Power encryption attack behavior risk assessment method based on qkd security boundary big data

Abstract

The application discloses a power encryption attack behavior risk assessment method based on QKD security boundary big data, which comprises the following steps: constructing a historical big data set containing the whole process characteristics of QKD key generation and distribution; configuring a differentiated encryption strategy set for the regulation and control type and the collection type devices with different functions in the power system; matching and comparing the encryption strategy execution data and the associated QKD link state data collected in real time with the risk assessment benchmark model constructed based on the historical big data; calculating the deviation degree of the encryption state of the device relative to the historical security benchmark to generate a device-level risk quantitative value; and finally, combining the function weight of the device in the system, performing weighted synthesis, and outputting a global encryption attack behavior risk assessment report. In this way, the application realizes the fine and quantitative evaluation of the heterogeneous encryption strategy execution risk of the power system under the dynamic QKD security boundary.

Description

Technical Field

[0001] This application relates to the field of power system network security technology, and in particular to a risk assessment method for power encryption attack behavior based on QKD security boundary big data. Background Technology

[0002] As the power system accelerates its evolution towards digitalization and networking, power production control and business management rely heavily on encrypted communication to ensure the confidentiality and integrity of instructions and data. With the development of advanced technologies such as quantum computing, traditional encryption systems face potential threats. Quantum Key Distribution (QKD) technology, due to its theoretical absolute security, has begun to be piloted in high-security communication links in the power industry. In practical engineering applications, the actual security performance of QKD is affected by various dynamic factors such as quantum channel quality, device status, and network topology, and its effective security boundary is not fixed. At the same time, the types of equipment in power systems are diverse, ranging from real-time control equipment to data acquisition terminals, with significant differences in their business characteristics and security requirements. Consequently, the encryption strategies deployed, such as algorithms and key update mechanisms, also vary. Most existing security assessment methods focus on the direct detection of network attack events or static compliance checks of the encryption system itself. It is difficult to conduct a correlated and forward-looking quantitative assessment of the attack risks of the overall defense system composed of different encryption strategies implemented by various power devices under complex and dynamic QKD security boundary conditions.

[0003] Furthermore, existing risk assessment methods typically treat encryption systems as black boxes or static configurations, lacking in-depth analysis of the intrinsic correlation between the execution process of encryption strategies, such as the actual lifespan of keys, algorithm computational load, and the real-time performance status of the underlying QKD link. This results in risk assessments often lagging behind the development of attack behavior, failing to provide effective risk warnings before attackers actually exploit encryption weaknesses or QKD boundaries shrink. In addition, existing technologies lack a unified and quantifiable assessment framework to measure the relative security and vulnerability of different functional devices such as control and data acquisition in power systems, making it difficult for security managers to accurately locate the most vulnerable encryption links in the system.

[0004] Therefore, there is an urgent need for a dynamic risk assessment method that can fully utilize the complete state data generated during the operation of the QKD system, combined with the differences in power equipment types and the heterogeneous characteristics of encryption strategies, in order to achieve a refined and quantitative assessment of the encryption attack risk of the power system, provide data support for the adjustment of proactive defense strategies, and make up for the shortcomings of existing technologies in dynamic correlation risk assessment. Summary of the Invention

[0005] To achieve the above objectives, the technical solution of this invention is as follows: This invention provides a method for risk assessment of power system encryption attack behavior based on QKD security boundary big data, including: constructing a QKD security boundary big data set for a power system; identifying and determining at least two different types of power equipment to be assessed within the target power system; configuring encryption policy sets adapted to the business security requirements of each of the at least two different types of power equipment to be assessed; real-time monitoring and acquisition of the actual encryption policy execution data adopted by the power equipment to be assessed under the current operating state of the target power system, as well as the QKD communication link status data associated with the encrypted communication of the power equipment to be assessed; and constructing a risk assessment method based on the QKD security boundary big data set. The baseline model defines the baseline risk level corresponding to different encryption strategy execution data under specific QKD communication link state data. The acquired encryption strategy execution data and QKD communication link state data are matched and compared with the risk assessment baseline model. Based on the comparison analysis results, an independent device encryption risk quantification value is calculated for each power device to be assessed. The device encryption risk quantification value reflects the degree to which the corresponding device deviates from the historical security baseline under the current encryption strategy and QKD link state. The device encryption risk quantification values ​​of all power devices to be assessed in the target power system are combined with the functional weight of each device in the power system to generate a global encryption attack risk assessment report for the target power system.

[0006] In some possible implementations, the QKD security boundary big data set includes historical and real-time QKD key generation and distribution process characteristic data related to the power communication network; the different types of power equipment to be evaluated include at least a first type of equipment used for issuing control commands and a second type of equipment used for collecting data transmission; a first encryption strategy set is configured for the first type of equipment, and a second encryption strategy set is configured for the second type of equipment, wherein the first encryption strategy set and the second encryption strategy set differ in at least one aspect of encryption algorithm type, key update frequency, or encryption data granularity.

[0007] In some possible implementations, the characteristic data of the QKD key generation and distribution process includes the time series of the success rate of single key generation of QKD devices, the fluctuation data of the quantum channel bit error rate, the data of the authentication channel interaction delay, and the data of the final effective key distribution rate; the QKD security boundary big data set is divided into multiple continuous or non-continuous data subsets through time windows, and each data subset is associated with the power system operation status label of the corresponding historical time period.

[0008] In some possible implementations, for the first type of device, the first encryption policy set contains at least two alternative encryption policies, each of which is uniquely determined by an encryption algorithm identifier, working mode, initialization vector generation rule, and key lifecycle threshold. The encryption algorithm identifier is selected from a predefined list of strong encryption algorithms, and the key lifecycle threshold is dynamically adjusted based on the maximum allowable delay of the first type of device's processing instructions and the importance level of the instructions. For the second type of device, the second encryption policy set contains at least two alternative encryption policies, each of which is uniquely determined by a stream encryption algorithm identifier, a key stream synchronization mechanism, and a key update triggering condition based on packet count. The key stream synchronization mechanism includes timestamp-based synchronization and sequence number-based synchronization, and the key update triggering condition is set based on the data sampling frequency of the second type of device and historical network congestion data. A binding mapping relationship is established between the first type of device and the first encryption policy set, and between the second type of device and the second encryption policy set. The binding mapping relationship and the description information of the alternative encryption policies in each encryption policy set are stored in the security policy configuration library of the target power system being evaluated.

[0009] In some possible implementations, a risk assessment benchmark model is constructed based on a QKD security boundary big data set. This includes: performing structural analysis on the QKD security boundary big data set to extract a QKD communication link state benchmark feature set as a model condition dimension, and an encryption policy execution benchmark feature set as a model evaluation dimension. The QKD communication link state benchmark feature set includes at least the quantum bit error rate distribution range, synchronization clock stability level, and key relay hop count. The encryption policy execution benchmark feature set includes at least the strength identifier of the actual encryption algorithm used, the actual key lifespan, and the encryption operation processor utilization rate. In the feature space spanned by the condition dimension feature sets, multiple discrete benchmark state units are divided according to the historical data distribution density. Each benchmark state unit consists of a set of condition dimension feature values. The range is defined by the combination of data points. For each baseline state unit, the distribution of encryption policy execution baseline feature values ​​among all historical data instances belonging to the corresponding baseline state unit is statistically analyzed. Based on this distribution, baseline risk level labels are assigned to different combinations of encryption policy execution baseline feature values. The basis for the division of baseline risk level labels is the frequency and severity of historical abnormal events associated with different combinations of encryption policy execution feature values ​​within the same baseline state unit. All baseline state units, the statistical results of the distribution of corresponding encryption policy execution baseline feature values, and the assigned baseline risk level labels are correlated and integrated to form a risk assessment baseline model. The risk assessment baseline model has the function of mapping and querying from any set of input QKD communication link status data and encryption policy execution data to the corresponding baseline risk level.

[0010] In some possible implementations, the encryption policy execution data includes the identifier of the encryption policy currently actually activated by the power device to be evaluated, the time interval since the last key update, the number of encrypted data units processed, and the time taken for the most recent encryption operation; the QKD communication link status data includes the current quantum error rate of the QKD link that provides key services for the corresponding power device to be evaluated, the current key generation rate, and the current key synchronization status flag.

[0011] In some possible implementations, the acquired encryption policy execution data and QKD communication link status data are matched and compared with the risk assessment benchmark model. This includes: locating the benchmark state unit that matches the current state in the risk assessment benchmark model based on the acquired current QKD communication link status data; and comparing the current encryption policy execution data with the distribution of encryption policy execution benchmark feature values ​​statistically obtained within the benchmark state unit to determine the relative position of the current encryption policy execution data in the corresponding historical distribution.

[0012] In some possible implementations, based on the comparative analysis results, an independent device encryption risk quantification value is calculated for each power device to be evaluated. This includes: calculating the device encryption risk quantification value by weighting the statistical percentile of the current encryption policy execution data within the matched baseline state unit and the numerical representation of the baseline risk level label associated with the corresponding position. The higher the device encryption risk quantification value, the further the encryption state of the corresponding device deviates from the historical security baseline under the current QKD link state.

[0013] In some possible implementations, generating a global encryption attack risk assessment report for the target power system specifically includes: obtaining the topology and business logic information of the target power system; assigning system function weight coefficients to each power device to be assessed; the weight coefficients reflect the relative importance of the corresponding device in maintaining the steady-state operation of the power system and ensuring the continuity of critical services, and the determination criteria include device type, device connectivity in the topology, and the criticality level of the services carried by the device; based on the device encryption risk quantification value of each power device to be assessed and its corresponding system function weight coefficient, a weighted aggregation algorithm is used to calculate the target power system's encryption attack risk assessment report. The system employs a comprehensive global risk index. All power equipment to be assessed is sorted in descending order of its encryption risk quantification value, identifying the top N devices as a set of high-risk devices. The system analyzes the type distribution of devices within this set, the characteristics of their encryption strategies, and the commonalities in the QKD link states associated with those devices, generating a preliminary risk cause analysis summary. Integrating the comprehensive global risk index, the list of high-risk devices and their detailed risk data, along with the preliminary risk cause analysis summary, a structured global encryption attack risk assessment report is generated according to a predefined report template. The report also includes operational suggestions based on the current global risk level.

[0014] In some possible implementations, the above method also includes: after generating the assessment report, the current encryption policy execution data, QKD communication link status data, calculated device encryption risk quantification value and final assessment report obtained in this assessment are anonymized and fed back as new sample data and expanded into the QKD security boundary big data set for subsequent iterative updates of the risk assessment benchmark model.

[0015] One or more technical solutions provided in the embodiments of the present invention have at least the following technical effects or advantages: In this embodiment of the invention, a historical big data set containing the characteristics of the entire QKD key generation and distribution process is constructed; differentiated encryption strategy sets are configured for control and acquisition devices with different functions in the power system; real-time data collection of device encryption strategy execution and associated QKD link status is used to match and compare with a risk assessment benchmark model built based on historical big data; the degree of deviation of the device's encryption status from the historical security benchmark is calculated to generate a device-level risk quantification value; finally, a weighted comprehensive analysis is performed based on the device's functional weight in the system to output a global encryption attack risk assessment report. Thus, this invention achieves a refined and quantitative assessment of the risk of heterogeneous encryption strategy execution in the power system under dynamic QKD security boundaries. Attached Figure Description

[0016] To more clearly illustrate the embodiments of the present invention, the accompanying drawings used in the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic flowchart of an embodiment of a power encryption attack risk assessment method based on QKD security boundary big data, provided by an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0019] In the relevant descriptions of this embodiment, the terms "including," "containing," and "possessing" are all open terms and are generally understood to include but not be limited to; the term "at least one" is generally understood to mean one or more, where "multiple" refers to two or more; the term "at least one of the following" or similar expressions refer to any combination of these items, including any combination of single or multiple items, for example, "at least one of a, b, or c", or "at least one of a, b, and c", which can all mean: a, b, c, ab (i.e., a and b), ac, bc, or abc, where a, b, and c can be single or multiple; the symbol "A / B" is used to describe the selection relationship of associated objects, generally indicating an "or" relationship.

[0020] In the following description of the embodiments, the terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the application. The singular forms "a" and "the" as used in the embodiments of this application and the appended claims are also intended to include the plural forms, unless the context clearly indicates otherwise.

[0021] Those skilled in the art should understand that, in the following description of the embodiments of this application, the sequence of numbers does not imply the order of execution. Some or all steps may be executed in parallel or sequentially. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0022] Those skilled in the art will understand that the numerical ranges in the embodiments of this application should be understood to specifically disclose each intermediate value between the upper and lower limits of the range. Any stated value or intermediate value within a stated range, as well as any other stated value or each smaller range between intermediate values ​​within a range, are also included within this invention. The upper and lower limits of these smaller ranges may be independently included or excluded from the range.

[0023] Unless otherwise stated, the technical / scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. While this application describes only preferred methods and materials, any methods and materials similar or equivalent to those described herein may be used in the implementation or testing of this application. All references to this specification are incorporated by way of citation to disclose and describe the methods and / or materials associated with those references. In the event of any conflict with any incorporated reference, the content of this specification shall prevail.

[0024] To illustrate the technical solution of the present invention, specific embodiments are described below.

[0025] Figure 1 A schematic flowchart illustrating an embodiment of a power encryption attack risk assessment method based on QKD security boundary big data provided by this invention is shown below. Figure 1 As shown, the above method may include: S10: Construct a large dataset of quantum key distribution (QKD) security boundaries for power systems; In some embodiments, the QKD security boundary big data set includes historical and real-time QKD key generation and distribution process feature data related to power communication networks.

[0026] Specifically, in this embodiment of the invention, the operation data of the entire process of key generation, negotiation and distribution is continuously collected from the QKD transceiver equipment, key relay nodes and supporting quantum key management system deployed in the target power communication network, and historical accumulated data and real-time incremental data are synchronously incorporated to form the original time-series data source.

[0027] The QKD key generation and distribution process characteristic data includes at least four core parameters: The first is the time series of the single key generation success rate of the QKD device, which records the execution results of each key negotiation attempt in timestamp order, and is used to characterize the temporal fluctuation characteristics of the quantum physical layer key generation capability; the second is the quantum channel bit error rate fluctuation data, which records the real-time bit error rate value during the quantum bit transmission process in time series form, and is used to reflect the dynamic changes in quantum channel quality and the fluctuation of security boundaries; the third is the authentication channel interaction delay data, which records the message round-trip delay and the number of authentication message retransmissions of the classical authentication channel, and is used to characterize the communication reliability and timeliness performance of the key negotiation process; the fourth is the final effective key distribution rate data, which records the amount of usable shared key generated per unit time after error correction and privacy amplification processing, and is used to quantify the actual key supply capacity that the QKD system can provide to the power industry.

[0028] In some embodiments, the QKD security boundary big data set is divided into multiple continuous or non-continuous data subsets by time windows, and each data subset is associated with a power system operation status label for a corresponding historical time period.

[0029] Specifically, in this embodiment, the specific content and structured organization of the characteristic data of the QKD key generation and distribution process are as follows: The first category is quantum physical layer parameters, including but not limited to: the success or failure flags of each attempt to generate a key between the QKD transmitter and receiver recorded in time series form, and the corresponding quantum channel bit error rate value when the key is successfully generated; the second category is negotiation and authentication layer parameters, including the round-trip communication delay data of the classical authentication channel during the quantum key negotiation process, and the statistics of the number of authentication message retransmissions; the third category is key output layer parameters, that is, the generation rate sequence of the effective key that the system finally outputs and can be used for encrypted communication, in bits per second.

[0030] When constructing large datasets, these parameters are synchronized and aligned according to a unified time source. Dividing the data into multiple continuous or non-continuous subsets using time windows means extracting segments from the continuous raw data stream using sliding windows or fixed-interval sampling. For example, a sliding window of 5 minutes with a step size of 1 minute is defined, and data is extracted sequentially. Each extracted data subset contains a statistical summary of all parameters within the 5-minute window, such as maximum, minimum, mean, variance, and the sampling points of the original sequence. Associating a power system operation status label with a historical time period means retrieving records that completely correspond to the 5-minute window time in the power system security information and event management SIEM system or log auditing system. If the log shows that a penetration test alarm for encrypted communication, an abnormal key consumption alarm, or an encryption-related communication interruption event occurred during that time period, the data subset is labeled as abnormal; otherwise, it is labeled as normal. This label serves as the historical truth corresponding to this set of data.

[0031] All data subsets carrying operational status tags are structured and archived for storage, ultimately forming a complete QKD security boundary big data set for the power system.

[0032] S20, For the target power system, identify and determine at least two different types of power equipment to be evaluated; In some embodiments, the different types of power equipment to be evaluated include at least a first type of equipment for issuing control commands and a second type of equipment for collecting data transmissions.

[0033] Specifically, the process involves obtaining the network topology configuration file, equipment asset list, and production, operation, and maintenance procedures of the target power system. By traversing all secondary power equipment with encrypted communication capabilities within the system, key equipment responsible for core business interactions and relying on QKD quantum keys for encryption protection is identified, forming an initial list of equipment to be evaluated. Then, based on the core functional positioning, data interaction characteristics, and business security level requirements of the equipment in various stages of power production, transmission, dispatch, and distribution, the power equipment in the initial list is divided into at least two distinct types, with the classification results corresponding one-to-one with the equipment's business security requirements.

[0034] The first type of equipment is control equipment that undertakes real-time regulation and protection control functions. Typical examples include relay protection devices, measurement and control units, and dispatch master station control terminals in substations. This type of equipment is responsible for issuing control commands and executing protection logic. Its services have high real-time performance and high reliability. The control commands it transmits directly affect the steady-state operation of the power grid, and it has high requirements for the security and latency sensitivity of encrypted communication.

[0035] The second category of equipment consists of data acquisition devices that perform operational data collection and transmission functions. Typical examples include smart meters on the distribution side, power grid status monitoring sensors, and distributed energy acquisition terminals. This type of equipment is responsible for periodically collecting power grid operation data and equipment status data and uploading them to the higher-level system. The business is characterized by large data volume, fixed sampling frequency, and limited terminal computing resources, and has high requirements for the resource overhead and transmission efficiency of encrypted communication.

[0036] After the equipment classification is completed, a unique equipment identifier and corresponding type label can be assigned to each power equipment to be evaluated, forming a structured list of equipment to be evaluated. The list simultaneously records the basic attributes of the equipment, such as its physical location, business domain, and associated communication links.

[0037] S30, for at least two different types of power equipment to be evaluated, configure a set of encryption policies that are adapted to the business security requirements of each type of equipment; In some embodiments, a first encryption policy set is configured for a first type of device, and a second encryption policy set is configured for a second type of device. The first encryption policy set and the second encryption policy set differ in at least one aspect, such as encryption algorithm type, key update frequency, or encryption data granularity.

[0038] In this embodiment of the invention, step S30 includes the following steps: S301, for the first type of device, the first encryption strategy set contains at least two alternative encryption strategies. Each alternative encryption strategy is uniquely determined by an encryption algorithm identifier, working mode, initialization vector generation rule, and key lifecycle threshold. The encryption algorithm identifier can be selected from a predefined list of strong encryption algorithms. The key lifecycle threshold is dynamically adjusted according to the maximum allowable delay of the instruction processed by the first type of device and the importance level of the instruction. S302, For the second type of device, the second encryption strategy set includes at least two alternative encryption strategies. Each alternative encryption strategy is uniquely determined by a stream encryption algorithm identifier, a key stream synchronization mechanism, and a key update triggering condition based on packet count. The key stream synchronization mechanism includes timestamp-based synchronization and sequence number-based synchronization. The key update triggering condition is set according to the data sampling frequency of the second type of device and network congestion history data. S303, establish the binding mapping relationship between the first type of device and the first encryption policy set, and between the second type of device and the second encryption policy set, and store the binding mapping relationship and the description information of the alternative encryption policies in each encryption policy set in the security policy configuration library of the target power system being evaluated.

[0039] In this embodiment, for the first type of equipment control equipment, the construction of its first encryption strategy set follows the principles of high security and controllable latency. This set is a strategy list containing at least two options. Each strategy in the list is a complete configuration package, which must explicitly specify the following four elements, and the combination of these four elements uniquely identifies a strategy: Element 1 is the encryption algorithm identifier, which must be selected from a predefined list of strong encryption algorithms certified by the power industry, such as options like AES-256-GCM and SM4-CTR. Element 2 is the working mode, explicitly specifying the block cipher mode used, such as GCM used to provide both encryption and integrity authentication. Element 3 is the initialization vector generation rule, specifying the method for generating the initialization vector used for the encryption algorithm, such as requiring the use of truly random numbers generated by the hardware security module HSM. The fourth element is the key lifecycle threshold, which is a dynamically determined value based on the device's operating parameters: First, the maximum end-to-end delay T_max allowed by the device to process the highest priority control command is obtained; second, the number N of such critical commands allowed within a key lifecycle is determined according to the preset importance level of the command; finally, the key lifecycle threshold is set to T_max / N or a conservative value calculated based on this to ensure that there is sufficient time to complete the encrypted transmission and execution of critical commands before the key expires.

[0040] For the second type of equipment, which involves data acquisition and transmission, the construction of its second encryption strategy set follows the principles of high efficiency and low overhead. This set can also be a strategy list containing at least two options. Each strategy configuration package in the list is uniquely determined by the following three elements: Element 1 is the stream encryption algorithm identifier, specifying the stream cipher algorithm used, such as ChaCha20 or ZUC; Element 2 is the key stream synchronization mechanism, defining the specific protocol for maintaining key stream synchronization between the encryption and decryption ends. Options may include timestamp synchronization based on the High Precision Network Time Protocol (NTP) or synchronization based on the auto-incrementing sequence number in each data packet header, and specifying the recovery process in case of synchronization failure; Element 3 is the key update trigger condition based on data packet count, setting a specific count value K. When the cumulative number of data packets encrypted and transmitted using the current key reaches K, the system must trigger the key update process. The setting of the value K needs to refer to the data sampling frequency of the device, such as the number of samples per second, and the historical average communication quality of the network area where the device is located, such as the average duration of no packet loss. The goal is to match the key update frequency with the network's reliable transmission window and avoid complex key switching during periods of frequent packet loss and retransmission.

[0041] After defining the policy sets, a static binding relationship is established between the devices and the policy sets. This process is implemented through configuration on the security policy management platform for the target power system. In the platform, the administrator associates device type identifiers, such as Type_A_Controller, with a pre-edited first encryption policy set configuration file; and associates another device type identifier, such as Type_B_Sensor, with a second encryption policy set configuration file. The platform maintains a security policy configuration library, which not only stores these binding relationships but also stores detailed descriptions of all alternative policies within each encryption policy set in structured data formats such as XML or JSON. This includes all the aforementioned technical parameters and configuration options. When performing risk assessments, the system reads information from this configuration library as the basis for determining the appropriate encryption policy for each device.

[0042] S40, real-time monitoring and acquisition of the actual encryption strategy execution data of the power equipment under evaluation under the current operating status of the target power system, as well as the QKD communication link status data associated with the encrypted communication of the power equipment under evaluation; Specifically, during the operation of the target power system, a real-time monitoring process can be initiated. This process collects two core input data points by calling the device management interface and security probes: first, the currently effective encryption policy parameters and their operational metrics for each power device to be evaluated; and second, the real-time performance readings of the QKD link providing quantum keys to these devices. The encryption policy parameters include the specific policy number currently in use, the time or amount of data used for the current key, and the latency of recent encryption operations. The QKD link status data includes the real-time quantum bit error rate, key generation rate, and link connection status flags. This data is encapsulated and cached in time sequence as a snapshot of the current system state.

[0043] In some embodiments, the encryption policy execution data includes the identifier of the encryption policy currently actually activated by the power equipment to be evaluated, the time interval since the last key update, the number of encrypted data units processed, and the time taken for the most recent encryption operation. QKD communication link status data includes the current quantum error rate, current key generation rate, and current key synchronization status flag of the QKD link that provides key services for the corresponding power equipment to be evaluated.

[0044] For example, this can be achieved through a lightweight agent deployed locally on the power equipment or on a critical network node; the agent collects the following four specific pieces of information by calling secure APIs provided by the device's operating system or by directly reading specific configuration registers: The currently active encryption policy identifier: This is a unique ID corresponding to a record in the policy configuration library, used to determine which specific encryption scheme the device is running; The cumulative time interval since the last successful key update: records the precise time difference from the completion time of the most recent key update operation to the current time; The number of discrete data units that have been successfully encrypted or decrypted since the last key update: a data unit can be a fixed-size data block or a complete message defined by the application layer; The time taken for the most recent encryption operation: Records the CPU clock cycles or actual time consumed by the device processor to complete the most recent encryption operation. This data is sampled and cached periodically by the agent program, such as every second. The QKD communication link status data is obtained by querying the real-time status interface of the QKD network management system. For each power device communication session using quantum keys, the management system provides the following real-time readings for its corresponding QKD link: Current quantum bit error rate: the percentage of bit errors measured in real time by the QKD receiver.

[0045] Current key generation rate: The average number of shared key bits generated per second by the QKD device in the most recent statistical period.

[0046] Current key synchronization status flag: A boolean or enumerated value indicating whether the key pools of both parties in QKD communication are currently in a synchronized and available state, such as synchronized, in synchronization, or synchronization lost. The monitoring process pulls data from the above two sources at fixed intervals and performs time alignment to form a complete current status record.

[0047] S50, based on the QKD security boundary big data set, constructs a risk assessment benchmark model, defining the benchmark risk level corresponding to different encryption strategy execution data under specific QKD communication link state data; The risk assessment benchmark model is constructed as follows: First, two key features are extracted from historical data: one describes the QKD link state condition dimension, and the other describes the evaluation dimension of the execution of encryption strategies adopted in the same historical period. Then, in the space formed by the condition dimension features, multiple representative benchmark state regions are manually or by rules based on the natural aggregation of historical data. Next, for each benchmark state region, all historical moments falling into that region are traced back, and the correlation between the execution characteristics of various encryption strategies adopted in these specific QKD states, such as whether key updates are timely and whether algorithm strength is sufficient, and whether a security event ultimately occurs is analyzed. Finally, based on this correlation, a benchmark risk level is assigned to the execution of encryption strategies with different characteristics in a given QKD state. The entire model is essentially a multi-level query mapping table, whose inputs are QKD states and encryption execution data, and whose output is the corresponding historical experience risk level.

[0048] Based on this, in some embodiments, step S50 above may include: S501 performs structural analysis on the QKD security boundary big data set, extracting the QKD communication link state benchmark feature set as the model condition dimension, and the encryption strategy execution benchmark feature set as the model evaluation dimension; the QKD communication link state benchmark feature set includes at least the quantum bit error rate distribution range, the synchronization clock stability level, and the key relay hop count, and the encryption strategy execution benchmark feature set includes at least the strength identifier of the actual encryption algorithm used, the actual key lifespan, and the processor utilization rate of encryption operations; S502, in the feature space spanned by the conditional dimension feature set, multiple discrete reference state units are divided according to the distribution density of historical data. Each reference state unit is defined by a combination of ranges of a set of conditional dimension feature values. S503, for each baseline state unit, the distribution of encryption policy execution baseline feature values ​​among all historical data instances belonging to the corresponding baseline state unit is statistically analyzed, and baseline risk level labels are assigned to different combinations of encryption policy execution baseline feature values ​​based on the distribution. The basis for dividing the baseline risk level labels is the frequency and severity of historical abnormal events associated with different combinations of encryption policy execution feature values ​​within the same baseline state unit. S504 integrates all baseline state units, the corresponding encryption policy execution baseline feature value distribution statistics, and the assigned baseline risk level labels to form a risk assessment baseline model. The risk assessment baseline model has the function of mapping and querying from any set of input QKD communication link state data and encryption policy execution data to the corresponding baseline risk level.

[0049] In this embodiment, feature engineering analysis is performed on the QKD security boundary big data set to extract two types of benchmark features for modeling. The first type is the QKD communication link state benchmark feature set, which serves as a model judgment condition. By analyzing parameters strongly correlated with QKD performance in historical data, several dimensions with the strongest discriminative power are selected, such as: a) the quantum bit error rate distribution range: the continuous bit error rate values ​​are discretized into three levels: low <2%, medium 2%-5%, and high >5%; b) the synchronization clock stability level: based on the clock offset variance data reported by the QKD device, it is divided into three levels: stable, normal, and fluctuating. Level; c. Key relay hop count: records the number of relay nodes the key passes through from the generator to the user, with values ​​of 0, 1, 2, etc.; The second category is the set of benchmark features for the encryption policy execution of the evaluated object, which extracts features reflecting the quality of policy execution from the historical encryption-related logs, such as: d. Actual encryption algorithm strength identifier: mapped to high strength, standard strength, etc., according to the algorithm directory; e. Actual key lifespan: records the actual time from when the key is put into use to when it is replaced; f. Encryption operation processor utilization rate: the average percentage of the device CPU load when performing encryption operations.

[0050] Within the feature space spanned by the three features a, b, and c established by S501, spatial partitioning is performed. The partitioning is based on the clustering of historical data instances in this space, using a rule-based partitioning method. For example, the three levels of feature a, the three levels of feature b, and several values ​​of feature c are combined to form multiple baseline state units such as low bit error rate, stable clock, and zero hops. Each unit is essentially a multi-dimensional cube or hypercube, defined by a combination of a range of values ​​for each condition feature. All historical data instances are classified into a specific baseline state unit based on their own condition feature values.

[0051] For each defined baseline state unit, statistical analysis is performed within the unit. First, all historical data instances belonging to that unit are identified. Then, the numerical distribution of the encryption policy execution baseline features (d, e, f) of these instances is analyzed. For example, statistics are compiled on the historical proportion of cases where high-strength algorithms were used under the specific QKD state represented by that unit, the 25th, 50th, and 75th percentiles of key lifetime, and the main range of processor utilization. Based on these statistical distributions and combined with the normal / abnormal state labels attached to each instance within the unit, correlation analysis is performed. Specifically, under the same QKD state, when the encryption execution characteristics are in different intervals, such as the interval where the key survival time exceeds the 75th percentile, we examine whether the frequency of the corresponding historical anomalies increases significantly, and the average severity level of the events. Based on this correlation analysis, we assign a baseline risk level label, such as low risk, medium risk, and high risk, to different combinations of encryption strategy execution characteristics or the intervals in which they are located. This process is essentially summarizing and labeling historical experience.

[0052] The above-mentioned construction results are systematically integrated to form a queryable risk assessment benchmark model. The storage structure of this model in the computer can be a multi-layered nested dictionary or database table, with the outermost layer using the unique code of the benchmark state unit as the key. Each key-value pair stores the conditional feature range definition of the unit, a detailed distribution statistics table of its historical encryption execution features including quantiles, frequency histograms, etc., and a lookup table mapping the encryption execution feature intervals to the benchmark risk level. Finally, the function provided by this model is: when a new set of QKD state data and encryption execution data is input, the model first matches the corresponding benchmark state unit according to the QKD state data, and then queries the lookup table in the unit according to the encryption execution data, thereby outputting a corresponding historical benchmark risk level.

[0053] S60, the acquired encryption strategy execution data and QKD communication link status data are matched and compared with the risk assessment benchmark model; Specifically, the real-time monitoring data obtained in step S40 is input into the risk assessment benchmark model constructed in step S50 for comparative analysis. The specific operation is as follows: First, the QKD link state feature value is extracted from the current data. In the condition dimension space of the model, the benchmark state region to which the current state belongs is located through feature value matching. Then, the encryption policy execution feature value in the current data is extracted and compared one by one with the historical encryption policy execution feature distribution stored in the benchmark state region to determine the position of the current encryption execution feature relative to the median or optimal value of the historical distribution. For example, is it within the feature range of historical good security performance, or has it deviated to the edge of the range of historical poor performance?

[0054] Based on this, step S60 above may include the following steps: S601, Based on the acquired current QKD communication link status data, locate the benchmark status unit that matches the current status in the risk assessment benchmark model; S602, compare the current encryption policy execution data with the distribution of encryption policy execution baseline feature values ​​statistically obtained within the baseline state unit, and determine the relative position of the current encryption policy execution data in the corresponding historical distribution.

[0055] In this embodiment, the specific execution process of matching and comparison analysis is as follows: First, state matching is performed, and QKD communication link state feature values ​​are extracted from the current real-time monitoring data, such as the current quantum error rate, synchronization clock stability (which can be deduced from the device state), and key relay hop count. These feature values ​​are processed according to the discretization rules defined in step S501. For example, the current quantum error rate of 5.2% is mapped to a high level. Then, the processed feature value combination, such as high, general, 1, is used as the query key to search in the risk assessment benchmark model constructed in step S50. The model searches for units whose condition feature range can completely cover the current input feature value among all the benchmark state units stored in itself. For example, the current state of high, general, 1 will match the benchmark state unit defined in the model as high error rate, general stability, and 1 hop. This unit is the benchmark reference that matches the current state.

[0056] Secondly, feature comparison is performed; after successfully matching the baseline state unit, the encryption strategy execution feature values ​​in the current real-time monitoring data are extracted, namely the encryption algorithm strength, the actual key lifespan, the processor utilization rate, etc.

[0057] Next, the statistical information on the distribution of encryption policy execution baseline feature values ​​stored in the baseline state unit of the model is accessed, and the current feature value is compared with these historical distributions. For example, the current actual key lifespan value is compared with the 25th, 50th, and 75th percentiles of the historical key lifespan of this unit to determine whether the current value is below the 25th percentile (i.e., fresher than most historical cases), between the 25th and 75th percentiles, or above the 75th percentile (i.e., older than most historical cases). This comparison determines the relative position of the current encryption execution state in this specific QKD historical context: whether it is better than the historical norm, within the normal range, or worse than the historical norm.

[0058] S70. Based on the comparative analysis results, an independent device encryption risk quantification value is calculated and generated for each power device to be evaluated. The device encryption risk quantification value reflects the degree to which the corresponding device deviates from the historical security benchmark under the current encryption strategy and QKD link state. Specifically, based on the comparison and analysis results of step S60, a quantified risk score is calculated for each power device to be evaluated. The calculation logic of this score is based on the degree of deviation of the current encryption strategy execution characteristics from the historical benchmark in its QKD state. If the current encryption execution characteristics fall completely within the feature range of the best historical security performance, the risk score is the lowest. If its feature value deviates significantly from the historical security range, for example, the key usage time far exceeds the historical security threshold, the risk score will increase linearly or non-linearly depending on the distance and direction of the deviation. Finally, an independent quantified risk value is output for each device.

[0059] Based on this, in this embodiment of the invention, step S70 may specifically include: calculating the device encryption risk quantification value by weighting the statistical percentile of the location of the current encryption policy execution data within the matched baseline state unit and the numerical representation of the baseline risk level label associated with that location. The higher the quantization value, the further the current device encryption state deviates from the historical security benchmark of the QKD link state.

[0060] In the above embodiments, the specific quantification logic for calculating and generating an independent device encryption risk quantification value is as follows: The calculation of this quantification value is a mapping and synthesis process based on the comparison results. First, for each encryption strategy, a baseline feature such as key lifespan is performed, and a basic sub-score is assigned according to its relative position relative to the historical distribution determined in step S60.

[0061] For example, define a mapping rule: if the feature value is within the normal range of 25%-75% of the historical distribution, the base score is 0, indicating no deviation risk; if it is below the 25th percentile, a negative score indicates the state is too fresh, possibly indicating abnormally frequent key updates, but this situation has low risk and can be assigned -10; if it is above the 75th percentile, a positive score indicates the state is worse than normal, such as the key being too old, and the score increases linearly or stepwise with the degree of deviation. For example, between the 75%-90th percentile, the score is 50; above the 90th percentile, the score is 100; secondly, obtain Take the baseline risk level label corresponding to the historical feature interval that is closest to the current combination of encryption execution features within the baseline state unit matched in step S60. Convert this label numerically; for example, low risk is converted to a coefficient of 1.0, medium risk to a coefficient of 1.5, and high risk to a coefficient of 2.0. This coefficient serves as a risk amplifier. Finally, the basic scores of each encryption execution feature are weighted and summed to obtain an initial risk score. This initial risk score is then multiplied by the risk amplification coefficient mapped from the baseline risk level to obtain the device's encryption risk quantification value. Therefore, this quantification value reflects two pieces of information: first, the basic score of the deviation of the current encryption execution state from the historical norm; and second, the historical risk severity amplification coefficient associated with this deviation in the current specific QKD state.

[0062] S80 comprehensively evaluates the encryption risk quantification value of all power equipment to be evaluated in the power system, and generates a global encryption attack risk assessment report of the power system by combining the functional weight of each equipment in the power system.

[0063] Specifically, the individual risks of all devices to be evaluated are aggregated, and a system-level risk synthesis is performed in conjunction with the overall operating logic of the power system. First, based on each device's location in the power grid topology and the importance of its control or data services, a predefined weighting coefficient is assigned to it. Then, the quantified individual risk values ​​of all devices are weighted and calculated together with their respective weighting coefficients to obtain a global comprehensive risk index. Simultaneously, the devices with the highest individual risk rankings are listed as key risk targets. Finally, the global index, the list of high-risk devices, and their risk causal analysis (e.g., multiple high-risk devices are identified due to delayed key updates) are integrated to generate a structured assessment report. This report describes the overall status and weaknesses of the current system's encryption defense system relative to historical security benchmarks.

[0064] Based on this, in this embodiment of the invention, step S80 may specifically include: S801: Obtain the topology and business logic information of the target power system to be evaluated, and assign system function weight coefficients to each power equipment to be evaluated. The weight coefficients reflect the relative importance of the corresponding equipment in maintaining the steady-state operation of the power system and ensuring the continuity of key businesses. The determination basis includes the equipment type, the connectivity of the equipment in the topology, and the criticality level of the business carried by the equipment. S802, based on the equipment encryption risk quantification value of each power equipment to be evaluated and its corresponding system function weight coefficient, a weighted aggregation algorithm is used to calculate the global comprehensive risk index of the target power system to be evaluated; S803: Sort all power equipment to be evaluated in descending order according to the equipment encryption risk quantification value, and identify the N equipment with the highest risk quantification value as the set of high-risk equipment of concern. S804: Analyze the type distribution of devices in the high-risk concern device set, the characteristics of the encryption strategies adopted, and the commonalities of the QKD link status associated with the corresponding devices, and generate a preliminary risk cause analysis summary. S805 integrates the global comprehensive risk index, a list of high-risk devices and their detailed risk data, as well as a preliminary analysis summary of the causes of risks, and generates a structured global encryption attack risk assessment report according to a predefined report template; the report also includes operational suggestions based on the current global risk level.

[0065] In the above embodiments, the topology diagram and equipment function description documents of the target power system to be evaluated are imported from the power dispatch automation system or the power grid management information system. Based on this information, a weight coefficient is calculated for each power device to be evaluated in the list. The calculation process follows a predefined set of rules: Rule 1, assigning a basic weight according to the device type, for example, the basic weight of the first type of control device is higher than that of the second type of acquisition device; Rule 2, analyzing the connectivity of the device in the network topology, i.e., the number of communication links directly connected to it. The higher the connectivity of the device, the greater the potential impact of its failure or attack. Therefore, its weight correction value is increased according to the connectivity number; Rule 3, determining the criticality level of the business carried by the device according to its role in the power business logic, such as involving the stability of the entire network, involving regional power supply, or involving general monitoring, and setting a weight multiplier for each level. Combining the basic weight, connectivity correction, and criticality multiplier, the final system function weight coefficient of each device is calculated through a multiplication or addition model and normalized so that the sum of all weight coefficients is 1.

[0066] A weighted aggregation algorithm is used for calculation. The input of this algorithm is the quantified value of the device encryption risk R_i (i=1 to N) of all N power devices to be evaluated, and their corresponding system function weight coefficients W_i. The aggregation calculation adopts a weighted summation method, that is: global comprehensive risk index G=Σ(R_i*W_i), where the summation sign is from i to N. In addition, the algorithm also calculates the statistical characteristics of individual risk values, such as maximum value, average value and standard deviation, as auxiliary indicators. The calculated G value is a dimensionless numerical value, and its magnitude directly represents the comprehensive level of the entire system in terms of encryption attack risk. The higher the value, the higher the overall risk of the system.

[0067] After calculating the individual risk quantification value R_i for all devices, the system can sort these values ​​in descending order. Starting from the top of the sorted list, it selects the top M devices with the highest risk values. M can be a fixed number, such as 5 devices, or a percentage of the total number of devices, such as the top 10%. These M devices are marked as high-risk devices and form a separate list. The list can include not only the device ID, but also its risk quantification value, device type, physical location, or logical area.

[0068] The system performs cross-device correlation analysis on the identified list of high-risk devices, and the analysis dimensions may include: Type distribution, for example, what are the proportions of control and acquisition types among high-risk equipment; Common characteristics of encryption strategies, such as whether these high-risk devices generally use a specific encryption algorithm configuration that has been identified as high-risk by the model, or whether their key lifespan is generally too long; Common state characteristics of associated QKD links, such as whether the current quantum error rate of QKD links serving these high-risk devices is generally high.

[0069] Based on these commonalities, the system can automatically generate a text summary describing which type of device, encryption strategy behavior, or QKD link status the main risk points of the current system may originate from, thus providing administrators with preliminary clues for risk tracing.

[0070] The system can organize all the above results and information according to a predefined standard template to generate a final evaluation report; the report body can contain at least the following sections: The execution summary presents the overall comprehensive risk index G and its level range, such as low, medium, and high, in the form of text and key indicator dashboards. Detailed risk assessment results are presented in tabular form, listing the individual risk quantification values, rankings, and weighting coefficients of all equipment to be assessed. High-risk devices are highlighted, with a detailed list of high-risk devices and the main risk factors for each device, such as key timeout or insufficient algorithm strength. A summary of the risk causation analysis, presenting the text analysis results generated by S804; The operation suggestions section does not automatically execute commands. Instead, it retrieves and displays relevant text prompts from a pre-set suggestion library based on the current global risk level and main risk causes. For example, it may suggest prioritizing the inspection and shortening of key update cycles for high-risk control devices, or suggesting redundant configuration checks for encrypted communication of devices operating under high-error-rate QKD links. The report is output in electronic document format.

[0071] In some embodiments, after generating the evaluation report, the current encryption policy execution data, QKD communication link status data, calculated device encryption risk quantification value, and final evaluation report obtained in this evaluation can be anonymized and fed back as new sample data to expand the QKD security boundary big data set for subsequent iterative updates of the risk assessment benchmark model.

[0072] In this embodiment, after completing a full evaluation process, the method also includes a data feedback and knowledge accumulation step. Specifically, while generating and outputting the evaluation report in step S80, the system automatically packages all core data involved in the current evaluation cycle, from data collection to report generation, into a new evaluation instance data package. This data package includes: the time range identifier for this evaluation, aggregated statistical values ​​of encryption policy execution data sequences and QKD communication link status data sequences for all devices under evaluation during the monitoring period, calculated encryption risk quantification values ​​for each device, and the final global risk assessment conclusion of "normal" or "needs attention." After packaging, the system first anonymizes the data package, removing all sensitive information that could directly pinpoint specific power plants, substations, or unique device identifiers, retaining only technical characteristic data, calculated values, and typified labels. The processed anonymous data package is uploaded and added to the storage system of the QKD security boundary big data set in step S10 via a secure channel. This data package, as a new historical record with a result label, is integrated into the corresponding time partition of the big data set.

[0073] This process enables the continuous accumulation of operational experience in the assessment system, allowing the basic dataset to expand and be updated over time. Subsequently, when step S50 is re-executed based on this large dataset to update the risk assessment benchmark model, the experience data from this assessment can be used as new historical samples to participate in the model construction, thereby enabling the model to reflect the latest system operating status and risk patterns, and achieving incremental optimization of the assessment benchmark.

[0074] In this embodiment of the invention, a historical big data set containing the characteristics of the entire QKD key generation and distribution process is constructed; differentiated encryption strategy sets are configured for control and acquisition devices with different functions in the power system; real-time data collection of device encryption strategy execution and associated QKD link status is used to match and compare with a risk assessment benchmark model built based on historical big data; the degree of deviation of the device's encryption status from the historical security benchmark is calculated to generate a device-level risk quantification value; finally, a weighted comprehensive analysis is performed based on the device's functional weight in the system to output a global encryption attack risk assessment report. Thus, this invention achieves a refined and quantitative assessment of the risk of heterogeneous encryption strategy execution in the power system under dynamic QKD security boundaries.

[0075] The various embodiments in this specification are described in a progressive manner. For the same or similar parts between the various embodiments, please refer to each other. Each embodiment focuses on describing the differences from other embodiments.

[0076] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit this application. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of this application.

Claims

1. A method for risk assessment of power grid encryption attack behavior based on QKD security boundary big data, characterized in that, include: Construct a big data set for the security boundary of quantum key distribution (QKD) in power systems; For the target power system, identify and determine at least two different types of power equipment to be evaluated; For the at least two different types of power equipment to be evaluated, configure encryption policy sets that are adapted to the business security requirements of each type of equipment; Real-time monitoring and acquisition of the actual encryption strategy execution data of the power equipment under evaluation under the current operating status of the target power system, as well as the QKD communication link status data associated with the encrypted communication of the power equipment under evaluation; Based on the QKD security boundary big data set, a risk assessment benchmark model is constructed, defining the benchmark risk level corresponding to different encryption strategy execution data under specific QKD communication link state data; The acquired encryption strategy execution data and QKD communication link status data are matched and compared with the risk assessment benchmark model. Based on the comparative analysis results, an independent device encryption risk quantification value is calculated for each power device to be evaluated. The device encryption risk quantification value reflects the degree to which the corresponding device deviates from the historical security benchmark under the current encryption strategy and QKD link state. By combining the quantitative values ​​of the encryption risk of all power devices to be evaluated in the target power system with the functional weight of each device in the power system, a global encryption attack risk assessment report of the target power system is generated.

2. The method according to claim 1, characterized in that, The QKD security boundary big data set includes historical and real-time QKD key generation and distribution process feature data related to power communication networks; The different types of power equipment to be evaluated include at least a first type of equipment used for issuing control commands and a second type of equipment used for collecting and transmitting data. A first encryption policy set is configured for the first type of device, and a second encryption policy set is configured for the second type of device. The first encryption policy set and the second encryption policy set differ in at least one aspect, namely, encryption algorithm type, key update frequency, or encryption data granularity.

3. The method according to claim 2, characterized in that, The characteristic data of the QKD key generation and distribution process includes the time series of the single key generation success rate of the QKD device, the quantum channel bit error rate fluctuation data, the authentication channel interaction delay data, and the final effective key distribution rate data. The QKD security boundary big data set is divided into multiple continuous or non-continuous data subsets through time windows, and each data subset is associated with a power system operation status label for a corresponding historical time period.

4. The method according to claim 2, characterized in that, For the first type of device, the first encryption strategy set contains at least two alternative encryption strategies. Each alternative encryption strategy is uniquely determined by an encryption algorithm identifier, working mode, initialization vector generation rule, and key lifecycle threshold. The encryption algorithm identifier is selected from a predefined list of strong encryption algorithms, and the key lifecycle threshold is dynamically adjusted according to the maximum allowable delay of the processing instruction of the first type of device and the importance level of the instruction. For the second type of device, the second encryption strategy set includes at least two alternative encryption strategies. Each alternative encryption strategy is uniquely determined by a stream encryption algorithm identifier, a key stream synchronization mechanism, and a key update triggering condition based on packet count. The key stream synchronization mechanism includes timestamp-based synchronization and sequence number-based synchronization. The key update triggering condition is set according to the data sampling frequency of the second type of device and historical network congestion data. Establish a binding mapping relationship between the first type of device and the first encryption policy set, and between the second type of device and the second encryption policy set, and store the binding mapping relationship and the description information of the alternative encryption policies in each encryption policy set in the security policy configuration library of the target power system being evaluated.

5. The method according to claim 1, characterized in that, The risk assessment benchmark model constructed based on the QKD security boundary big data set includes: Structural analysis is performed on the QKD security boundary big data set to extract the QKD communication link state benchmark feature set as a model condition dimension, and the encryption strategy execution benchmark feature set as a model evaluation dimension. The QKD communication link state benchmark feature set includes at least the quantum bit error rate distribution range, the synchronization clock stability level, and the key relay hop count. The encryption strategy execution benchmark feature set includes at least the strength identifier of the encryption algorithm actually used, the actual key lifespan, and the processor occupancy rate for encryption operations. In the feature space spanned by the conditional dimension feature set, multiple discrete reference state units are divided according to the distribution density of historical data. Each reference state unit is defined by a range combination of a set of conditional dimension feature values. For each baseline state unit, the distribution of encryption policy execution baseline feature values ​​among all historical data instances belonging to the corresponding baseline state unit is statistically analyzed. Based on this distribution, baseline risk level labels are assigned to different combinations of encryption policy execution baseline feature values. The basis for the division of the baseline risk level labels is the frequency and severity of historical abnormal events associated with different combinations of encryption policy execution feature values ​​within the same baseline state unit. All baseline state units, the corresponding encryption policy execution baseline feature value distribution statistics, and the assigned baseline risk level labels are correlated and integrated to form the risk assessment baseline model. The risk assessment baseline model has the function of mapping and querying from any set of input QKD communication link state data and encryption policy execution data to the corresponding baseline risk level.

6. The method according to claim 1, characterized in that, The encryption policy execution data includes the encryption policy identifier currently actually activated by the power equipment to be evaluated, the time interval since the last key update, the number of encrypted data units processed, and the time taken for the most recent encryption operation. The QKD communication link status data includes the current quantum error rate, current key generation rate, and current key synchronization status flag of the QKD link that provides key services for the corresponding power equipment to be evaluated.

7. The method according to claim 1, characterized in that, The step of matching and comparing the acquired encryption policy execution data and QKD communication link status data with the risk assessment benchmark model includes: Based on the acquired current QKD communication link status data, a benchmark status unit matching the current status is located in the risk assessment benchmark model. The current encryption policy execution data is compared with the distribution of encryption policy execution baseline feature values ​​statistically obtained within the baseline state unit to determine the relative position of the current encryption policy execution data in the corresponding historical distribution.

8. The method according to claim 7, characterized in that, The step of calculating an independent device encryption risk quantification value for each power device to be evaluated based on the comparison analysis results includes: calculating the device encryption risk quantification value by weighting the statistical percentile of the current encryption strategy execution data in the matched baseline state unit and the numerical representation of the baseline risk level label associated with the corresponding position. The higher the encryption risk quantification value of the device, the further the encryption status of the corresponding device deviates from the historical security benchmark under the current QKD link status.

9. The method according to claim 1, characterized in that, The generation of the global encryption attack risk assessment report for the target power system specifically includes: The topology and business logic information of the target power system to be evaluated are obtained, and a system function weight coefficient is assigned to each power device to be evaluated. The weight coefficient reflects the relative importance of the corresponding device in maintaining the steady-state operation of the power system and ensuring the continuity of key businesses. The determination basis includes the device type, the connectivity of the device in the topology, and the criticality level of the business carried by the device. Based on the equipment encryption risk quantification value of each power equipment to be evaluated and its corresponding system function weight coefficient, a weighted aggregation algorithm is used to calculate the global comprehensive risk index of the target power system to be evaluated. All power equipment to be evaluated are sorted in descending order according to the equipment encryption risk quantification value, and the top N equipment with the highest risk quantification value are identified as the set of high-risk equipment of concern. Analyze the type distribution of devices in the set of high-risk devices, the characteristics of the encryption strategies they employ, and the commonalities in the QKD link states associated with the corresponding devices to generate a preliminary risk cause analysis summary; By integrating the global comprehensive risk index, the list of high-risk devices and their detailed risk data, and a preliminary analysis summary of the risk causes, a structured global encryption attack risk assessment report is generated according to a predefined report template; the report also includes operational suggestions based on the current global risk level.

10. The method according to claim 1, characterized in that, The method further includes: After generating the assessment report, the current encryption policy execution data, QKD communication link status data, calculated device encryption risk quantification value, and final assessment report obtained in this assessment are anonymized and fed back as new sample data to expand the QKD security boundary big data set for subsequent iterative updates of the risk assessment benchmark model.

Images