self-healing in stages according to the majority vote results.

[0116] In this embodiment of the invention, after the handling strategy is passed by a majority vote, the attack closed-loop handling, abnormal execution body reconstruction, and system self-healing are performed: 1. Perform physical power-off isolation on compromised nodes and trusted anchor execution entities that have failed bootstrapping verification to block the attack propagation path; 2. Dynamically shrink the attack surface, close risky ports and protocols, and revoke abnormal authorization permissions; 3. Dynamically adjust the recovery path, adjust the node recovery order within the same security level partition, temporarily skip compromised non-core nodes, and prioritize the recovery of core security nodes and critical business nodes. The adjustment plan can only be implemented after being approved by a majority vote. 4. For a single voting anomaly of the trusted anchor executor, perform fault tolerance marking and record the anomaly log; for trusted anchor executors with multiple consecutive voting anomalies, perform logical isolation, read the heterogeneous security control plane pure benchmark image from the node trusted benchmark library, perform image trust verification, and then perform executor reconstruction. After reconstruction, the executor is restored to its cluster voting authority and normal operation status after passing the cluster cross-verification and the majority vote of the independent voting module. 5. For security nodes that fail verification, close their business communication ports to perform physical isolation, retain out-of-band management channels, read the heterogeneous clean baseline image of the corresponding security node in the cluster's global hardware write-protected storage unit, perform trusted verification, and then reconstruct the node. Once the verification is successful, the node will be reintegrated into the security management system. 6. If a business node verification fails, a security alarm will be triggered and pushed to the business management side for handling.

[0117] The entire process executes exception tolerance and isolation rules: If a single trusted anchor executor outputs an exception in a single vote, the majority result shall prevail, and fault tolerance flags and exception logs shall be executed simultaneously; If a single trusted anchor executor outputs multiple consecutive exception data that is inconsistent with the majority result, and the exception is confirmed by cross-validation, the trusted anchor executor shall be logically isolated and reconstructed.

[0118] Specifically, for trusted anchor executors that have repeatedly exhibited voting anomalies, logical isolation refers to suspending the cluster voting privileges of the trusted anchor executor, isolating its business interactions with the out-of-band management network, and not performing physical power-off operations; executor reconstruction refers to recompiling the trust chain verification and security management plane loading of the trusted anchor executor based on a clean baseline image of the heterogeneous security management plane, and restoring its cluster voting privileges and normal operating status after the verification passes.

[0119] Furthermore, this invention employs a two-tier hardware write-protected storage system to provide physical-level security for the entire trust chain transmission process. The architecture comprises two layers with completely independent functional boundaries and complementary redundancy, reusing unified hardware security capabilities throughout the process, with no redundant design. 1. The local hardware write-protected storage area of ​​the heterogeneous trusted anchor executor belongs to a single heterogeneous trusted anchor executor and is directly connected to the hardware trusted module of the trusted anchor executor. It is the core trust carrier for the trusted anchor executor's power-on bootstrap. The trusted anchor executor can complete the baseline trust root verification and bootstrap startup without accessing external shared resources during the entire power-on bootstrap process, completely avoiding the risk of network attacks during the startup process; it is in a hardware-level read-only locked state by default, and audit logs can only be appended after authorization and voting are passed, with no remote modification interface.

[0120] 2. The Trusted Anchor Cluster's globally hardware-written-protected storage unit belongs to the entire Trusted Anchor Cluster but is independent of any individual Trusted Anchor. It serves as the global redundancy backup source for the entire cluster. Read operations can only be performed after cross-validation and majority voting by all Trusted Anchor executors. By default, it is locked in hardware at the entire process, with no remote write interface, and only supports offline out-of-band authorized updates. This completely avoids the risk of attack contamination and solves the single point of failure problem of individual Trusted Anchor executors.

[0121] Furthermore, this invention employs a strict classification and isolation design for the core trust carrier and functional carrier of the entire system. Their hierarchical and functional boundaries are completely independent, eliminating the risk of logical confusion between the root of trust and functional implementation from a design perspective. 1. The baseline trust root, a non-executable program, is the sole source of trust for end-to-end trusted verification. All heterogeneous trusted anchor executors share the same baseline trust root. Its unique integrity verification hash is permanently stored at the factory in the physically immutable hardware storage area of ​​the trusted module of the heterogeneous trusted anchor executor. The complete description file of the baseline trust root is stored in the local hardware write-protected storage area of ​​the trusted anchor executor, pre-configured at the factory and hardware-level read-only locked. The baseline trust root specifically includes three sub-trust roots with completely independent functional boundaries: the identity trust root, the authorization control root, and the majority voting compliance root. Each sub-trust root has built-in factory-configured, hardware-level read-only locked enforcement rules.

[0122] The specific contents and functions of the three sub-root trusts are as follows: First, the identity trust root, which includes a unique CA root certificate for the entire system and a dedicated public key for signature verification in the trusted benchmark library, provides a unique source of trust for identity authentication, signature verification, legality verification of the trusted benchmark library, and data integrity verification throughout the entire system; Second, the authorization control root, which includes the public key for authorization and signature verification of high-risk operations throughout the black start process, and is equipped with built-in minimum permission and permission separation mandatory control rules to provide a basis for verification of the authorization legality of core operations throughout the process; Third, the majority voting compliance root, along with built-in voting compliance control rules and anomaly handling bottom lines, provides an indispensable compliance verification basis for the endogenous security decision-making mechanism throughout the entire process.

[0123] 2. The heterogeneous security control plane is a clean baseline image, and the executable functional system of the trusted anchor executor is a clean image. Each heterogeneous trusted anchor executor has its own heterogeneous implementation version, which is stored in the local hardware write-protected storage area of ​​the trusted anchor executor and the global hardware write-protected storage unit of the cluster. It must pass the legality and integrity verification through the baseline trust root before it can be started and loaded. It is the core functional carrier for realizing full-process trust measurement, security control, attack monitoring and emergency response.

[0124] Furthermore, this invention employs a three-tiered anomaly handling mechanism, adapting to the requirements of separation of responsibilities between power system security control and business management, while also considering system high availability and attack blocking capabilities, forming a clear handling gradient covering all anomaly scenarios: Fatal Failure Handling: For scenarios where the trusted anchor execution fails to perform power-on bootstrap verification, the entire machine is physically powered off and isolated to completely block the spread of attacks, while retaining only the offline recovery channel, in accordance with the S2 step handling rules. Core anomaly handling: For scenarios of a single voting anomaly during the operation of the trusted anchor executor, fault tolerance flags and log records are executed to prevent interruption of cluster operation; for scenarios of multiple consecutive voting anomalies, logical isolation is performed, voting permissions are suspended, control interactions are isolated, and after trust verification is completed based on a clean baseline image, the executor is reconstructed to restore its cluster operation capability, corresponding to the S6 step handling rules. Node anomaly handling: For scenarios where security node verification fails, the business communication port is closed to perform physical isolation, while the out-of-band management channel is maintained throughout the process, and reconstruction is completed based on multiple heterogeneous clean baseline images; For scenarios where business node verification fails, a security alarm is triggered and pushed to the business management side, following the corresponding S4 and S5 step handling rules.

[0125] Furthermore, this invention incorporates dual rules of majority voting and flexible voting. The voting logic is pre-configured at the factory and cannot be remotely tampered with, providing an unavoidable compliance basis for end-to-end decision-making. The default rule is a 2 / 3 majority voting rule, where verification is considered successful only when more than half of the trusted anchor execution entities output consistent and reliable results. The accompanying flexible voting rule ensures verification is successful only when all remaining trusted anchor execution entities output consistent full verification results. Taking a typical cluster with three execution entities as an example, if one execution entity is isolated, the remaining two execution entities switch to the full consistency verification rule.

[0126] Furthermore, this invention employs a dual security mechanism that complements cross-validation and majority voting, with a clear division of labor and no logical redundancy: cross-validation is a pre-voting stage, the core of which is to prevent false alarms, prevent single-point cheating, and ensure data consistency, confirming that all trusted anchor execution entities complete the calculation based on a unified benchmark and original data; majority voting is the final decision-making stage, the core of which is fault tolerance and attack resistance, outputting an unbypassable final execution instruction.

[0127] Furthermore, the trusted benchmarks corresponding to each node in the entire system are uniformly stored in the node trusted benchmark library. The node trusted benchmark library adopts a two-level redundant backup architecture: each trusted anchor executor's local hardware write-protected storage area stores a complete local copy; the cluster-wide hardware write-protected storage unit stores a globally redundant fallback copy. The node trusted benchmark library contains multiple sets of heterogeneous security control plane images and corresponding trusted benchmarks for each trusted anchor executor, multiple sets of heterogeneous clean benchmark images and corresponding trusted benchmarks for each security node, and trusted benchmarks corresponding to each business node. Before use in the entire process, the legality and integrity must be verified by the benchmark trust root to avoid using tampered benchmark data.

[0128] The trusted benchmark consists of two parts: first, the trusted integrity verification basis for the corresponding image, containing the image's unique trusted hash value, used to verify the integrity and tamper-proof nature of the target image, files, and configuration; second, the trusted identity verification basis for the corresponding node, containing the node's digital identity certificate issued by the CA root certificate, a hardware identity whitelist, and signature verification rules, used to verify the legitimacy and authorization validity of the target device and image. The node trusted benchmark library is in a hardware write-protected read-only state by default. Digital signatures can only be issued via authorized private keys. Only after all trusted anchors perform test signatures, cross-validation, and majority voting can a full copy be synchronously updated and take effect.

[0129] Furthermore, this invention employs a multi-modal trust measurement mechanism, which selects multiple dimensions of measurement items to perform trust data collection and calculation based on the type of the target object and the verification scenario. The measurement items include static trust benchmark verification, dynamic behavior legality verification, compliance baseline verification, and vulnerability threat intelligence verification, adapting to the trust verification needs of different stages and different objects throughout the entire process.

[0130] The trusted verification of this invention refers to the verification and judgment operation performed on the results of trusted measurement based on the preset trusted benchmarks in the node trusted benchmark library, with the benchmark trust root as the sole source of trust. It is used to confirm the identity legitimacy, data integrity and operational compliance of the target object, and is the core pre-process of trusted decision-making in the whole process.

[0131] Furthermore, the black boot process audit log of this invention is uniformly archived to the aforementioned two-level hardware write-protected storage system, reusing existing hardware-level security capabilities to achieve tamper-proof audit logs throughout their entire lifecycle: Write rules: Append-only writes to audit logs can only be performed after a majority vote. Hardware mechanisms are used to prohibit modification, deletion, and overwriting of archived logs. Redundant backup: First, write to the dedicated audit partition of the local write protection zone of the corresponding trusted anchor execution body, and then synchronize to the global audit partition of the cluster global write protection unit to form a two-level redundant backup to avoid the risk of single point of failure. Access control: Only entities holding dedicated audit authorization private keys can read archived logs through an independent out-of-band control network, without any write or modification permissions; the read and write permissions for audit logs throughout their entire lifecycle are completely isolated from the production business network and the in-band business control network.

[0132] Furthermore, a layered chain recovery process follows a strong dependency progression logic: trusted anchor clusters, heterogeneous security control planes, high-security-level partitions, and low-security-level partitions. If the verification and voting process in the previous stage is not completed, the next stage cannot be initiated, forming an irreversible trust transfer chain. All security node recovery operations are completed through an independent out-of-band control network. Before the target security node passes the vote, its production business communication ports remain closed throughout the process, with only the out-of-band management interface open for trusted verification, preventing access to the contaminated production network during recovery. Security level priorities are set according to the power system production control area taking precedence over the management information area. Within the same security partition, the recovery order follows: boundary protection security nodes first, internal control security nodes second, and monitoring and audit security nodes last.

[0133] Furthermore, the globally stable operation trusted node status benchmark refers to the dynamic trusted benchmark generated based on the node trusted verification results passed by the full-process voting and attack handling records. It includes a global trusted node whitelist, node trusted status identifiers, and full-link dynamic trusted measurement thresholds. It is the core basis for continuous trusted verification under the normalized intrinsic security operation mode.

[0134] Furthermore, in the normalized internal security operation mode, after the black signal is activated, the physical isolation architecture of the out-of-band control and voting channels is retained, the majority voting mechanism is switched to the daily continuous security protection mode, and all high-risk security control operations throughout the entire life cycle are completed through the out-of-band channel, which is completely isolated from the production business network.

[0135] In a specific embodiment, the node trusted benchmark library update implementation is as follows: When a new node is added to the system or an existing node image is upgraded, the administrator uses an offline secure terminal and a benchmark update authorization private key to issue a digital signature on the newly added or updated node trusted benchmark, generating a new node trusted benchmark library update package. The operations and maintenance personnel write the update package to the device's cluster-wide hardware write-protected storage unit and trigger the update verification process through an encrypted out-of-band interface. Each heterogeneous trusted anchor executor first completes the signature verification and integrity verification of the update package, then performs cross-validation, and finally, after a majority vote, synchronously updates the local copy and makes it effective. The entire process requires no access to the production network, does not violate the read-only locking attribute and integrity verification mechanism of the benchmark trust root, and simultaneously meets the system's dynamic expansion requirements.

[0136] Key points of this invention: In response to the frequent occurrence of APT attacks, ransomware attacks, and supply chain attacks in the power industry, extreme cases could lead to catastrophic events such as the complete compromise of the power security management system, malicious implantation of the system's root of trust, and large-scale equipment hijacking, resulting in the paralysis of core network security capabilities, the inability to verify the reliability of online and offline backups, and the failure of traditional disaster recovery methods. This invention presents a pioneering black-boot solution for network security capabilities adapted to the compliance requirements of the power industry. Key features are as follows: 1. This solution constructs a hardware-level, tamper-proof, externally dependent trust origin, addressing the core shortcomings of traditional disaster recovery solutions such as trust premise collapse and single point of failure. This solution uses a cluster of at least three heterogeneously designed (preferably full-stack heterogeneous) trusted anchor execution entities as the sole source of trust for the entire system. Each execution entity's hardware trusted module has a built-in physically tamper-proof storage area. The integrity verification hash of the unique baseline trust root is permanently fixed at the factory. The complete baseline trust root file is pre-installed in the local hardware write-protected storage area of ​​each execution entity, forming multi-copy hardware-level redundancy protection. A two-level hardware write-protected storage system is provided, using a local and global dual-redundancy architecture to back up the trusted baseline library and full-process audit logs. All identity authentication and integrity verification throughout the process use this hardware-level trust root as the sole trust benchmark, without relying on any online authentication services or external trust systems, reducing the risk of trust root tampering and pre-implanted attacks. The integrity of the baseline trust root is verified at the underlying level by the root hash fixed in the physically tamper-proof hardware storage area of ​​the hardware trusted module, without relying on online authentication services or external trust systems throughout the process; objects that fail verification are directly determined as untrustworthy.

[0137] 2. This paper designs an intrinsically secure decision-making mechanism combining independent hardware voting with dual-bus physical isolation to address the industry pain points of traditional solutions where voting logic is easily bypassed and attacks are easily penetrated. This method uses a pure digital logic circuit hardware voter, physically isolated from the executor throughout the entire process, as the sole final decision node. Voting rules are pre-configured at the factory, with no programmable interface, and execution instructions cannot be bypassed. A dual security mechanism is established, consisting of cross-validation to prevent single-point cheating and majority voting output for the final decision. It includes majority voting rules and flexible voting rules for abnormal scenarios, covering all cluster scenarios with at least three executors. Simultaneously, two physically isolated channels are used: a dedicated out-of-band voting bus and an independent out-of-band management network, with no cross-connections to the production business network, reducing the risk of attacks bypassing the voting mechanism and penetrating the management system from the production network.

[0138] 3. Establish a layered chain-like recovery system prioritizing security capabilities and a closed-loop protection mechanism throughout the entire process. This addresses the inherent logic of traditional solutions that prioritize business recovery and postpone security capabilities, which easily leads to secondary attacks and lacks real-time protection during the recovery process. This invention breaks away from the inherent logic of general IT disaster recovery prioritizing business recovery and postponing security capabilities. It establishes irreversible, strongly dependent, progressive recovery rules, strictly adhering to the progressive execution order of trusted anchor bootstrapping, security control plane startup, high-security-level partition recovery, low-security-level partition recovery, and business node access control. The next recovery channel will never be opened until the previous step has passed trusted verification and majority voting. Security node recovery is executed entirely through an independent out-of-band control network. Business communication ports are shut down throughout the process before voting is passed. Global security capability network reconstruction must be completed before business node access control is implemented. At the same time, dynamic attack blocking and classified closed-loop self-healing are the core actions for continuous execution throughout the black boot process. Differentiated handling rules are designed for the execution body, security nodes, and business nodes, taking into account both the high availability requirements of the power system and the industry's separation of responsibilities compliance requirements, thus avoiding the risk of secondary attacks during the recovery process.

[0139] The points to be protected by this invention: like Figure 3 As shown, the complete technical solution includes S1 black boot triggering and anchor point synchronous power-on, S2 anchor point trust root voting and bootstrapping, S3 security control plane verification and startup, S4 security capability architecture layered chain recovery, S5 business node trusted access and permission control, S6 full-process attack dynamic blocking and system self-healing, and S7 steady-state switching and process closed loop; it also protects, but is not limited to, heterogeneous trusted anchor point execution body design, base trust root three-sub-trust root architecture, majority voting and flexible voting rules, two-level hardware write protection storage system, multi-mode trusted measurement mechanism, and audit log full lifecycle anti-tampering mechanism.

[0140] This invention draws on the progressive recovery logic of physical black boot in power grids, using a heterogeneous trusted anchor cluster with physical offline cold backup as the hardware carrier. It uses the integrity verification hash of the complete file of the baseline trust root, which is fixed in the physically immutable hardware storage area within the cluster, as the trust origin of the entire system. This breaks the traditional disaster recovery's reliance on clean backups and enables self-bootstrapping recovery of security capabilities without external dependencies under extreme attack scenarios. Throughout the process, it reduces the risk of secondary attacks through anomaly handling mechanisms and intrinsic security mechanisms. It achieves full lifecycle anti-tampering of the trust baseline and audit logs through a two-level hardware write-protected storage system, adapting to the mandatory protection architecture and responsibility management requirements of power systems, and taking into account both engineering feasibility and dynamic scalability.

[0141] This embodiment also provides a black-start system for power network security capabilities. This system is used to implement the above embodiments and preferred embodiments, and details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0142] This embodiment provides a black-start system with enhanced power network security capabilities, such as... Figure 4 As shown, it includes: The Trusted Anchor Cluster Module is used to trigger a black start, power on multiple heterogeneous trusted anchor execution entities in the Trusted Anchor Cluster, and perform bootstrapping and voting on the corresponding anchor trust roots to generate the first voting result. The independent voting module is used to perform cross-validation on the heterogeneous security control plane when the first voting result meets the preset majority voting pass conditions, and then vote according to the cross-validation result to generate the second voting result. The hierarchical chain recovery module is used to initiate the heterogeneous security control plane that passed the vote in the second voting result, and to perform progressive recovery and voting on the security nodes in each security partition according to the preset security level priority. The Trusted On-Time Management Module is used to perform progressive recovery of business nodes and vote on each business node according to the preset business priority when all security nodes in all security partitions pass the vote. The steady-state switching module is used to vote on the global steady-state operation criteria strategy generated by each heterogeneous trusted anchor executor if each business node passes the vote. Based on the voting result of the global steady-state operation criteria strategy, it determines to complete the black start and execute the normalized secure operation mode.

[0143] In a specific embodiment, the black-start system for power network security capabilities includes a trusted anchor cluster module, an independent voting module, a hierarchical chain recovery module, a trusted access control module, an attack dynamic blocking module, and a steady-state switching module. The Trusted Anchor Cluster Module contains at least three heterogeneous Trusted Anchor Executors, which are mainly used for bootstrapping verification after black start triggering, security control plane operation, and full-process trust measurement and calculation, serving as the trust carrier and security control core of the entire process. The independent voting module is physically isolated from each trusted anchor execution entity. The voting hardware execution rules are factory-preset and cannot be tampered with. It is mainly used to execute majority voting throughout the entire process, to perform the final vote on verification results, security decisions, and disposal instructions, and to issue unbypassable execution instructions. The hierarchical chain recovery module is mainly used to perform progressive recovery of security nodes in each security zone according to the security level priority of the power system security zone, multi-mode trust measurement and voting control, and strictly follow the recovery order with security capabilities as the priority. The Trusted Access Control Module is mainly used to perform multi-mode trusted measurement, permission control and voting processes before business nodes are accessed after the global security capability network is built. The attack dynamic blocking module is mainly used to perform full-process attack monitoring, path tracing, classification and closed-loop handling, and voting control of execution body and node reconstruction. The classification and closed-loop handling rules are consistent with the classification and closed-loop handling rules of claim 1. The steady-state switching module is mainly used for voting control of global trusted state synchronization, two-level redundant archiving of audit logs, and switching of normalized operation modes.

[0144] It is worth mentioning that the heterogeneous trusted anchor execution units of the trusted anchor cluster module adopt independent implementation schemes in at least one of the hardware layer, firmware layer, system layer, middleware layer, and application layer. They have built-in hardware trusted modules with physically immutable hardware storage areas and no common security vulnerabilities. Each trusted anchor execution unit is normally in a cold standby power-off and physically offline state, and is only powered on synchronously when a black boot is triggered. The system is configured with an out-of-band management and control network independent of the production business network. All management and control commands and measurement data are transmitted through the independent out-of-band management and control network, and are physically isolated from the production business network throughout the process.

[0145] The independent voting module is a hardware voter implemented with pure digital logic circuits. It has no programmable interface or operating system. The voting logic and rules are pre-set at the factory and cannot be remotely tampered with. It communicates with each trusted anchor execution unit through an out-of-band dedicated voting bus.

[0146] In some optional implementations, the trusted anchor cluster module is equipped with a two-level hardware write-protected storage system, which includes: The first-level storage unit is a local hardware write-protected storage area for heterogeneous trusted anchor execution entities. It belongs to a single heterogeneous trusted anchor execution entity and is used to store the baseline trust root, the heterogeneous security control plane mirror, the local copy of the node trusted baseline library, and the full-process audit log of black boot. The second-level storage unit is a global hardware write-protected storage unit for the Trusted Anchor Cluster. It belongs to the entire Trusted Anchor Cluster and is used to store a global redundant backup copy of the trusted benchmark library of the storage node, multiple sets of heterogeneous pure benchmark images of each security node, and a global backup of the audit logs of the entire cluster black boot process. Both levels of storage units are in a hardware write-protected read-only state by default, and audit log appending can only be performed after a majority vote.

[0147] This embodiment also provides a black-start device for power network security capabilities. This device is used to implement the above embodiments and preferred embodiments, and details already described will not be repeated. As used below, the term "unit" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0148] This embodiment provides a black-start device for power network security, such as... Figure 5 As shown, it includes: The heterogeneous trusted anchor execution unit is used to trigger black start, power on multiple heterogeneous trusted anchor execution units in the trusted anchor cluster, and perform bootstrapping and voting on the corresponding anchor trust roots to generate the first voting result. The first independent voting unit outside the band is used to perform cross-validation on the heterogeneous security control plane when the first voting result meets the preset majority voting pass condition, and to vote according to the cross-validation result to generate the second voting result. The second independent voting unit outside the second zone is used to activate the heterogeneous security control plane that passed the vote in the second voting result, and to perform progressive recovery and voting on the security nodes in each security partition according to the preset security level priority. The third independent voting unit outside the zone is used to perform progressive recovery of business nodes and vote on each business node according to the preset business priority when all security nodes in the entire security partition pass the vote. The fourth independent voting unit outside the band is used to vote on the global steady-state operation criteria strategy generated by each heterogeneous trusted anchor execution entity if each business node passes the vote, and to determine the completion of black start and execution of normalized secure operation mode based on the voting result of the global steady-state operation criteria strategy.

[0149] In a specific embodiment, the device includes at least three heterogeneous trusted anchor execution units, an out-of-band independent voting unit, an out-of-band communication unit, and a trusted anchor cluster global hardware write-protected storage unit; wherein, the first out-of-band independent voting unit, the second out-of-band independent voting unit, the third out-of-band independent voting unit, and the fourth out-of-band independent voting unit are all out-of-band independent voting units.

[0150] The heterogeneous trusted anchor execution unit is a trusted computing hardware unit with a hardware trusted module. Each unit adopts an independent full-stack heterogeneous design at the hardware layer, firmware layer, system layer, middleware layer, and application layer. It has a built-in hardware trusted module with a physically immutable hardware storage area and a local hardware write-protected storage area, which are used to solidify the unique integrity verification hash of the base trust root complete file, store the base trust root complete file, the heterogeneous security control plane mirror, the local copy of the node trusted base library, and the local archive partition of the black boot full process audit log. The out-of-band independent voting unit is physically isolated from each heterogeneous trusted anchor execution unit, solidifies the core rules of majority voting, the voting logic is immutable, has no programmable network access capability, and is connected to each heterogeneous trusted anchor execution unit through an out-of-band dedicated voting bus. The out-of-band communication unit provides a physical out-of-band trigger interface and an independent out-of-band control network communication interface to enable physical triggering of black start, cross-unit synchronous communication and alarm output. All communication channels are physically isolated from the production business network. The cluster-wide hardware write-protected storage unit is used to store heterogeneous security control plane images of each trusted anchor executor, multiple sets of heterogeneous pure benchmark images of each security node, global redundant copies of the node trusted benchmark library, and global archive partitions of the black boot full-process audit logs. By default, it is in a hardware write-protected read-only state.

[0151] The out-of-band independent voting unit is a hardware voter implemented with pure digital logic circuits. It has no programmable interface or operating system. Most of the core voting rules are factory-preset and cannot be remotely tampered with. All heterogeneous trusted anchor execution units of the device are normally in a cold standby power-off and completely physical offline state. Only the encrypted physical out-of-band trigger interface is retained. There is no remote forced start or voting bypass interface.

[0152] The heterogeneous trusted anchor execution unit preferably adopts an industrial-grade dedicated server with a hardware trusted module, or any one of the following: industrial-grade trusted computing plug-in card, embedded industrial machine, or system-on-a-chip (SoC) security module.

[0153] The black-start device for power network security provided in this embodiment of the invention can execute the black-start method for power network security provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects for executing the method. Further functional descriptions of the various modules and units described above are the same as in the corresponding embodiments described above, and will not be repeated here.

[0154] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the black-boot method for power network security capabilities shown in the above embodiments is implemented.

[0155] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A black-start method for power grid network security, characterized in that, The method includes: Trigger a black start, power on multiple heterogeneous trusted anchor execution entities in the trusted anchor cluster, and bootstrap and vote on the corresponding anchor trust roots to generate the first voting result; When the first voting result meets the preset majority voting pass condition, cross-validation is performed on the heterogeneous security control plane, and voting is conducted according to the cross-validation result to generate the second voting result. The heterogeneous security control plane that passed the vote in the second voting result is activated, and the security nodes in each security partition are progressively restored and voted on according to the preset security level priority. When all security nodes within all security partitions pass the vote, the service nodes are progressively restored according to the preset service priority, and a vote is held on each of the service nodes. If each of the aforementioned business nodes passes the vote, then the global steady-state operation criterion strategy generated by each of the aforementioned heterogeneous trusted anchor executors is voted on, and the black start is completed and the normalized intrinsic security operation mode is executed based on the voting result of the global steady-state operation criterion strategy.

2. The method according to claim 1, characterized in that, The triggering of the black boot involves powering on multiple heterogeneous trusted anchor executions within the trusted anchor cluster and bootstrapping and voting on the corresponding anchor trust roots to generate a first voting result, including: Trigger a black start and simultaneously power on multiple heterogeneous trusted anchor executions in the trusted anchor cluster; The hardware trusted module firmware and the master device boot firmware within the execution bodies of each heterogeneous trusted anchor point are bootstrapped. After the bootstrapping is successful, the complete file of the baseline root of trust in the local hardware write-protected storage area is extracted and combined with the anchor root of trust in the physically immutable hardware storage area. The trust measurement of the anchor root of trust is then performed to generate standardized measurement results. The first voting result is generated by voting on each of the standardized metric results.

3. The method according to claim 1, characterized in that, The voting rules used to generate the first voting result include flexible voting rules: If less than half of the trusted anchor executions fail the verification, a physical power-off isolation command is issued to the abnormal executions and a security alarm is triggered. The remaining executions are then switched to a voting rule where all results are completely consistent. The verification is considered successful only if all the remaining trusted anchor executions output consistent results. If half or more of the trusted anchor executions fail the verification, the entire cluster is immediately powered off to terminate the process and a security alarm is triggered.

4. The method according to claim 1, characterized in that, When the first voting result meets the preset majority voting pass condition, cross-validation is performed on the heterogeneous security control plane, and voting is conducted according to the cross-validation result to generate a second voting result, including: When the first voting result meets the preset majority voting pass condition, the trusted reference of the heterogeneous security control plane of each heterogeneous trusted anchor executor is retrieved; The credibility determination result is obtained by using the credibility benchmark of the heterogeneous security control plane of each heterogeneous trusted anchor executor and the heterogeneous security control plane stored in the local hardware write-protected storage area to perform credibility measurement. Cross-validate the credibility determination result corresponding to any of the heterogeneous trusted anchor execution entities with the credibility determination results corresponding to the remaining heterogeneous trusted anchor execution entities, and output the cross-validation result; A second voting result is generated by voting on each of the credibility determination results and each of the cross-validation results. When the first voting result does not meet the preset majority voting pass condition, it is determined that the bootstrap verification of each heterogeneous trusted anchor executor fails, and the trusted anchor cluster is stopped from powering on.

5. The method according to claim 1, characterized in that, The process of activating the heterogeneous security control plane that passed the vote in the second voting result, and performing progressive recovery and voting on security nodes in each security partition according to the preset security level priority, includes: Initiate the heterogeneous security control plane that passed the vote in the second voting result; According to the preset security level priority, perform progressive recovery on the security nodes in each security zone; The original measurement data of the recovered secure node is sent to all the heterogeneous trusted anchor execution entities; Each heterogeneous trusted anchor execution entity performs a full-dimensional, multi-modal trusted measurement verification on each of the security nodes, and votes on the first verification result.

6. The method according to claim 1, characterized in that, When all security nodes within all security partitions pass the vote, the gradual recovery of service nodes is performed according to preset service priorities, and a vote is taken on each of the service nodes, including: Physically isolate and reconstruct security nodes that failed to pass the vote within each of the aforementioned security partitions; When all security nodes within the aforementioned security partition pass the vote, the service nodes are gradually restored according to the preset service priority. Send the access requests of each of the aforementioned business nodes to all of the aforementioned heterogeneous trusted anchor execution entities; Each heterogeneous trusted anchor execution entity performs a full-dimensional, multi-modal trusted measurement verification on each business node, and votes on the second verification result.

7. The method according to claim 1, characterized in that, If each of the aforementioned business nodes passes the vote, then the global steady-state operation criterion strategy generated by each of the heterogeneous trusted anchor executors is voted on. Based on the voting result of the global steady-state operation criterion strategy, the black start is completed and the normalized intrinsic security operation mode is executed, including: If each of the aforementioned business nodes passes the vote, then the global steady-state operation criterion strategy generated by each of the aforementioned heterogeneous trusted anchor execution entities is retrieved; Each of the aforementioned global steady-state operation criteria and strategies is cross-validated and voted on sequentially. When the global steady-state operation criterion strategy is approved, the black start is completed and the normalized intrinsic safety operation mode is executed. When the global steady-state operation criterion strategy votes against the decision, the steady-state operation process is terminated and a safety alarm is triggered.

8. The method according to any one of claims 1 to 7, characterized in that, The method further includes: Collect consistent running data throughout the entire black boot process; Based on the aforementioned whole-process homogeneous operation data, attack identification and attack tracing are performed on the corresponding heterogeneous trusted anchor execution entities to obtain corresponding handling strategies. Each of the proposed handling strategies is subject to a majority vote, and closed-loop handling and system self-healing are carried out in stages according to the majority vote results.

9. A black-start system for power grid network security, characterized in that, The system includes: The Trusted Anchor Cluster Module is used to trigger a black start, power on multiple heterogeneous trusted anchor execution entities in the Trusted Anchor Cluster, and perform bootstrapping and voting on the corresponding anchor trust roots to generate the first voting result. The independent voting module is used to perform cross-validation on the heterogeneous security control plane when the first voting result meets the preset majority voting pass condition, and to vote according to the cross-validation result to generate a second voting result. The hierarchical chain recovery module is used to initiate the heterogeneous security control plane that passed the vote in the second voting result, and to perform progressive recovery and voting on the security nodes in each security partition according to the preset security level priority. The trusted on-time control module is used to perform progressive recovery of business nodes and vote on each business node according to the preset business priority when all security nodes in all security partitions pass the vote. The steady-state switching module is used to vote on the global steady-state operation criteria strategy generated by each of the heterogeneous trusted anchor execution entities if each of the aforementioned business nodes passes the vote, and determine the completion of black start and execution of normalized intrinsic security operation mode based on the voting result of the global steady-state operation criteria strategy.

10. The system according to claim 9, characterized in that, The trusted anchor cluster module is equipped with a two-level hardware write-protected storage system, which includes: The first-level storage unit is a local hardware write-protected storage area for heterogeneous trusted anchor execution entities. It belongs to a single heterogeneous trusted anchor execution entity and is used to store the baseline trust root, the heterogeneous security control plane image, the local copy of the node trusted baseline library, and the full-process audit log of black boot. The second-level storage unit is a global hardware write-protected storage unit for the Trusted Anchor Cluster. It belongs to the entire Trusted Anchor Cluster and is used to store a global redundant backup copy of the trusted benchmark library of the storage node, multiple sets of heterogeneous pure benchmark images of each security node, and a global backup of the audit logs of the entire cluster black boot process. Both levels of storage units are in a hardware write-protected read-only state by default, and audit log appending can only be performed after a majority vote.

11. A black-start device for power network security, characterized in that, The device includes: The heterogeneous trusted anchor execution unit is used to trigger black start, power on multiple heterogeneous trusted anchor execution units in the trusted anchor cluster, and perform bootstrapping and voting on the corresponding anchor trust roots to generate the first voting result. The first independent voting unit outside the band is used to perform cross-validation on the heterogeneous security control plane when the first voting result meets the preset majority voting pass condition, and to vote according to the cross-validation result to generate the second voting result. The second independent voting unit outside the second zone is used to activate the heterogeneous security control plane that passed the vote in the second voting result, and to perform progressive recovery and voting on the security nodes in each security partition according to the preset security level priority. The third independent voting unit outside the band is used to perform progressive recovery of business nodes and vote on each of the business nodes according to the preset business priority when all security nodes in the security partition pass the vote. The fourth independent voting unit is used to vote on the global steady-state operation criteria strategy generated by each of the heterogeneous trusted anchor execution entities if each of the aforementioned business nodes passes the vote, and to determine the completion of black start and execution of normalized intrinsic security operation mode based on the voting result of the global steady-state operation criteria strategy.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the black-start method for power network security capabilities as described in any one of claims 1 to 8.

Images