A hybrid wireless network access selection method and system for power service bearer

Abstract

The application discloses a kind of hybrid wireless network access selection methods and systems for power service bearing.The method obtains the communication demand and multidimensional security demand of power service and the communication attribute and security capability of multiple candidate wireless networks;The security demand of service is compared with each candidate network security capability item by item, and the gap of each security capability dimension is determined;Additional security measures corresponding to the gap that can be compensated are configured, and candidate security access paths are formed by candidate wireless networks and security measures;Whether each candidate security access path meets the business communication demand is verified, and the target security access path is determined by comprehensive evaluation in the candidate path that meets security and communication demand;Access authorization information bound with terminal, service, target network, security policy and validity period is generated, and service access is executed;After access, network state is continuously monitored, and dynamic reselection is performed when requirements are not met.The application realizes the collaborative optimization of security capability and communication performance and the dynamic update of access path.

Description

Technical Field

[0001] This invention belongs to the field of power wireless communication and heterogeneous network access control technology, specifically relating to a hybrid wireless network access selection method and system for power services, applicable to wireless security access control in power service scenarios such as online monitoring, mobile operations, and video inspection. Background Technology

[0002] In power systems, service terminals are widely distributed across various areas, including substations, distribution rooms, transmission lines, industrial parks, and mobile work sites. Due to differences in deployment conditions, coverage, and service types, power wireless communication typically utilizes multiple network standards, such as WLAN, WiMAX, 4G / 5G public networks, 4G / 5G private networks, and power wireless private networks, to provide access services. These different networks offer varying advantages and disadvantages in terms of available bandwidth, transmission rate, latency, packet loss rate, coverage, and operating costs. Furthermore, their security capabilities differ in areas such as authentication, data encryption, integrity protection, access control, network isolation, and security domain levels.

[0003] Existing methods for selecting heterogeneous network access in power services typically use the bandwidth, speed, latency, packet loss rate, security, and cost of multiple candidate wireless networks as evaluation indicators. These indicators are then normalized and weighted using methods such as the analytic hierarchy process (AHP), entropy weighting, or other multi-attribute decision-making methods. Finally, the network with the highest comprehensive score is selected as the access network.

[0004] However, the existing technologies mentioned above have the following shortcomings: security capabilities (identity authentication, encryption, integrity, access control, network isolation, etc.) are combined into a single indicator and weighted together with communication attributes, which can easily mask deficiencies in individual security capabilities; there is a lack of independent security access judgment, and networks that do not meet security requirements may still be selected due to superior communication performance; when network security capabilities are insufficient, only a lower score or elimination is possible, and it is impossible to configure additional security measures to compensate for specific gaps; access authorization is not bound to terminals, services, networks, and security policies, and there is a lack of continuous security verification, making it impossible to dynamically adjust access paths; additional security measures will introduce additional latency and bandwidth overhead, and existing solutions do not jointly verify security capabilities and communication performance, which may lead to the problem of security being met but latency exceeding limits.

[0005] Therefore, there is an urgent need to provide a hybrid wireless network access selection method and system that can achieve item-by-item matching of security capabilities, dynamic configuration with compensable gaps, joint constraints of communication and security, binding of authorization and services, and dynamic updates. Summary of the Invention

[0006] The purpose of this invention is to provide a hybrid wireless network access selection method and system for power service transmission, addressing the technical problems in existing technologies such as simplistic security evaluation, lack of independent security access determination, inability to compensate for networks with insufficient security capabilities, lack of access authorization and service binding, and lack of continuous security verification. This invention, based on the communication performance and security access requirements of the power service to be accessed, obtains the communication operation status and security capabilities of multiple candidate wireless networks, performs security access condition determination on the candidate wireless networks, and identifies the target wireless access network from among the candidate networks or secure access paths that meet the service security requirements, thereby achieving secure access and reliable transmission of power services.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: a hybrid wireless network access selection method for power service bearer, comprising the following steps:

[0008] Step 1: Obtain the communication and security requirements of the power service to be accessed, and obtain the communication attributes and security capabilities of multiple candidate wireless networks; the communication requirements include bandwidth, transmission rate, latency and packet loss rate requirements, and the security requirements include identity authentication, data confidentiality, data integrity, access control, network isolation and network trusted status requirements.

[0009] Step 2: Compare the security requirements of the power service to be accessed with the security capabilities of each candidate wireless network item by item to determine whether there is a security capability gap in each candidate wireless network in each security capability dimension; add the candidate wireless network that meets the security requirements to the set of secure feasible networks; remove the candidate wireless network with an uncompensable security capability gap from the candidate set.

[0010] Step 3: For candidate wireless networks with security capability gaps that can be compensated by preset additional security measures, configure corresponding additional security measures according to the security capability gaps, and form a candidate secure access path together with the candidate wireless network and the additional security measures;

[0011] Step 4: Verify whether each candidate secure access path meets the communication requirements of the power service to be accessed; among the candidate secure access paths that simultaneously meet the security requirements and the communication requirements, conduct a comprehensive evaluation based on communication performance parameters to determine the target secure access path;

[0012] Step 5: Generate access authorization information based on the target secure access path, execute the security measures corresponding to the target secure access path, and establish a communication connection between the power service to be accessed and the target wireless network;

[0013] Step 6: Continuously monitor the communication and security status of the target wireless network. When the current access path no longer meets the service security or communication requirements, repeat steps 1 to 5.

[0014] Furthermore, in step 2, the security requirements of the power service to be accessed are compared item by item with the security capabilities of each candidate wireless network, including:

[0015] Let the security requirement vector of the power service to be connected be . Each element represents the minimum requirements of the business for identity authentication, data confidentiality, data integrity, access control, network isolation, and network trust status.

[0016] Let the security capability vector of the nth candidate wireless network be... ;

[0017] Calculate the gap in the k-th security capability dimension ;

[0018] When all security capability dimensions are satisfied At that time, the candidate wireless network is determined to be a natively security-compliant network;

[0019] When a security capability gap exists but can be compensated for by pre-set additional security measures, the candidate wireless network is identified as a security capability compensable network, and a security capability gap set is formed. .

[0020] Furthermore, in step 3, corresponding additional security measures are configured based on the security capability gap, including:

[0021] According to the set of security capability gaps Select the corresponding security control measures from the preset security control rule base, which includes one or more of the following: identity enhancement authentication, additional encryption protection, integrity verification, secure access gateway, network isolation control, and service access control.

[0022] Based on the mapping relationship between security capability gaps and security control measures, select a set of security controls that can compensate for the corresponding gaps. ;

[0023] The security control set and candidate wireless networks are arranged into a security control chain according to the execution order. , where N n Indicates candidate wireless networks;

[0024] The security control chain and the candidate wireless network together constitute a candidate secure access path.

[0025] Furthermore, after forming the candidate secure access path, step 3 further includes:

[0026] The security capabilities of candidate wireless networks are compensated based on the security control set to obtain the compensated equivalent security capabilities. ,in This represents a function that calculates the equivalent safety capability after compensation based on safety control measures.

[0027] When the compensated equivalent security capability meets If so, the candidate secure access path is determined to meet the business security requirements.

[0028] Further, in step 4, verifying whether each candidate secure access path meets the communication requirements of the power service to be accessed includes:

[0029] For each candidate secure access path, the communication performance parameters of the candidate secure access path are determined based on the communication attributes of the corresponding candidate wireless network and the additional overhead introduced by security control measures. These communication performance parameters include available bandwidth B. n Transmission rate R n Communication delay D n Packet loss rate P n and access cost C n ;

[0030] Based on the communication requirements of the power service to be accessed, the candidate secure access paths are constrained and judged: , , , ,in , , and These represent the minimum bandwidth, minimum transmission rate, maximum allowable latency, and maximum allowable packet loss rate required by the service, respectively.

[0031] Candidate secure access paths that satisfy the constraints are added to the set of secure feasible paths S.

[0032] Furthermore, in step 4, a comprehensive evaluation is performed based on communication performance parameters to determine the target secure access path, including:

[0033] When there are multiple candidate secure access paths in the set of secure feasible paths S, a comprehensive evaluation is performed based on the bandwidth, rate, latency, packet loss rate, security control overhead, and access cost of each path.

[0034] Comprehensive evaluation function for secure access paths Calculate the comprehensive evaluation value of each candidate secure access path;

[0035] The candidate secure access path with the best comprehensive evaluation result is selected as the target secure access path. ,in This represents the comprehensive evaluation function for secure access paths.

[0036] Further, in step 5, generating access authorization information based on the target secure access path, executing the security measures corresponding to the target secure access path, and establishing a communication connection includes:

[0037] The target secure access path is represented as follows: ,in Indicates the target wireless network. This represents the set of security controls corresponding to the target secure access path;

[0038] Determine whether the target secure access path meets the business security requirements: when the compensated equivalent security capability Upon establishment, it is determined that the target secure access path meets the business security requirements;

[0039] Generate access authorization information bound to the target secure access path. ,in Indicates the terminal identifier. Indicates business identifier, Indicates the target wireless network identifier. Indicates the security control strategy identifier. Indicates the effective period of the authorization;

[0040] After receiving the access authorization information, the target wireless network or secure access entity verifies the terminal's identity, service permissions, and security control policies.

[0041] After successful verification, the corresponding security measures are executed sequentially according to the security control set in the target secure access path, and a communication connection is established between the power service and the target wireless network.

[0042] Furthermore, in step 6, the communication and security status of the target wireless network are continuously monitored. When the current access path no longer meets the service security or communication requirements, steps 1 to 5 are re-executed, including:

[0043] Continuously monitor the communication status and security status of the target wireless network. The communication status information includes available bandwidth, transmission rate, communication latency, and packet loss rate. The security status information includes network trust status, security configuration, security policy version, and access authorization validity status.

[0044] When the communication status information does not meet the business communication constraints or the current secure access path does not meet the business security requirements, the current access authorization is revoked or updated, and steps 1 to 5 are re-executed to reselect the target secure access path.

[0045] The present invention also provides a hybrid wireless network access selection system for power service bearers, for implementing the above-mentioned method, comprising:

[0046] The business requirements acquisition module is used to acquire the communication and security requirements of the power services to be accessed.

[0047] The network capability acquisition module is used to acquire the communication attributes and security capabilities of multiple candidate wireless networks;

[0048] The security capability gap analysis module is used to compare the security requirements of the power service to be accessed with the security capabilities of each candidate wireless network item by item, determine the security capability gap, and classify the candidate network types.

[0049] The security control configuration module is used to configure additional security measures for networks with compensable security capabilities, and to form candidate secure access paths.

[0050] The access path verification and evaluation module is used to verify whether each candidate secure access path meets the communication requirements and to perform a comprehensive evaluation to determine the target secure access path.

[0051] The access authorization generation module is used to generate access authorization information based on the target secure access path;

[0052] The secure access execution module is used to execute the security measures corresponding to the target secure access path and establish a communication connection.

[0053] The status monitoring and update module is used to continuously monitor the communication and security status of the target wireless network, and trigger the re-execution of secure access path selection when the current access path no longer meets the service requirements.

[0054] Furthermore, when the security capability gap analysis module compares the security requirements of the power service to be accessed with the security capabilities of each candidate wireless network item by item, it makes judgments on each security capability dimension separately, without using other security capabilities or communication performance attributes to compensate for the deficiency of a certain necessary security capability.

[0055] Furthermore, when configuring additional security measures, the security control configuration module selects corresponding security control measures from a preset security control rule base based on the security capability gaps. The security control measures include one or more of the following: enhanced identity authentication, additional encryption protection, integrity verification, secure access gateway, network isolation control, and service access control.

[0056] Furthermore, when the access path verification and evaluation module performs communication performance constraint judgment on the candidate secure access path, the communication performance constraints include minimum bandwidth, minimum transmission rate, maximum allowable delay and maximum allowable packet loss rate, and the communication performance parameters take into account the additional overhead introduced by security control measures.

[0057] Furthermore, the status monitoring and update module can be set up independently or integrated into the network capability acquisition module.

[0058] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which implements the above-described method when the computer program is executed by a processor.

[0059] Compared with the prior art, the present invention has the following beneficial effects:

[0060] (1) This invention matches the security requirements of power services, such as identity authentication, data confidentiality, data integrity, access control, network isolation and network trust status, with the security capabilities of candidate wireless networks one by one, instead of merging each security dimension into a single security evaluation index and weighting it together with ordinary attributes such as bandwidth and latency. This avoids the problem of a single index masking the inadequacy of a single security capability, significantly improves the security accuracy of wireless access decision-making, and solves the problem in the prior art where networks that do not meet security requirements are selected due to inaccurate judgment of security capabilities.

[0061] (2) By identifying the specific gaps in each security capability dimension of each candidate wireless network and configuring corresponding additional security control measures (such as identity enhancement authentication, encrypted tunnels, secure access gateways, isolated security domains, etc.) for compensable gaps, the present invention enables wireless networks that could not directly meet the security requirements of services to form usable secure access paths through security capability compensation, thereby making full use of network resources with good communication performance but slightly lacking security capabilities, and solving the problem of resource waste caused by simply eliminating networks with insufficient security capabilities in the prior art.

[0062] (3) This invention evaluates the candidate wireless networks and their configured security control measures together as a secure access path. On the basis of meeting the service security requirements, it further combines communication indicators such as bandwidth, rate, latency, and packet loss rate for constraint screening. It also fully considers the additional authentication latency, processing latency and bandwidth overhead introduced by the security control process, so that the selection result meets both security and service carrying performance requirements. This solves the problem in the prior art that security requirements may be met but service latency exceeds the limit due to the lack of joint verification of security capabilities and communication performance.

[0063] (4) By generating access authorization information that is bound to terminal identifier, service identifier, target wireless network identifier, security control policy and validity period, this invention associates service access permissions with specific services and security policies, avoids the incorrect reuse of access permissions in different services or different network scenarios, improves the reliability of security access control in a hybrid wireless network environment, and solves the problem in the prior art that access authorization is not bound to services and is easily reused across services and networks.

[0064] (5) The present invention forms a closed-loop process of “status acquisition - security capability matching - security control configuration - secure access path selection - authorized access - status update”. During the operation of the service, the communication status and security status are continuously monitored. When the network trust status changes, the security policy changes, or the current access path cannot meet the service requirements, the access authorization can be revoked or updated in a timely manner and the secure access path selection can be re-executed. This solves the problem of lack of continuous security verification in the prior art, which makes it impossible to dynamically adjust the access path and improves the continuous secure access capability in dynamic network environments.

[0065] (6) This invention can be deployed on power wireless communication management platforms, edge controllers or network selection entities, and can be further extended according to actual application scenarios, including authentication level, encryption algorithm, security domain level, trusted status evaluation index and communication performance parameters, without changing the basic process of security requirement matching, security capability compensation and secure access path selection. It has good scalability and wide applicability. Attached Figure Description

[0066] Figure 1 This is a flowchart of a hybrid wireless network access selection method for power service bearer provided in an embodiment of the present invention;

[0067] Figure 2 This is a framework diagram of a hybrid wireless network access selection system for power service bearer provided in an embodiment of the present invention. Detailed Implementation

[0068] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0069] It should be noted that the following detailed descriptions are exemplary and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0070] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0071] like Figure 1 As shown, the hybrid wireless network access selection method for power service bearers provided in this embodiment includes the following steps:

[0072] Step 1: Obtain the communication and security requirements of the power service to be accessed, and obtain the communication attributes and security capabilities of multiple candidate wireless networks; the communication requirements include bandwidth, transmission rate, latency and packet loss rate requirements, and the security requirements include identity authentication, data confidentiality, data integrity, access control, network isolation and network trusted status requirements.

[0073] Step 2: Compare the security requirements of the power service to be accessed with the security capabilities of each candidate wireless network item by item to determine whether there is a security capability gap in each candidate wireless network in each security capability dimension; add the candidate wireless network that meets the security requirements to the set of secure feasible networks; remove the candidate wireless network with an uncompensable security capability gap from the candidate set.

[0074] Step 3: For candidate wireless networks with security capability gaps that can be compensated by preset additional security measures, configure corresponding additional security measures according to the security capability gaps, and form a candidate secure access path together with the candidate wireless network and the additional security measures;

[0075] Step 4: Verify whether each candidate secure access path meets the communication requirements of the power service to be accessed; among the candidate secure access paths that simultaneously meet the security requirements and the communication requirements, conduct a comprehensive evaluation based on communication performance parameters to determine the target secure access path;

[0076] Step 5: Generate access authorization information based on the target secure access path, execute the security measures corresponding to the target secure access path, and establish a communication connection between the power service to be accessed and the target wireless network;

[0077] Step 6: Continuously monitor the communication and security status of the target wireless network. When the current access path no longer meets the service security or communication requirements, repeat steps 1 to 5.

[0078] The following section provides a further explanation of the relevant technical aspects involved in this method.

[0079] Step 1: Obtain business requirements and candidate network capabilities

[0080] The system receives a secure access request for a power service, obtains the service type, terminal identifier, and service identifier, and forms a service communication requirement parameter set and a service security requirement parameter set. The service communication requirement parameter set includes minimum bandwidth, target bandwidth, minimum transmission rate, target transmission rate, maximum allowable latency, maximum allowable packet loss rate, and cost constraints; the service security requirement parameter set includes authentication, data confidentiality, data integrity, access control, network isolation, and network trusted state requirements.

[0081] Let the number of candidate networks be... , No. The communication attributes of each candidate network include available bandwidth. achievable speed Communication delay Packet loss rate and network access costs Its composition, represented by its communication attribute vector, is as follows:

[0082]

[0083] No. The security capabilities of each candidate wireless network include authentication capabilities. Encryption capabilities Integrity protection capabilities Access control capabilities Network isolation capabilities and current trusted state Its security capability vector is represented as

[0084]

[0085] The system acquires the communication attributes and security capabilities of each candidate wireless network through periodic data collection or event triggering, which serves as the basis for subsequent security capability matching and secure access path selection.

[0086] Step 2: Security Capability Matching and Gap Identification

[0087] Let the security requirement vector of the power service to be connected be:

[0088]

[0089] Each element represents the minimum requirements of the service for identity authentication, data confidentiality, data integrity, access control, network isolation, and network trust status. The service security requirement vector e is then compared with the security capability vector of the nth candidate wireless network. Calculate the gap in the k-th security capability dimension:

[0090]

[0091] When all security capability dimensions are satisfied The nth candidate wireless network is determined to be a natively security-satisfied network. When a security capability gap exists, but the corresponding gap can be compensated by preset additional security measures, the candidate wireless network is determined to be a security capability compensable network, forming a security capability gap set:

[0092]

[0093] If a candidate wireless network has an uncompensable security capability gap, or if there are no available security measures corresponding to the gap, the candidate wireless network will be removed from the candidate set. During the security capability matching process, each security capability dimension is judged separately, and no other security capabilities or communication performance attributes are used to compensate for the deficiency of a necessary security capability.

[0094] Step 3: Security control configuration and candidate secure access path generation

[0095] For candidate wireless networks with security capability gaps, the system determines the security capability gap set based on the available security capability gaps. Select the corresponding security control measure from the preset security control rule base. Let the security control rule base be:

[0096]

[0097] in, This includes enhanced identity authentication, additional encryption protection, integrity verification, secure access gateway, network isolation control, and business access control.

[0098] Based on the mapping relationship between security capability gaps and security control measures, the system selects a set of security controls that can compensate for the corresponding gaps.

[0099]

[0100] For networks with natively satisfied security, the security control set is empty. For networks with compensable security capabilities, the system generates corresponding security control chains according to the security control policy.

[0101]

[0102] in, This indicates a candidate wireless network, representing additional security controls arranged in the order of execution.

[0103] The security control chain and the candidate wireless network together constitute a candidate secure access path. The system compensates for the security capabilities of the candidate wireless network based on the security control chain, obtaining the compensated equivalent security capabilities:

[0104]

[0105] in This function represents the equivalent safety capability calculated after compensation based on safety control measures.

[0106] When the compensated equivalent security capability meets When the compensated security capabilities are no less than the corresponding security requirements of the business in all security capability dimensions, the candidate security access path is determined to meet the business security requirements.

[0107] Through the above process, the system no longer selects based solely on the attributes of the wireless network itself, but generates a secure access path that meets the requirements based on business security needs.

[0108] Step 4: Communication performance constraint screening and target secure access path selection

[0109] For the nth candidate secure access path, the communication performance parameters of the candidate secure access path are determined based on the communication attributes of the corresponding candidate wireless network and the additional overhead introduced by security control measures. The communication performance parameters include available bandwidth B. n Transmission rate R n Communication delay D n Packet loss rate P n and access cost C n .

[0110] The system performs constraint judgments on candidate secure access paths based on the communication requirements of the power services to be accessed. , , , ,in , , and These represent the minimum bandwidth, minimum transmission rate, maximum allowable latency, and maximum allowable packet loss rate required by the service, respectively.

[0111] Candidate secure access paths that meet both business security requirements and communication performance constraints are included in the set of secure feasible paths. .

[0112] When there are multiple candidate secure access paths in the set of secure feasible paths S, the system comprehensively evaluates each path based on its bandwidth, rate, latency, packet loss rate, security control overhead, and access cost to determine the target secure access path.

[0113]

[0114] in, This represents the comprehensive evaluation function for secure access paths. Finally, the candidate secure access path with the optimal comprehensive evaluation result is selected as the target secure access path.

[0115] Step 5: Access Authorization Generation and Secure Access Execution

[0116] Determine the target secure access path Subsequently, the system generates corresponding access authorization information based on the target secure access path, wherein the target secure access path is represented as:

[0117]

[0118] in, Indicates the target wireless network. This represents the set of security controls corresponding to the target secure access path.

[0119] The system performs authorization checks based on the security capabilities corresponding to the target secure access path, determining whether the target secure access path meets business security requirements. Upon establishment, it is determined that the target secure access path meets the business security requirements, whereby... The equivalent security capability of the target secure access path after security control compensation. This represents the business security requirement vector.

[0120] Subsequently, the system generates access authorization information bound to the target secure access path. ,in Indicates the terminal identifier. Indicates business identifier, Indicates the target wireless network identifier. Indicates the security control strategy identifier. Indicates the effective period of the authorization.

[0121] After receiving the access authorization information, the target wireless network or secure access entity verifies the terminal's identity, service permissions, and security control policies. Upon successful verification, it proceeds according to the security control set in the target secure access path. The corresponding security measures are executed in sequence, including identity authentication, data encryption, integrity protection, access control or network isolation control, and a communication connection is established between the power business and the target wireless network.

[0122] Step 6: Status monitoring and dynamic updates after service integration

[0123] After service access is completed, the system continuously monitors communication status information such as available bandwidth, transmission rate, communication latency, and packet loss rate of the target wireless network, as well as security status information such as network trust status, security configuration, security policy version, and access authorization validity status. If the communication status does not meet the service communication constraints or the current secure access path does not meet the service security requirements, the system revokes or updates the current access authorization and re-executes the above steps to reselect the target secure access path.

[0124] Through the above dynamic update process, continuous and secure access to power services in a hybrid wireless network environment is achieved.

[0125] like Figure 2 As shown, this embodiment also provides a hybrid wireless network access selection system for implementing the above-mentioned system, including: a service requirement acquisition module, a network capability acquisition module, a security capability gap analysis module, a security control configuration module, an access path verification and evaluation module, an access authorization generation module, a secure access execution module, and a status monitoring and update module. The modules are logically connected in the following order: service requirement and network status acquisition, security capability matching, security control configuration, access path verification, access authorization, secure access execution, and status feedback.

[0126] The business requirement acquisition module is used to acquire the business type, minimum bandwidth, target bandwidth, minimum rate, target rate, security level, allowable latency, allowable packet loss rate, and cost constraints of the power service to be accessed, as well as the requirements for identity authentication, data confidentiality, data integrity, access control, network isolation, and network trust status, and form a business requirement parameter set.

[0127] The network capability acquisition module is used to periodically or event-triggeredly collect the available bandwidth, reachable speed, security evaluation value, current latency, current packet loss rate and access cost of each candidate network, as well as authentication capability, encryption capability, integrity protection capability, access control capability, network isolation capability, security domain level and current trusted status, forming a candidate network attribute matrix.

[0128] The security capability gap analysis module is used to compare the service security requirements with the security capabilities of each candidate wireless network item by item, determine the security capability gap of each candidate wireless network, and classify the candidate wireless networks into security requirement satisfied type, security capability compensable type, and security capability uncompensable type.

[0129] The security control configuration module is used to configure additional security measures such as identity verification, encrypted tunnels, integrity protection, secure access gateways, isolated security domains, or service-level access control for specific security capability gaps in the security capability compensable network, thereby forming candidate secure access paths.

[0130] The access path verification and evaluation module is used to verify whether each candidate secure access path meets the business security requirements and communication performance thresholds; when there are multiple feasible paths, a comprehensive evaluation is performed based on bandwidth, rate, latency, packet loss rate, security control overhead and access cost to determine the target secure access path.

[0131] The access authorization generation module is used to generate access authorization information based on the target secure access path, and bind the access authorization information with the terminal identifier, service identifier, target wireless network identifier, security control policy, and validity period.

[0132] The secure access execution module is used to verify the access authorization information, execute the security measures corresponding to the target secure access path, and establish a communication connection between the power service to be accessed and the target wireless network.

[0133] The status monitoring and update module continuously monitors the communication and security status of the target wireless network. When the current access path no longer meets service security or communication requirements, it updates or revokes the access authorization and feeds back the status change to the network capability acquisition module, re-executing the secure access path selection. This module can be configured independently or integrated into the network capability acquisition module.

[0134] Example 1: Secure Access to Online Monitoring Services

[0135] For online monitoring services, the system first obtains the communication and security requirements of the service. Since online monitoring requires continuous transmission of equipment operating status data, corresponding bandwidth, transmission rate, latency, and packet loss rate requirements are set. Simultaneously, authentication, data confidentiality, integrity protection, and access control requirements are set according to the importance of the service data. The system obtains the communication attributes and security capabilities of candidate wireless networks such as power grid private networks, 5G public or private networks, and WLANs, and calculates the security capability gaps of each candidate network according to the security capability matching method in step 2. Assuming a candidate 5G network has the required authentication and encryption capabilities but insufficient network isolation capabilities, the system configures a secure access gateway or isolated security domain as a compensation measure based on the security capability gap, forming a corresponding secure access path. Subsequently, the system filters the compensated secure access paths according to the communication performance constraints in step 4. When a path simultaneously meets the security and communication requirements of the online monitoring service, it is added to the set of secure feasible paths, and the path with the best overall performance is selected to complete the service access.

[0136] Example 2: Secure Access to Mobile Operation Services

[0137] For mobile operations, since terminal locations may change, the system sets corresponding communication and security requirements based on the service type. Communication requirements include transmission rate, latency, and packet loss rate requirements in a mobile environment; security requirements include terminal authentication, access control, and data protection requirements. The system acquires multiple candidate wireless networks within the coverage area of ​​the mobile terminal's current location and determines whether each network meets the service security requirements. For networks with insufficient security capabilities but which can be compensated for by additional security controls, the system configures corresponding security control measures, such as enhanced authentication or service access control policies. When multiple candidate secure access paths meet the mobile operation service requirements, the system comprehensively evaluates the path's communication performance, security control overhead, and access cost, and selects the target secure access path. When a change in the mobile terminal's location causes the current target network to no longer meet the service security or communication requirements, the system re-executes security capability matching and secure access path selection to achieve dynamic secure access for mobile operations.

[0138] Example 3: Secure Access to Video Inspection Services

[0139] For video inspection services, due to the high bandwidth requirements of video data and the inclusion of on-site equipment image information, the system sets high bandwidth and transmission rate requirements, and sets corresponding data encryption and access control requirements based on the sensitivity of the video data. The system acquires multiple candidate wireless networks covering the inspection area and determines whether each network meets the security and communication requirements of the video inspection service. When a candidate wireless network has high bandwidth but insufficient security isolation capabilities, the system does not directly select that network. Instead, it configures a secure access gateway, service access control, or encrypted transmission measures based on the security capability gap to form a secure access path that meets the requirements. Among the candidate paths that meet the security requirements and communication constraints, the system comprehensively evaluates bandwidth, transmission rate, latency, security control overhead, and cost, and selects the target secure access path to complete the video service transmission.

[0140] This embodiment also provides a computer-readable storage medium having a computer program stored thereon, which implements the above-described method when the computer program is executed by a processor.

[0141] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0142] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0143] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0144] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0145] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention in any other way. Any person skilled in the art may make changes or modifications to the above-disclosed technical content to create equivalent embodiments. However, any simple modifications, equivalent changes, and modifications made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the protection scope of the present invention.

Claims

1. A hybrid wireless network access selection method for power service bearers, characterized in that, Includes the following steps: Step 1: Obtain the communication and security requirements of the power service to be accessed, and obtain the communication attributes and security capabilities of multiple candidate wireless networks; the communication requirements include bandwidth, transmission rate, latency and packet loss rate requirements, and the security requirements include identity authentication, data confidentiality, data integrity, access control, network isolation and network trusted status requirements. Step 2: Compare the security requirements of the power service to be accessed with the security capabilities of each candidate wireless network item by item to determine whether there is a security capability gap in each candidate wireless network in each security capability dimension; add the candidate wireless network that meets the security requirements to the set of secure feasible networks; remove the candidate wireless network with an uncompensable security capability gap from the candidate set. Step 3: For candidate wireless networks with security capability gaps that can be compensated by preset additional security measures, configure corresponding additional security measures according to the security capability gaps, and form a candidate secure access path together with the candidate wireless network and the additional security measures; Step 4: Verify whether each candidate secure access path meets the communication requirements of the power service to be accessed; among the candidate secure access paths that simultaneously meet the security requirements and the communication requirements, conduct a comprehensive evaluation based on communication performance parameters to determine the target secure access path; Step 5: Generate access authorization information based on the target secure access path, execute the security measures corresponding to the target secure access path, and establish a communication connection between the power service to be accessed and the target wireless network; Step 6: Continuously monitor the communication and security status of the target wireless network. When the current access path no longer meets the service security or communication requirements, repeat steps 1 to 5.

2. The hybrid wireless network access selection method for power service bearer according to claim 1, characterized in that, In step 2, the security requirements of the power service to be accessed are compared item by item with the security capabilities of each candidate wireless network, including: Let the security requirement vector of the power service to be connected be . Each element represents the minimum requirements of the business for identity authentication, data confidentiality, data integrity, access control, network isolation, and network trust status. Let the security capability vector of the nth candidate wireless network be... ; Calculate the gap in the k-th security capability dimension ; When all security capability dimensions are satisfied At that time, the candidate wireless network is determined to be a natively security-compliant network; When a security capability gap exists but can be compensated for by pre-set additional security measures, the candidate wireless network is identified as a security capability compensable network, and a security capability gap set is formed. .

3. The hybrid wireless network access selection method for power service bearer according to claim 1, characterized in that, In step 3, corresponding additional security measures are configured based on the security capability gap, including: According to the set of security capability gaps Select the corresponding security control measures from the preset security control rule base, which includes one or more of the following: identity enhancement authentication, additional encryption protection, integrity verification, secure access gateway, network isolation control, and service access control. Based on the mapping relationship between security capability gaps and security control measures, select a set of security controls that can compensate for the corresponding gaps. ; The security control set and candidate wireless networks are arranged into a security control chain according to the execution order. , where N n Indicates candidate wireless networks; The security control chain and the candidate wireless network together constitute a candidate secure access path.

4. The hybrid wireless network access selection method for power service bearer according to claim 3, characterized in that, Step 3, after forming the candidate secure access path, also includes: The security capabilities of candidate wireless networks are compensated based on the security control set to obtain the compensated equivalent security capabilities. ,in This represents a function that calculates the equivalent safety capability after compensation based on safety control measures. When the compensated equivalent security capability meets If so, the candidate secure access path is determined to meet the business security requirements.

5. The hybrid wireless network access selection method for power service bearer according to claim 1, characterized in that, Step 4, verifying whether each candidate secure access path meets the communication requirements of the power service to be accessed, includes: For each candidate secure access path, the communication performance parameters of the candidate secure access path are determined based on the communication attributes of the corresponding candidate wireless network and the additional overhead introduced by security control measures. These communication performance parameters include available bandwidth B. n Transmission rate R n Communication delay D n Packet loss rate P n and access cost C n ; Based on the communication requirements of the power service to be accessed, the candidate secure access paths are constrained and judged: , , , ,in , , and These represent the minimum bandwidth, minimum transmission rate, maximum allowable latency, and maximum allowable packet loss rate required by the service, respectively. Candidate secure access paths that satisfy the constraints are added to the set of secure feasible paths S.

6. The hybrid wireless network access selection method for power service bearer according to claim 1, characterized in that, In step 4, a comprehensive evaluation is performed based on communication performance parameters to determine the target secure access path, including: When there are multiple candidate secure access paths in the set of secure feasible paths S, a comprehensive evaluation is performed based on the bandwidth, rate, latency, packet loss rate, security control overhead, and access cost of each path. Comprehensive evaluation function for secure access paths Calculate the comprehensive evaluation value of each candidate secure access path; The candidate secure access path with the best comprehensive evaluation result is selected as the target secure access path. ,in This represents the comprehensive evaluation function for secure access paths.

7. The hybrid wireless network access selection method for power service bearer according to claim 1, characterized in that, In step 5, access authorization information is generated based on the target secure access path, security measures corresponding to the target secure access path are executed, and a communication connection is established, including: The target secure access path is represented as follows: ,in Indicates the target wireless network. This represents the set of security controls corresponding to the target secure access path; Determine whether the target secure access path meets the business security requirements: when the compensated equivalent security capability Upon establishment, it is determined that the target secure access path meets the business security requirements; Generate access authorization information bound to the target secure access path. ,in Indicates the terminal identifier. Indicates business identifier, Indicates the target wireless network identifier. Indicates the security control strategy identifier. Indicates the effective period of the authorization; After receiving the access authorization information, the target wireless network or secure access entity verifies the terminal's identity, service permissions, and security control policies. After successful verification, the corresponding security measures are executed sequentially according to the security control set in the target secure access path, and a communication connection is established between the power service and the target wireless network.

8. The hybrid wireless network access selection method for power service bearer according to claim 1, characterized in that, In step 6, the communication and security status of the target wireless network are continuously monitored. When the current access path no longer meets the service security or communication requirements, steps 1 to 5 are re-executed, including: Continuously monitor the communication status and security status of the target wireless network. The communication status information includes available bandwidth, transmission rate, communication latency, and packet loss rate. The security status information includes network trust status, security configuration, security policy version, and access authorization validity status. When the communication status information does not meet the business communication constraints or the current secure access path does not meet the business security requirements, the current access authorization is revoked or updated, and steps 1 to 5 are re-executed to reselect the target secure access path.

9. A hybrid wireless network access selection system for power service bearer, used to implement the method as described in any one of claims 1-8, characterized in that, include: The business requirements acquisition module is used to acquire the communication and security requirements of the power services to be accessed. The network capability acquisition module is used to acquire the communication attributes and security capabilities of multiple candidate wireless networks; The security capability gap analysis module is used to compare the security requirements of the power service to be accessed with the security capabilities of each candidate wireless network item by item, determine the security capability gap, and classify the candidate network types. The security control configuration module is used to configure additional security measures for networks with compensable security capabilities, and to form candidate secure access paths. The access path verification and evaluation module is used to verify whether each candidate secure access path meets the communication requirements and to perform a comprehensive evaluation to determine the target secure access path. The access authorization generation module is used to generate access authorization information based on the target secure access path; The secure access execution module is used to execute the security measures corresponding to the target secure access path and establish a communication connection. The status monitoring and update module is used to continuously monitor the communication and security status of the target wireless network, and trigger the re-execution of secure access path selection when the current access path no longer meets the service requirements.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-8.

Images