Electric power cloud edge quantum encryption communication implementation method based on quantum optimization algorithm

Abstract

The application discloses an electric power cloud edge quantum encryption communication implementation method based on a quantum optimization algorithm and relates to the technical fields of electric power system information communication and quantum encryption communication. The electric power cloud edge quantum encryption communication implementation method based on the quantum optimization algorithm comprises the following steps: S1, gateway operation data is acquired, and time axis repositioning, dynamic denoising and normalization processing are performed; S2, a pre-recovery matrix and a post-recovery matrix are constructed, and the mapping relationship before and after the disconnection recovery is evaluated for consistency; S3, a key takeover state is extracted, key takeover evaluation is performed, and an encryption channel rebinding is executed; S4, a recovery state discrimination sequence is constructed and recovery deviation evaluation is performed, and a recovery state behavior label is output. The application effectively improves the session mapping consistency and the encryption communication continuity of the gateway disconnection recovery in a weak network environment, and solves the problems of authentication failure, context cross talk and cumulative failure caused by the lack of check and drift detection of the mapping relationship.

Description

Technical Field

[0001] This invention relates to the field of power system information communication and quantum encrypted communication technology, specifically to a method for implementing power cloud-edge quantum encrypted communication based on quantum optimization algorithms. Background Technology

[0002] With the rapid development of the Internet of Things (IoT) and the Industrial Internet, cloud-edge-device collaborative architectures are widely used in various scenarios. Gateways, as key nodes connecting the edge and terminals, frequently need to handle disconnection and recovery scenarios. In existing technologies, to reduce connection establishment overhead, gateways often reuse existing session IDs and mapping entries during disconnection and recovery, performing only local repairs without systematically verifying the integrity of the mapping relationships. When existing systems experience repeated short disconnections and rapid recovery in weak network conditions, although the session ID may persist, the internal mapping objects may shift, causing the same service flow to be attached to the wrong security context, leading to authentication failures and contextual interference. Furthermore, such failures are difficult to reproduce and have a cumulative effect.

[0003] In power system cloud-edge-device collaborative scenarios, the cloud typically consists of a dispatch master station, centralized control cloud platform, or security management platform; the edge typically consists of substation edge gateways, distribution edge gateways, or station-end security access gateways; and the devices typically consist of protection devices, measurement and control devices, data acquisition terminals, or intelligent devices within the station. These nodes require continuous state synchronization, parameter distribution, and secure communication. In scenarios involving weak networks, link jitter, or station-end switching, edge gateways often experience short-term disconnections and rapid recovery. If existing session identifiers and local mapping entries are reused during recovery without consistency verification of the security context handle and key chain location index, an abnormal state can easily form in the power communication link where the session continues but the internal mapping object is offset.

[0004] For example, the invention patent CN120546884B discloses a ubiquitous network data security gateway resistant to quantum attacks, including: a communication interface module, a verification module, a policy parsing module, an accumulator update module, a second signature module, and an output module. The verification module verifies the authenticity of the signature and the consistency of members based on the terminal's public key and the accumulator's public key; the policy parsing module dynamically filters fields according to a predefined editable policy; the accumulator update module efficiently accumulates and witnesses updates subsets without calling the private key; the second signature module uses a lattice signature algorithm based on the SIS assumption and combines bounded rejection sampling to complete the re-signing; the output module securely distributes the re-signed data packet to the user; furthermore, it supports threshold fragmentation and Chinese Remainder Theorem reassembly to achieve distributed privacy protection and reliable recovery of highly sensitive fields. This invention achieves a balance between quantum security and editability, with controllable re-signing and verification performance.

[0005] For example, invention patent CN111865589B discloses a quantum communication encryption system and method for realizing quantum-encrypted transmission in mobile communication, including: a quantum communication network; a quantum key injection machine and a quantum key distribution device set at the quantum key injection machine end; a quantum encryption device set at the service platform end, a quantum security service platform, and a quantum key distribution device at the service platform end; and a quantum terminal encryption module set at the mobile terminal. This invention does not change the existing encryption system and process of mobile communication, nor does it add any encryption links to the information transmission link. It enhances the security of the working key by fusing the key distributed using a public-private key system and the key distributed using quantum communication technology, thereby improving its resistance to quantum computing.

[0006] In existing technologies, to reduce connection establishment overhead, gateways in current systems often reuse existing session IDs and mapping table entries during connection recovery, performing only local repairs. However, when multiple short connection drops and rapid recovery occur repeatedly in weak networks, if consistency verification and drift detection are not performed on the mapping relationship between session ID, security context handle, and key chain location index, the session ID may still be valid, but the internal mapping object may have shifted. This could lead to the same service flow being attached to the wrong security context, causing authentication failure, context crosstalk risk, and cumulative failures that are difficult to reproduce.

[0007] Therefore, in order to address the above problems, there is an urgent need for a quantum-optimized algorithm-based method for implementing edge-to-edge quantum encrypted communication in power cloud. Summary of the Invention

[0008] Technical problems to be solved To address the shortcomings of existing technologies, this invention provides a quantum-optimized algorithm-based method for edge-to-edge quantum encrypted communication in power cloud, which solves the problems of authentication failure, contextual crosstalk, and cumulative faults caused by the lack of verification and drift detection of mapping relationships.

[0009] Technical solution To achieve the above objectives, the present invention provides the following technical solution: a quantum-encrypted communication implementation method for power cloud edge-end based on quantum optimization algorithms, comprising: S1, acquiring gateway operation data and performing time axis relocation, dynamic denoising and normalization processing to construct a session mapping observation dataset; S2, based on the session mapping observation dataset, constructing a pre-recovery matrix and a post-recovery matrix, performing a consistency evaluation on the mapping relationship before and after disconnection recovery, and outputting a consistency verification result; S3, based on the consistency verification result, extracting the key acceptance state and constructing a target acceptance sequence, performing a key acceptance evaluation, and performing encrypted channel rebinding; S4, constructing a recovery state discrimination sequence and performing a recovery deviation evaluation, outputting a recovery state behavior label and generating a recovery state report.

[0010] Further, the specific steps for acquiring gateway operation data and performing timeline relocation, dynamic denoising, and normalization processing to construct a session mapping observation dataset are as follows: Full-process data collection is performed on the power master station cloud platform, substation, or distribution edge security gateway and station-end access equipment during operation to acquire gateway operation data. This data includes session ID, security context handle, key chain location index, cache slot number, incremental key reference token, and key segment number. A method combining NTP-based timestamp correction and distributed logical clock sorting is used to relocate the gateway operation data along the timeline, correcting the state order misalignment caused by asynchronous node reporting in disconnection scenarios. Using the session ID as the primary key, a distributed consistency hash is applied. The algorithm integrates and correlates session state data from different nodes, mapping and fusing scattered fields of the same session across the cloud, edge, and endpoint. It combines the sliding window interquartile range (IIL) method from statistics with the local outlier factor algorithm to dynamically denoise gateway operation data, filtering out null records, duplicate records, and invalid jump records caused by network jitter. It also uses a minimum-maximum normalization method for normalization. The algorithm constructs a session mapping observation dataset and synchronously stores it to the cloud management node through a quantum encryption channel using a hybrid QKD and PQC encryption. The edge security gateway retains local cache records, and the cloud uses a distributed database to store data categorized by data type. The edge nodes use a ring buffer overlay storage method.

[0011] Furthermore, based on the session mapping observation dataset, the specific steps for constructing the pre-recovery matrix and the post-recovery matrix are as follows: Based on the session mapping observation dataset, a sliding window sampling method based on disconnection event timestamp alignment is used to extract continuous state records with a window length of L before and after disconnection recovery. Each record contains a session ID hash value, a security context handle encoding value, and a key chain position index. These are arranged in chronological order to obtain the pre-recovery mapping sequence and the post-recovery mapping sequence. The session ID hash value, security context handle encoding value, and key chain position index at each sampling moment in the pre-recovery mapping sequence are used as row vectors and stacked in chronological order to construct the pre-recovery matrix. The number of rows in the matrix is ​​the window length, and the number of columns is three, corresponding to the numerical features of the session identifier, security context handle, and key chain position index, respectively. The post-recovery matrix is ​​constructed in the same way using the post-recovery mapping sequence.

[0012] Further, the specific steps for evaluating the consistency of the mapping relationship before and after connection loss recovery are as follows: Each column of the pre-recovery matrix and the post-recovery matrix is ​​weighted according to the weights of the session ID hash value, security context handle encoding value, and key chain position index in session mapping drift detection, resulting in a weighted pre-recovery matrix and a weighted post-recovery matrix; the element differences at corresponding positions in the weighted pre-recovery matrix and the weighted post-recovery matrix are calculated and substituted into the F-norm to obtain the overall matrix difference; the overall matrix difference is divided by the sum of the F-norm of the weighted pre-recovery matrix and the zero-prevention term, and the negative value of the exponent is taken to obtain the structural similarity index; the product of the F-norm of the weighted pre-recovery matrix and the F-norm of the weighted post-recovery matrix is ​​added to the zero-prevention term to obtain the baseline term; the weighted pre-recovery matrix is ​​transposed and subjected to matrix trace operation with the weighted post-recovery matrix to obtain a product matrix; the product matrix is ​​divided by the baseline term to obtain the directional consistency index; the directional consistency index is multiplied by the structural similarity index to obtain the mapping consistency evaluation value.

[0013] Furthermore, the specific steps for outputting the consistency verification result are as follows: compare the mapping consistency evaluation value and the mapping consistency threshold in real time. When the mapping consistency evaluation value is less than the mapping consistency threshold, it is determined that there is a consistency anomaly in the current post-disconnection recovery mapping relationship, triggering an anomaly state record. Set the mapping drift detection flag for the current session, set the mapping drift detection flag to an anomaly state at the edge node, and write the current timestamp and anomaly type code. When the mapping consistency evaluation value is greater than or equal to the mapping consistency threshold, it is determined that the current post-disconnection recovery mapping relationship is consistent, the current session mapping chain is retained, and the consistency verification result is output.

[0014] Furthermore, based on the consistency verification results, the specific steps for extracting the key acceptance status and constructing the target acceptance sequence are as follows: Based on the consistency verification results and the mapping drift detection flag, when the mapping drift detection flag is abnormal, the old security context corresponding to the original session is frozen, only the session metadata synchronization channel is retained, and the old context is prohibited from continuing to participate in formal encrypted communication; the edge security gateway uses the session ID hash value, the security context handle encoding value, and the target key chain position index as the joint retrieval key to query the key fragment record corresponding to the current session in the local cache record; when the query is successful, the corresponding key fragment record is extracted, and the local actual acceptance sequence is constructed; when the local cache record does not find the corresponding key fragment record, the edge security gateway uses Q... The KD and PQC hybrid encryption channel sends an incremental acceptance request to the cloud management node. The cloud management node returns an incremental key reference token, the target key segment start index, a key segment number sequence with a continuous window length, and a rebinding sequence number based on the incremental acceptance request. The edge security gateway concatenates the target key segment number sequence returned by the cloud with the locally actually hit key segment record in a time sequence. It then arranges the key segment number, cache slot number, and rebinding sequence number within the state window with a window length of L in sequence to construct the target acceptance sequence and the actual acceptance sequence. It compares the binding sequence numbers of adjacent state points in the actual acceptance sequence. When the binding sequence number of the later state point is less than the binding sequence number of the earlier state point, it is recorded as a binding rollback event.

[0015] Further, the specific steps for key acceptance evaluation are as follows: Compare the key segment numbers in the target acceptance sequence and the actual acceptance sequence point by point in chronological order; count the consecutive identical key segment numbers to obtain the longest consecutive matching length; count the number of non-sequential switching of cache slot numbers between adjacent state points in the actual acceptance sequence to obtain the cache slot jump count; and count the number of binding rollback events to obtain the binding rollback count; square the longest consecutive matching length to obtain the acceptance term; add one to the cache slot jump count to obtain the slot perturbation term; add one to the binding rollback count to obtain the rollback perturbation term; multiply the slot perturbation term and the rollback perturbation term to obtain the abnormal perturbation joint term; use the acceptance term as the numerator, and the sum of the acceptance term, the abnormal perturbation joint term, and the zero-prevention term as the denominator to obtain the key acceptance evaluation value.

[0016] Further, the specific steps for rebinding the encrypted channel are as follows: The key acceptance evaluation value and the key acceptance threshold are compared in real time. If the key acceptance evaluation value is less than the key acceptance threshold, it is determined that the current session still has a key acceptance anomaly after the connection is restored, and the current encrypted channel to be restored is frozen. If the key acceptance evaluation value is greater than or equal to the key acceptance threshold, it is determined that the current session meets the key acceptance conditions, and the encrypted channel rebinding process is executed. After the encrypted channel rebinding is completed, the edge security gateway sends a rebinding confirmation frame to the end-side access node. After receiving the rebinding confirmation frame, the end-side access node refreshes its local session acceptance status and sends back a recovery confirmation flag. After receiving the recovery confirmation flag, the edge security gateway marks the current session as restored and synchronously stores the rebinding sequence number in the cloud management node and local cache record.

[0017] Further, the specific steps for constructing the recovery state discrimination sequence and performing recovery deviation assessment are as follows: Check whether the edge security gateway has successfully sent a rebinding confirmation frame to the end-side access node; if successful, record it as a confirmation frame arrival state; if unsuccessful, record it as a confirmation frame not arriving state. Check whether the end-side access node has successfully sent back a recovery confirmation flag for the rebinding confirmation frame; if successful, record it as a recovery response arrival state; if unsuccessful, record it as a recovery response missing state. Check whether the formal encrypted communication channel corresponding to the current session has been activated; if activated, record it as an activated state; if not activated, record it as an inactive state. Quantize the confirmation frame arrival status, recovery response status, and channel availability status respectively, and use the sigmoid function to perform a nonlinear mapping on the weighted sum of the three to obtain the communication stability state value of the current state point. Calculate the mapping consistency evaluation value corresponding to each state point within a continuous fixed state window. The communication stability state value and key acceptance evaluation value are arranged in chronological order to construct a recovery state discrimination sequence; the number of state points within a continuous window length is obtained through sliding window sampling; a state point index is generated based on the time series index within the continuous window length; the difference between the mapping consistency evaluation values ​​before and after is calculated to obtain the mapping fluctuation term; the difference between the key acceptance evaluation values ​​before and after is calculated to obtain the acceptance fluctuation term; the difference between the communication stability state values ​​before and after is calculated to obtain the communication fluctuation term; the mapping fluctuation term and the acceptance fluctuation term are multiplied to obtain the coupling term; the communication fluctuation term is divided by 1 and the sum of the absolute values ​​of the differences between the mapping fluctuation term and the acceptance fluctuation term to obtain the disturbance adjustment term; the coupling term and the disturbance adjustment term are added together and substituted into the hyperbolic tangent function to obtain the local recovery deviation term; all local recovery deviation terms within the continuous window length are multiplied together and accumulated, and the result of the multiplication is subtracted by 1 to obtain the recovery deviation evaluation value.

[0018] Furthermore, the specific steps for outputting recovery status behavior tags and generating a recovery status report are as follows: Real-time comparison of the recovery deviation assessment value and the recovery deviation threshold. When the recovery deviation assessment value is less than or equal to the recovery deviation threshold, and the recovery confirmation flag for the current session is successful, the current recovery segment is determined to be in a normal recovery state. When the recovery deviation assessment value is greater than the recovery deviation threshold, the current recovery segment is determined to have an abnormal recovery risk, and the current session is marked as an abnormal recovery segment, entering the local anomaly analysis process. The abnormal recovery segment undergoes feature determination: the recovery status type is structurally bound to the current session ID hash value, node number, anomaly type code, recovery confirmation flag, and current valid key segment number to generate a recovery status behavior tag. In the local anomaly analysis process, an isolation correction flag is set for the session of the abnormal recovery segment, and the current timestamp, node identifier, and anomaly type code are written. After all session recovery tasks are completed, all recovery status behavior tags are summarized to generate a recovery status report.

[0019] Beneficial effects The present invention has the following beneficial effects: (1) This invention uses a combination of NTP-based timestamp correction and distributed logical clock sorting to reposition the time axis of gateway running data, and uses a combination of sliding window interquartile range method and local outlier factor algorithm to dynamically denoise, which solves the problem of state order misalignment and invalid jump records caused by asynchronous reporting of nodes in disconnection scenarios, and realizes the quality construction of session mapping observation dataset.

[0020] (2) This invention constructs the mapping sequences before and after recovery into a matrix before recovery and a matrix after recovery, and introduces the Frobenius norm and matrix trace to calculate the mapping consistency evaluation value, thereby realizing the joint quantitative evaluation of the structural similarity and directional consistency of the ternary mapping chain of session ID, security context handle and key chain position index before and after disconnection recovery, and solves the problem that the mapping offset caused by local repair is difficult to detect.

[0021] (3) This invention, by constructing a joint judgment mechanism of mapping consistency assessment, key acceptance assessment, and recovery deviation assessment, achieves comprehensive identification and classification output of multiple abnormal states during the connection loss recovery process, reduces misjudgments and omissions caused by single indicator judgment, and improves the accuracy of the recovery process analysis results. It realizes refined identification of mapping mismatch types and localized marking of abnormal states, providing accurate input basis for key acceptance analysis.

[0022] (4) This invention, by introducing a quantum optimization algorithm into the target key segment selection and incremental connection sequence construction stages of the power cloud edge-end disconnection recovery process, can reduce the number of cache conflicts, repeated connection attempts, and cloud request attempts at the edge gateway while ensuring key connection correctness, thereby achieving lightweight quantum-encrypted communication connection during the power communication recovery process.

[0023] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0024] Figure 1 This is a flowchart of the method for implementing quantum encrypted communication between the power cloud and the edge based on quantum optimization algorithms according to the present invention. Figure 2 This is a diagram illustrating the abnormal characteristics of session mapping in this invention. Figure 3 This is an analysis diagram of the session mapping consistency evaluation results of the present invention; Figure 4 This is a bar chart showing the evaluation results of the session key acceptance in this invention. Figure 5 This is a bar chart for evaluating session recovery deviation in this invention. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] Please see Figures 1-5 This invention provides a technical solution: a method for implementing quantum encrypted communication between the power cloud and the edge based on a quantum optimization algorithm, comprising: S1, acquiring gateway operation data and performing time axis relocation, dynamic denoising and normalization processing to construct a session mapping observation dataset; S2, based on the session mapping observation dataset, constructing a pre-recovery matrix and a post-recovery matrix, performing a consistency evaluation on the mapping relationship before and after disconnection recovery, and outputting a consistency verification result; S3, based on the consistency verification result, extracting the key acceptance state and constructing a target acceptance sequence, performing a key acceptance evaluation, and performing encrypted channel rebinding; S4, constructing a recovery state discrimination sequence and performing a recovery deviation evaluation, outputting a recovery state behavior label and generating a recovery state report.

[0027] Specifically, the steps for acquiring gateway operation data, performing timeline relocation, dynamic denoising and normalization processing, and constructing a session mapping observation dataset are as follows: The entire process of power station cloud platform, substation or distribution edge security gateway and station access equipment operation is collected to obtain gateway operation data. The gateway operation data includes session ID, security context handle, key chain location index, cache slot number, incremental key reference token and key segment number. Considering that the asynchronous reporting caused by the inconsistent recovery time of each node in the disconnection scenario will cause the state records of the same session to be out of order on the timeline, direct splicing will cause misjudgment due to mapping drift. Therefore, the data must be repositioned on the timeline. A method combining NTP synchronization-based timestamp correction and distributed logical clock sorting is used to reposition the gateway operation data on the timeline, correct the state order misalignment caused by asynchronous reporting of nodes in the disconnection scenario, and eliminate data silos between nodes. Using session ID as the primary key, a distributed consistent hash algorithm is used to associate and integrate the session state data of different nodes, and to map and merge the scattered fields of the same session on the cloud, edge and terminal sides to avoid the impact of outliers introduced by network jitter on the accuracy of consistency assessment.

[0028] This study combines the statistical sliding window interquartile range method with the local outlier factor algorithm to dynamically denoise gateway operation data, filtering out null records, duplicate records, and invalid jump records caused by network jitter. A min-max normalization method is then used for normalization. A session mapping observation dataset is constructed and synchronously stored on the cloud management node through a quantum encryption channel using a hybrid QKD and PQC encryption. Local cache records are also retained on the edge security gateway. The cloud uses a distributed database for data type-based storage, while the edge nodes use a ring buffer overlay storage. This processed session mapping observation dataset will serve as input for mapping consistency evaluation, key acceptance evaluation, and recovery deviation evaluation in disconnection recovery scenarios, ensuring that each evaluation indicator is based on accurate, aligned, and noise-free data.

[0029] like Figure 2The diagram shown illustrates the characteristics of session mapping anomalies. It comprehensively demonstrates the formation characteristics of session mapping anomalies in disconnection recovery scenarios from four aspects: security context handle recovery time, disconnection recovery feature correlation, dynamic denoising effect, and normalized feature distribution. The top-left subplot compares the original handle number with the handle recovery time of a single session after recovery, reflecting significant processing differences between different sessions during security context reconstruction. This indicates that session recovery in weak network environments is not a simple continuation of the original state, but may be accompanied by internal mapping reorganization. The top-right subplot shows the correlation between the number of disconnection recovery attempts and the recovery time in scatter plot form. It can be seen that the more edge nodes that recover, the higher the overall recovery time, indicating that multiple short disconnections will increase the complexity of the recovery path and increase the risk of mapping offset. The bottom-left subplot shows the comparison of the number of anomalies before and after dynamic denoising, showing that after joint processing by the sliding window interquartile range method and the local outlier factor algorithm, invalid jumps and false anomalies caused by network jitter can be effectively filtered out, thereby improving the accuracy of session mapping verification. The bottom-right subplot shows the distribution of core features after normalization, indicating that key variables such as security context handle, key chain position, and disconnection recovery stability have good comparability on a unified scale, which can provide standardized input for subsequent matrix construction before and after recovery, consistency assessment, and drift detection. Overall, the figure illustrates that before entering the mapping consistency verification, the present invention has extracted, cleaned and standardized the key abnormal features in the gateway operation data, laying a reliable data foundation for identifying the problem of session ID continuation but internal mapping object offset.

[0030] In this implementation plan, by uniformly collecting, relocating, dynamically denoising, associating, fusing, and normalizing the gateway operation data of cloud control nodes, edge security gateways, and end-side access nodes, the problems of timing misalignment, pseudo-anomalies, and scale inconsistencies caused by asynchronous node reporting, network jitter, and data dispersion in disconnection recovery scenarios can be effectively eliminated.

[0031] Specifically, the steps for constructing the pre-recovery and post-recovery matrices based on the session mapping observation dataset are as follows: Based on the session mapping observation dataset, a sliding window sampling method based on disconnection event timestamp alignment is adopted to extract continuous state records with a window length of L before and after disconnection recovery. The window length L is determined according to the sampling period and the maximum disconnection duration to ensure that the window covers the critical state change range before and after disconnection. This avoids missing important state transitions due to an excessively short window and prevents redundant noise from being introduced due to an excessively long window. Each record contains the session ID hash value, the encoded value of the security context handle, and the key chain location index. Arranged in chronological order, the pre-recovery mapping sequence and the post-recovery mapping sequence are obtained.

[0032] The session ID hash value, security context handle encoding value, and key chain location index at each sampling time in the pre-recovery mapping sequence are used as row vectors to form a three-dimensional row vector. These are stacked from top to bottom in chronological order to construct the pre-recovery matrix. The number of rows in the matrix is ​​the window length, and the number of columns is three, corresponding to the numerical features of the session identifier, security context handle, and key chain location index, respectively. The post-recovery mapping sequence is constructed in the same way to form the post-recovery matrix, resulting in two matrices with the same dimensions for subsequent consistency evaluation.

[0033] In this implementation scheme, a sliding window sampling method based on disconnection event timestamp alignment is used to extract continuous state records before and after disconnection recovery. Furthermore, a matrix before recovery and a matrix after recovery are constructed. This can transform the originally scattered key state information such as session identifiers, security context handles, and key chain location indexes into a unified, regular, and directly comparable matrix representation, so that the mapping relationship before and after disconnection recovery has a clear structural correspondence and time series comparability.

[0034] Specifically, the steps for consistency assessment of the mapping relationship before and after connection loss recovery are as follows: Each column of the pre-recovery matrix and the post-recovery matrix is ​​weighted according to the weights of the session ID hash value, the security context handle encoding value, and the key chain position index in session mapping drift detection, resulting in a weighted pre-recovery matrix and a weighted post-recovery matrix. By analyzing the difference contribution of each weighted column, the drift type can be further distinguished: when the difference in the session ID column is dominant, it may be a type where the session ID is maintained but the context handle is offset; when the difference in the key chain position column is dominant, it may be a type where the key chain index is misaligned; when the directional consistency index is low, it indicates a reversal of the sequence trend, which may correspond to a key backoff type drift. The differences between corresponding elements in the pre-weighted and post-weighted matrices are calculated and substituted into the F-norm to obtain the overall matrix difference. The overall matrix difference is divided by the sum of the F-norm of the pre-weighted matrix and the zero-prevention term, and the negative value of the exponent is taken to obtain the structural similarity index. The product of the F-norm of the pre-weighted matrix and the F-norm of the post-weighted matrix is ​​multiplied by the zero-prevention term to obtain the baseline term. The pre-weighted matrix is ​​transposed and the trace of the post-weighted matrix is ​​performed to obtain the product matrix. The product matrix is ​​divided by the baseline term to obtain the directional consistency index. The directional consistency index is multiplied by the structural similarity index to obtain the mapping consistency evaluation value.

[0035] The specific formula for calculating the mapping consistency evaluation value is as follows: ; In the formula, This represents the mapping consistency evaluation value, used to quantify the degree of consistency of the ternary mapping chain before and after session disconnection and recovery; This represents the matrix before weighted recovery, used for structural and directional comparisons with the recovered mapping. This represents the weighted restored matrix, used to calculate the degree of mapping offset. The Frobenius norm is represented by the sum of the squares and square roots of the differences between the elements of the matrix as a whole, and is used to characterize the degree of difference in the overall structure of the mapping chain before and after restoration. The zero-prevention term is obtained by statistically analyzing the minimum non-zero mean of the mapping difference sequence in the normal recovery samples, with a value range of (0, 10). -3 ], used to prevent the denominator from being zero; The trace operation represents the matrix trace, obtained by summing the diagonal elements of the matrix, and is used to characterize the consistency of the mapping chain direction before and after restoration. The mapping consistency evaluation value is used to characterize the consistency of session identifiers, security contexts, and key chain inheritance relationships of the power cloud edge communication link before and after disconnection restoration, in order to avoid incorrect communication context attachments between the dispatch side, station side, and terminal side.

[0036] Table 1 shows the mapping consistency assessment and drift detection results, used to evaluate the mapping consistency before and after matrix restoration and determine the drift level. Session IDSID-001: Before restoration, the matrix F-norm was 8.25; after restoration, the matrix F-norm was 7.98; the mapping consistency assessment value was 0.80; the drift level was no drift. Session IDSID-002: Before restoration, the matrix F-norm was 9.32; after restoration, the matrix F-norm was 6.85; the mapping consistency assessment value was 0.58; the drift level was slight drift. Session IDSID-003: Before restoration, the matrix F-norm was 7.68; after restoration, the matrix F-norm was 7.52; the mapping consistency assessment value was 0.88; the drift level was no drift. Session IDSID-0 04: Before recovery, the F-norm of the matrix was 8.76; after recovery, the F-norm of the matrix was 7.43; the mapping consistency assessment value was 0.70; the drift level was no drift. Session IDSID-005: Before recovery, the F-norm of the matrix was 10.25; after recovery, the F-norm of the matrix was 6.38; the mapping consistency assessment value was 0.49; the drift level was severe drift. Session IDSID-006: Before recovery, the F-norm of the matrix was 7.23; after recovery, the F-norm of the matrix was 7.15; the mapping consistency assessment value was 0.91; the drift level was no drift. Session IDSID-007: Before recovery, the F-norm of the matrix was 8.92; after recovery, the F-norm of the matrix was 6.97; the mapping consistency assessment value was 0.64; the drift level was moderate drift.

[0037] Table 1. Results of Mapping Consistency Assessment and Drift Detection like Figure 3The analysis chart of the session mapping consistency evaluation results shows a comprehensive display of the mapping relationship status of each session after disconnection recovery from four aspects: the heat map distribution of matrix differences after weighted recovery, the comparison of the three consistency indices, the discrimination of session mapping drift level, and the deviation of calculated values. The upper left subplot visually reflects the distribution of matrix differences of the example sessions after weighted recovery in the three dimensions of session ID hash value, handle encoding, and key chain index in the form of a heat map, which can be used to locate the concentrated location of deviations; the upper right subplot compares the consistency evaluation value, structural similarity index, and directional consistency index of each session, which can intuitively see which sessions, although the overall consistency is still acceptable, have seen a decline in local structural or directional matching; the lower left subplot classifies the drift degree of different sessions based on the consistency threshold, distinguishing between no drift, slight drift, moderate drift, and severe drift, indicating that the method can not only determine whether there is an anomaly, but also characterize the degree of anomaly; the lower right subplot shows the correspondence between the formula output value and the theoretical error, indicating that the constructed consistency evaluation model has good computational interpretability and result verifiability. Overall, this invention demonstrates that the consistency verification mechanism proposed in this invention can identify, quantify, and classify the offset of the ternary mapping relationship in scenarios of multiple short disconnections and rapid recovery in weak networks, providing a basis for mapping drift detection and correction.

[0038] This implementation scheme can quantify the consistency of the ternary mapping chain as a whole, and can further distinguish different types of drift characteristics such as session identifier offset, key chain misalignment and sequence trend reversal. It can identify, quantify and classify abnormal mapping relationships, thereby improving the accuracy and interpretability of session mapping drift detection in scenarios of multiple short disconnections and rapid recovery in weak networks, and providing a reliable basis for subsequent mapping correction, key acceptance verification and encryption channel rebinding.

[0039] Specifically, the steps for outputting the consistency check results are as follows: The mapping consistency evaluation value and the mapping consistency threshold are compared in real time. The mapping consistency threshold is determined based on the statistical distribution of mapping consistency evaluation values ​​in normal sessions, and is a fixed value between 0.8 and 0.95, or dynamically adjusted according to the false alarm rate requirements of the disconnection recovery scenario. When the mapping consistency evaluation value is less than the mapping consistency threshold, it is determined that there is a consistency anomaly in the current disconnection recovery mapping relationship, triggering an anomaly state record. A mapping drift detection flag is set for the current session, and the mapping drift detection flag is set to an anomaly state at the edge node. At the same time, the current timestamp and anomaly type code are written. The anomaly type code uses a 4-bit binary code to identify the specific type of session mapping drift, including session ID retention but context handle offset, key chain index misalignment, and key rollback. When the mapping consistency evaluation value is greater than or equal to the mapping consistency threshold, it is determined that the current disconnection recovery mapping relationship is consistent, the current session mapping chain is retained, and the consistency verification result is output.

[0040] This implementation scheme enables real-time identification, structured marking, and categorized management of session mapping anomalies. Simultaneously, for sessions determined to maintain consistent mapping relationships, their session mapping chains can be preserved, avoiding unnecessary interruptions or repetitive processing. This improves the real-time performance, targeting, and traceability of session mapping anomaly detection in disconnection recovery scenarios, providing clear judgment criteria for key acceptance judgment, encrypted channel rebinding, and recovery status identification.

[0041] Specifically, based on the consistency verification results, the specific steps for extracting the key acceptance status and constructing the target acceptance sequence are as follows: Based on the consistency verification result and the mapping drift detection flag, when the mapping drift detection flag is abnormal, the old security context corresponding to the original session is frozen, only the session metadata synchronization channel is retained, and the old context is prohibited from continuing to participate in formal encrypted communication. The edge security gateway uses the session ID hash value, the security context handle encoding value, and the target key chain location index as the joint retrieval key to query the key fragment record corresponding to the current session in the local cache record. The key fragment record includes the key segment number, cache slot number, slot write time, validity period tag, reference status tag, and rebinding sequence number. When the query is successful and the cache slot is not reused, the key validity period has not expired, and the reference status is consistent with the current session, the corresponding key fragment record is extracted and the local actual acceptance sequence is constructed.

[0042] When the local cache record fails to match the corresponding key segment record, or although it does match but the cache slot has been reused, the key has expired, the reference status is inconsistent, or the binding sequence number is discontinuous, the edge security gateway sends an incremental acceptance request to the cloud management node through a hybrid QKD and PQC encrypted channel. The incremental acceptance request includes the current session ID hash value, the corrected security context handle encoding value, the target key chain location index, the local cache hit flag, and the valid rebinding sequence number. Based on a quantum optimization algorithm, the cloud management node optimizes the starting index of the target key segment and the key segment number sequence within a continuous window length, under the constraints of the current session ID hash value, the target key chain location index, the cache slot occupancy status, and the historical rebinding sequence number. This reduces the number of key retrievals, cache conflicts, and repeated acceptance overhead on the edge side. The cloud management node returns an incremental key reference token, the target key segment starting index, the key segment number sequence within the continuous window length, and the rebinding sequence number based on the incremental acceptance request.

[0043] The incremental key reference token is a 32-byte globally unique identifier, generated by the cloud management node based on the current session ID hash, timestamp, and random number. The format is: [Session ID hash (8 bytes)][Timestamp (8 bytes)][Random number (4 bytes)][Signature (12 bytes)]. Upon receiving the token, the edge security gateway must verify the signature using the cloud public key and check if the timestamp is within a valid window (e.g., ±5 seconds) to prevent replay attacks. The token is valid for 30 seconds and must be re-requested after expiration. The target key segment starting index is a 2-byte unsigned integer, indicating the starting position of the continuous key segment issued by the cloud in the global key pool. The key segment numbering sequence with a continuous window length of L consists of L arrays of 2-byte unsigned integers, arranged sequentially. The rebinding sequence number is a 2-byte unsigned integer maintained by the cloud management node. It increments by 1 each time an incremental connection is generated for the same session. The edge security gateway synchronously stores this sequence number in its local cache and carries it in subsequent requests for rollback verification. If the rebinding sequence number received by the cloud is less than or equal to the previously issued maximum value, the request is rejected and a rollback alarm is triggered.

[0044] The edge security gateway sequentially concatenates the target key segment number sequence returned from the cloud with the locally obtained key segment records. It then arranges the key segment numbers, cache slot numbers, and rebinding sequence numbers within a state window of length L, constructing a target acceptance sequence and an actual acceptance sequence. The gateway compares the binding sequence numbers of adjacent state points in the actual acceptance sequence; when the binding sequence number of a later state point is less than that of a previous state point, it is recorded as a binding rollback event. The target acceptance sequence characterizes the standard key chain progression trajectory that the current session should accept under the corrected security context, while the actual acceptance sequence characterizes the key chain progression trajectory actually loaded during the local recovery process at the edge node.

[0045] In this implementation scheme, by coordinating and controlling the incremental key reference token, the starting index of the target key segment, the key segment number sequence, and the rebinding sequence number, problems such as misreference of key segments, cache reuse interference, key rollback, and duplicate acceptance can be effectively avoided. This ensures that the target acceptance sequence and the actual acceptance sequence have a clear correspondence and timing constraints, thereby improving the accuracy and traceability of key acceptance judgment in disconnection recovery scenarios and providing a reliable foundation for key acceptance evaluation, encrypted channel rebinding, and recovery anomaly identification.

[0046] Specifically, the steps for conducting a key acceptance assessment are as follows: The key segment numbers in the target acceptance sequence and the actual acceptance sequence are compared point by point in chronological order. The longest consecutive matching length is obtained by counting consecutive identical key segment numbers. The number of times the cache slot numbers between adjacent state points in the actual acceptance sequence are switched out of order is obtained as the cache slot jump count. Cache slot numbers are written sequentially according to the key segment order during normal operation. If an out-of-order jump occurs, it usually means that the cache has been incorrectly reused, data has been lost, or it has been maliciously tampered with. This will lead to key acceptance disorder and thus cause encrypted communication failure. The number of binding rollback events is also counted to obtain the binding rollback count. The rebinding sequence number is monotonically incremented by the cloud. If the sequence number rollback occurs in the actual sequence, it indicates that a replay attack, state rollback, or synchronization anomaly between nodes may have occurred, causing the session to revert to the old state, which is a serious security risk. The longest consecutive matching length is squared to obtain the acceptance term; the number of cache slot transitions is incremented by one to obtain the slot perturbation term; the number of binding rollbacks is incremented by one to obtain the rollback perturbation term; the slot perturbation term and the rollback perturbation term are multiplied to obtain the abnormal perturbation joint term; the acceptance term is used as the numerator, and the sum of the acceptance term, the abnormal perturbation joint term, and the zero-prevention term is used as the denominator to obtain the key acceptance evaluation value.

[0047] The specific formula for calculating the key acceptance evaluation value is as follows: ; In the formula, This represents the key succession evaluation value, used to quantify the continuity and stability of the key chain succession after the current session is restored from a disconnection. This indicates the longest consecutive match length, used to characterize the continuity of the key chain; This indicates the number of cache slot transitions, used to characterize whether edge cache loading is stable during the recovery process; This indicates the number of binding rollbacks, used to characterize whether an old key reference reflow occurs during the recovery process; The zero-prevention term is obtained by statistically analyzing the minimum non-zero mean of the mapping difference sequence in the normal recovery samples, with a value range of (0, 10). -3 ] is used to prevent the denominator from being zero.

[0048] This implementation plan can comprehensively and quantitatively evaluate the key handover process after connection loss recovery from three aspects: key chain continuity, cache loading order, and rebinding timing correctness. It can not only accurately reflect whether there are abnormal situations such as key segment misconnection, cache reuse disturbance, and old state rollback during the current session recovery process, but also highlight the dominant role of continuous handover capability in the key recovery process, thereby improving the accuracy and pertinence of key handover anomaly identification and providing a reliable basis for encryption channel rebinding judgment and recovery status analysis.

[0049] Specifically, the steps for performing encrypted channel rebinding are as follows: The system compares the key acceptance evaluation value with the key acceptance threshold in real time. If the key acceptance evaluation value is less than the key acceptance threshold, it is determined that the current session still has a key acceptance anomaly after the disconnection is recovered. The current encrypted channel to be recovered is frozen, and the current session is switched to a restricted recovery state, which only allows the synchronization of session control information, binding sequence number and anomaly tag. The system then re-initiates the next round of incremental key reference requests to the cloud management node. If the key acceptance evaluation value is greater than or equal to the key acceptance threshold, it is determined that the current session meets the key acceptance conditions. The system then performs encrypted channel rebinding processing, writes the corrected security context handle, the current valid key segment number, the cache slot number and the rebinding sequence number into the local mapping table entry of the edge security gateway, and activates the formal encrypted communication channel of the current session.

[0050] After the encrypted channel rebinding is completed, the edge security gateway sends a rebinding confirmation frame to the end-side access node. This frame includes the current session ID hash, the corrected security context handle encoding, the currently valid key segment number, the rebinding sequence number, and the rebinding timestamp; as well as a Message Authentication Code (MAC) generated based on the session key, used by the end-side to verify the frame's integrity and authenticity. Upon receiving the frame, the end-side access node recalculates the MAC using its locally stored session key and compares it with the received value. If they match, the confirmation frame is valid; otherwise, it is discarded and a retransmission mechanism is triggered. After receiving the rebinding confirmation frame, the end-side access node refreshes its local session acceptance status and sends back a recovery confirmation flag. This flag includes the current session ID hash, the rebinding sequence number, and the response authentication code generated based on the session key. The edge security gateway also verifies this flag; if the verification passes, it marks the current session as recovered. Upon receiving the recovery confirmation flag, the edge security gateway marks the current session as recovered and synchronously stores the rebinding sequence number in both the cloud management node and its local cache.

[0051] By incrementally accepting target key segments only within a continuous window length, triggering the return of incremental key reference information from the cloud only when mapping consistency is abnormal, and prioritizing the reuse of local cache records that meet the conditions, the computational, communication, and storage access volumes of the power edge gateway during the disconnection recovery process are reduced, thus achieving lightweight quantum encrypted communication recovery.

[0052] like Figure 4 The bar chart showing the session key acceptance evaluation results, with session IDs on the x-axis and key acceptance evaluation values ​​on the y-axis, visually illustrates the key chain acceptance status of different sessions after connection loss recovery. The dashed lines in the chart represent the key acceptance threshold. Sessions with bars above the threshold and marked as successful indicate a high degree of continuity between the target and actual acceptance sequences, with minimal abnormal disturbances such as cache slot jumps and binding sequence number rollbacks, thus meeting the conditions for encrypted channel rebinding. Sessions with bars below the threshold and marked as failed indicate significant key segment misalignment, cache loading anomalies, or old key reference backflow issues during recovery, making it difficult to complete correct key chain acceptance. This chart clearly reflects the differences in key acceptance among different sessions during the recovery phase, providing a basis for determining whether to activate the formal encrypted communication channel, whether to enter a restricted recovery state, and whether to re-initiate incremental key reference requests.

[0053] This implementation plan ensures that the encrypted communication link is re-established in the correct security context and valid key chain location after the connection is restored, preventing the incorrect connection state from continuing to participate in formal communication; thereby improving the accuracy, integrity and security of encrypted channel restoration in connection restoration scenarios, and providing reliable support for restoration state identification and anomaly tracing.

[0054] Specifically, the steps for constructing the recovery state discrimination sequence and evaluating the recovery bias are as follows: The system checks whether the edge security gateway has successfully sent a rebinding confirmation frame to the end-side access node. If successful, it is recorded as "confirmation frame arrived"; otherwise, it is recorded as "confirmation frame not arrived". It also checks whether the end-side access node has successfully sent back a recovery confirmation flag in response to the rebinding confirmation frame. If successful, it is recorded as "recovery response arrived"; otherwise, it is recorded as "recovery response missing". Finally, it checks whether the formal encrypted communication channel corresponding to the current session has been activated. If activated, it is recorded as "activated"; otherwise, it is recorded as "inactive". The system quantizes the confirmation frame arrival status, recovery response status, and channel availability status, and uses a sigmoid function to perform a non-linear mapping on the weighted sum of the three. The confirmation frame arrival status is quantized as 1 for arrival and 0 for absence, and the recovery response status is quantized as 1 for arrival. Missing values ​​are assigned a value of 0, and channel availability is quantified as 1 for active and 0 for inactive. The weighted sum of these three values ​​is mapped using the sigmoid function, with an output range of (0,1), yielding the communication stability value for the current state point. The mapping consistency evaluation value, communication stability value, and key acceptance evaluation value corresponding to each state point within the continuous fixed state window are arranged in chronological order to construct a recovery state discrimination sequence. The length of the continuous fixed state window is consistent with the continuous window length L. When the rebinding confirmation frame is successfully sent and the recovery confirmation flag is successfully returned, activating the formal encrypted communication channel, the communication stability value of the corresponding state point is set to 1. When there are cases of rebinding confirmation failure, recovery confirmation failure, or the formal encrypted communication channel not being activated, the communication stability value of the corresponding state point is set to 0.

[0055] The number of state points within a continuous window of length is obtained through sliding window sampling; the number of state points is denoted as n, and each state point corresponds to a sampling time. A state point index is generated based on the time series index within the continuous window of length. The difference between the mapping consistency evaluation values ​​before and after is calculated to obtain the mapping fluctuation term. The difference between the key acceptance evaluation values ​​before and after is calculated to obtain the acceptance fluctuation term. The difference between the communication stable state values ​​before and after is calculated to obtain the communication fluctuation term. The mapping fluctuation term and the acceptance fluctuation term are multiplied to obtain the coupling term. The communication fluctuation term is divided by 1 and the sum of the absolute values ​​of the differences between the mapping fluctuation term and the acceptance fluctuation term to obtain the disturbance adjustment term. The coupling term and the disturbance adjustment term are added together and substituted into the hyperbolic tangent function to obtain the local recovery deviation term. All local recovery deviation terms within the continuous window of length are multiplied together and accumulated, and the result of the multiplication is subtracted by one to obtain the recovery deviation evaluation value.

[0056] The specific formula for calculating the recovery deviation assessment value is as follows: ; In the formula, This represents the recovery deviation assessment value, used to quantify the degree of coupling deviation between mapping relationship fluctuations, key acceptance fluctuations, and communication stability fluctuations during the current session recovery process; This indicates the number of state points within a continuous fixed state window, used to determine the number of state points included when calculating the recovery deviation assessment value; This represents the state point index, used to calculate the change between adjacent state points; This represents the mapping fluctuation term, used to describe the fluctuation amplitude of the session mapping chain between consecutive state points during the recovery process. This indicates the fluctuation in the key acceptance status, used to reflect the degree of fluctuation in the key acceptance status during the recovery process; This represents the communication fluctuation term, used to describe the stability fluctuations of the encrypted communication channel during the recovery process.

[0057] This implementation scheme can comprehensively characterize the degree of deviation accumulation during the session recovery process, and can also effectively identify situations where a single state is normal but the overall recovery link has fluctuation coupling anomalies, thereby improving the completeness, continuity and accuracy of recovery anomaly identification, and providing a reliable basis for the generation of recovery state behavior labels and the output of recovery state reports.

[0058] Specifically, the steps for outputting recovery status behavior labels and generating a recovery status report are as follows: The system compares the recovery deviation assessment value and the recovery deviation threshold in real time. When the recovery deviation assessment value is less than or equal to the recovery deviation threshold and the recovery confirmation flag for the current session is successful, the current recovery segment is determined to be in a normal recovery state. When the recovery deviation assessment value is greater than the recovery deviation threshold, the current recovery segment is determined to have an abnormal recovery risk, and the current session is marked as an abnormal recovery segment, entering the local anomaly analysis process. The abnormal recovery segment is characterized as follows: when the mapping drift detection flag is abnormal and the mapping consistency assessment value continuously decreases, it is identified as a mapping drift continuation state; when the key acceptance assessment value is lower than the key acceptance threshold and there are consecutive key segments inconsistent between the target acceptance sequence and the actual acceptance sequence, it is identified as a key acceptance abnormal state; when the communication stability state fluctuates continuously and the recovery confirmation flag fails, it is identified as a rebinding failure state; when the same session repeatedly triggers incremental acceptance requests within a continuous fixed statistical period and is accompanied by a continuous increase in the recovery deviation assessment value, it is identified as a recovery chain repeated correction state.

[0059] The recovery status type is structurally bound to the current session ID hash, node number, anomaly type code, recovery confirmation flag, and current valid key segment number to generate a recovery status behavior label. The node number is a unique numerical identifier pre-assigned by the cloud control node, edge security gateway, and end-side access node during system deployment. Recovery status behavior labels include normal recovery labels, mapping drift continuation labels, key handover anomaly labels, rebinding failure status, and recovery chain repeated correction labels. In the local anomaly resolution process, an isolation correction flag is set for the session in the anomaly recovery segment, and the current timestamp, node identifier, and anomaly type code are written into it. After all session recovery tasks are completed, all recovery status behavior labels are summarized, and the number of normal recovery labels, mapping drift continuation labels, key handover anomaly labels, rebinding failure statuses, and recovery chain repeated correction labels are counted to generate a recovery status report.

[0060] like Figure 5 The bar chart showing session recovery deviation assessment uses Session ID (SID) as the classification dimension and recovery deviation assessment value as the quantitative indicator. The dashed lines indicating recovery deviation thresholds visually distinguish the recovery status of different sessions: SID-001, SID-002, SID-004, and SID-006 all have recovery deviations within the threshold, indicating normal recovery; SID-007's recovery deviation slightly exceeds the threshold, indicating a rebinding failure; SID-005's recovery deviation is significantly higher than the threshold, indicating a key transfer anomaly; SID-003's recovery deviation is far higher than the threshold, representing the most severe anomaly, manifesting as a mapping drift continuation problem. This chart clearly presents the recovery health of each session through visual comparison, helping operations personnel quickly locate high-risk sessions and specific anomaly types, providing data support for problem troubleshooting and optimization.

[0061] This implementation scheme effectively distinguishes between normal and abnormal recovery states, and further identifies different anomaly types such as mapping drift continuation, key acceptance anomaly, rebinding failure, and repeated correction of the recovery chain, thereby improving the granularity and interpretability of abnormal recovery identification in disconnection recovery scenarios. At the same time, by summarizing and statistically analyzing the recovery state behavior tags and generating a recovery state report, an overall state distribution result for the multi-session recovery process can be formed.

[0062] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0063] The preferred embodiments of the present invention disclosed above are merely illustrative of the invention. These preferred embodiments do not exhaustively describe all details, nor do they limit the invention to the specific implementations described. Clearly, many modifications and variations can be made based on the content of this specification. This specification selects and specifically describes these embodiments to better explain the principles and practical applications of the invention, thereby enabling those skilled in the art to better understand and utilize the invention. The invention is limited only by the claims and their full scope and equivalents.

Claims

1. A method for implementing quantum-encrypted communication between power cloud and edge devices based on quantum optimization algorithms, characterized in that: Includes the following steps: S1: Obtain gateway operation data, and perform timeline relocation, dynamic denoising and normalization processing to construct a session mapping observation dataset; S2, based on the session mapping observation dataset, constructs a matrix before recovery and a matrix after recovery, evaluates the consistency of the mapping relationship before and after disconnection recovery, and outputs the consistency verification result; S3, based on the consistency verification result, extract the key acceptance status and construct the target acceptance sequence, perform key acceptance evaluation, and perform encrypted channel rebinding; S4. Construct a recovery status discrimination sequence and perform recovery deviation assessment, output recovery status behavior labels and generate a recovery status report.

2. The method for implementing quantum encrypted communication between power cloud and edge devices based on quantum optimization algorithms according to claim 1, characterized in that: The specific steps for acquiring gateway operation data, performing timeline relocation, dynamic denoising and normalization processing, and constructing a session mapping observation dataset are as follows: The entire process of power master station cloud platform, substation or distribution edge security gateway and station access equipment operation is collected to obtain gateway operation data. The gateway operation data includes session ID, security context handle, key chain location index, cache slot number, incremental key reference token and key segment number. A method combining NTP synchronization-based timestamp correction and distributed logical clock sorting is used to reposition the gateway operation data on the time axis and fix the state order misalignment caused by asynchronous reporting by nodes in the disconnection scenario. Using session ID as the primary key, a distributed consistent hash algorithm is used to associate and integrate the session state data of different nodes, and to map and merge the scattered fields of the same session on the cloud, edge and terminal sides. By combining the sliding window interquartile range method of statistics with the local outlier factor algorithm, the gateway operation data is dynamically denoised to filter out null records, duplicate records, and invalid jump records caused by network jitter. The minimum-maximum normalization method is used for normalization. A session mapping observation dataset is constructed and synchronously stored in the cloud management node through a quantum encryption channel using QKD and PQC hybrid encryption. The edge security gateway also retains local cache records. The cloud uses a distributed database to store data according to data type, and the edge node uses a ring buffer overlay storage.

3. The method for implementing quantum encrypted communication between power cloud and edge devices based on quantum optimization algorithms according to claim 1, characterized in that: The specific steps for constructing the pre-recovery and post-recovery matrices based on the session mapping observation dataset are as follows: Based on the session mapping observation dataset, a sliding window sampling method based on disconnection event timestamp alignment is adopted to extract continuous state records with a window length of L before and after disconnection recovery. Each record contains the session ID hash value, the encoded value of the security context handle, and the key chain position index. Arranged in chronological order, the mapping sequence before recovery and the mapping sequence after recovery are obtained. The session ID hash value, security context handle encoding value, and key chain position index at each sampling time in the pre-recovery mapping sequence are used as row vectors and stacked in chronological order to construct the pre-recovery matrix. The number of rows in the matrix is ​​the window length, and the number of columns is three, which correspond to the numerical features of the session identifier, security context handle, and key chain position index, respectively. The restored mapping sequence is constructed into a restored matrix in the same manner.

4. The method for implementing quantum encrypted communication between power cloud and edge devices based on quantum optimization algorithms according to claim 1, characterized in that: The specific steps for evaluating the consistency of the mapping relationship before and after connection restoration are as follows: Each column of the pre-recovery matrix and the post-recovery matrix is ​​weighted according to the weights of the session ID hash value, the security context handle encoding value, and the key chain position index in session map drift detection, to obtain the weighted pre-recovery matrix and the weighted post-recovery matrix; The differences between corresponding elements in the pre-weighted and post-weighted matrices are calculated and substituted into the F-norm to obtain the overall matrix difference. The overall matrix difference is divided by the sum of the F-norm of the pre-weighted matrix and the zero-prevention term, and the negative value of the exponent is taken to obtain the structural similarity index. The product of the F-norm of the pre-weighted matrix and the F-norm of the post-weighted matrix is ​​multiplied by the zero-prevention term to obtain the baseline term. The pre-weighted matrix is ​​transposed and the trace of the post-weighted matrix is ​​performed to obtain the product matrix. The product matrix is ​​divided by the baseline term to obtain the directional consistency index. The directional consistency index is multiplied by the structural similarity index to obtain the mapping consistency evaluation value.

5. The method for implementing quantum-encrypted communication between power cloud and edge devices based on quantum optimization algorithms according to claim 1, characterized in that: The specific steps for outputting the consistency verification result are as follows: The mapping consistency evaluation value and the mapping consistency threshold are compared in real time. When the mapping consistency evaluation value is less than the mapping consistency threshold, it is determined that there is a consistency anomaly in the current mapping relationship after the disconnection is recovered. An abnormal state record is triggered, a mapping drift detection flag is set for the current session, the mapping drift detection flag is set to an abnormal state at the edge node, and the current timestamp and anomaly type code are written at the same time. When the mapping consistency evaluation value is greater than or equal to the mapping consistency threshold, it is determined that the mapping relationship after the current disconnection is restored remains consistent, the current session mapping chain is retained, and the consistency verification result is output.

6. The method for implementing quantum encrypted communication between power cloud and edge devices based on quantum optimization algorithms according to claim 1, characterized in that: The specific steps for extracting the key acceptance status and constructing the target acceptance sequence based on the consistency verification result are as follows: Based on the consistency check results and mapping drift detection flags, when the mapping drift detection flag is abnormal, the old security context corresponding to the original session is frozen, only the session metadata synchronization channel is retained, and the old context is prohibited from continuing to participate in formal encrypted communication. The edge security gateway uses the session ID hash value, security context handle encoding value, and target key chain position index as the joint retrieval key to query the key fragment record corresponding to the current session in the local cache record. When the query is successful, the corresponding key fragment record is extracted and the local actual acceptance sequence is constructed. When the local cache record does not find the corresponding key fragment record, the edge security gateway sends an incremental acceptance request to the cloud management node through the QKD and PQC hybrid encryption channel. The cloud management node returns the incremental key reference token, the target key segment start index, the key segment number sequence of the continuous window length, and the rebinding sequence number according to the incremental acceptance request. The edge security gateway concatenates the target key segment number sequence returned from the cloud with the actual key segment record hit locally in a time sequence. It arranges the key segment number, cache slot number and rebinding sequence number in the state window with a window length of L in order to construct the target acceptance sequence and the actual acceptance sequence. It compares the binding sequence numbers of adjacent state points in the actual acceptance sequence. When the binding sequence number of the later state point is less than the binding sequence number of the earlier state point, it is recorded as a binding rollback event.

7. The method for implementing quantum encrypted communication between power cloud and edge devices based on quantum optimization algorithms according to claim 1, characterized in that: The specific steps for conducting key acceptance evaluation are as follows: The key segment numbers in the target acceptance sequence and the actual acceptance sequence are compared point by point in chronological order. The longest consecutive matching length is obtained by counting consecutive identical key segment numbers. The number of times the cache slot numbers between adjacent state points in the actual acceptance sequence are switched out of order is obtained by counting the number of cache slot jumps. The number of binding rollback events is also counted to obtain the number of binding rollbacks. The longest consecutive matching length is squared to obtain the acceptance term; the number of cache slot transitions is incremented by one to obtain the slot perturbation term; the number of binding rollbacks is incremented by one to obtain the rollback perturbation term; the slot perturbation term and the rollback perturbation term are multiplied to obtain the abnormal perturbation joint term; the acceptance term is used as the numerator, and the sum of the acceptance term, the abnormal perturbation joint term, and the zero-prevention term is used as the denominator to obtain the key acceptance evaluation value.

8. The method for implementing quantum encrypted communication between power cloud and edge devices based on quantum optimization algorithms according to claim 1, characterized in that: The specific steps for performing encrypted channel rebinding are as follows: The key acceptance evaluation value and the key acceptance threshold are compared in real time. When the key acceptance evaluation value is less than the key acceptance threshold, it is determined that the current session still has a key acceptance anomaly after the disconnection is restored, and the current encrypted channel to be restored is frozen. When the key acceptance evaluation value is greater than or equal to the key acceptance threshold, the current session is determined to meet the key acceptance conditions, and the encrypted channel rebinding process is executed. After the encrypted channel rebinding is completed, the edge security gateway sends a rebinding confirmation frame to the end access node. After receiving the rebinding confirmation frame, the end access node refreshes the local session acceptance status and sends back the recovery confirmation flag. After receiving the recovery confirmation flag, the edge security gateway marks the current session as recovered and synchronizes the rebinding sequence number to the cloud management node and local cache record.

9. The method for implementing quantum encrypted communication between power cloud and edge devices based on quantum optimization algorithms according to claim 1, characterized in that: The specific steps for constructing the recovery state discrimination sequence and evaluating the recovery bias are as follows: Check whether the edge security gateway has successfully sent a rebinding confirmation frame to the end-side access node. If successful, it is recorded as the confirmation frame has arrived; if unsuccessful, it is recorded as the confirmation frame has not arrived. Check whether the end-side access node has successfully sent back a recovery confirmation flag in response to the rebinding confirmation frame. If successful, it is recorded as the recovery response has arrived; if unsuccessful, it is recorded as the recovery response is missing. Check whether the formal encrypted communication channel corresponding to the current session has been activated. If activated, it is recorded as activated; if not activated, it is recorded as inactive. Quantize the confirmation frame arrival status, recovery response status, and channel availability status respectively, and use the sigmoid function to perform a nonlinear mapping on the weighted sum of the three to obtain the communication stability value of the current state point. Arrange the mapping consistency evaluation value, communication stability value and key acceptance evaluation value corresponding to each state point in a continuous fixed state window in chronological order to construct a recovery state discrimination sequence. The number of state points within a continuous window of length is obtained by sampling through a sliding window; a state point index is generated based on the time series index within the continuous window of length; the difference between the mapping consistency evaluation values ​​before and after is calculated to obtain the mapping fluctuation term; the difference between the key acceptance evaluation values ​​before and after is calculated to obtain the acceptance fluctuation term; the difference between the communication stable state values ​​before and after is calculated to obtain the communication fluctuation term. Multiplying the mapped fluctuation term by the received fluctuation term yields the coupling term; Divide the communication fluctuation term by 1 and sum the absolute values ​​of the differences between the mapping fluctuation term and the receiving fluctuation term to obtain the disturbance adjustment term; add the coupling term and the disturbance adjustment term and substitute them into the hyperbolic tangent function to obtain the local recovery deviation term; multiply and accumulate all local recovery deviation terms within the continuous window length, and subtract the result of the multiplication by 1 to obtain the recovery deviation evaluation value.

10. The method for implementing quantum encrypted communication between power cloud and edge devices based on quantum optimization algorithms according to claim 1, characterized in that: The specific steps for outputting recovery status behavior labels and generating a recovery status report are as follows: The system compares the recovery deviation assessment value and the recovery deviation threshold in real time. When the recovery deviation assessment value is less than or equal to the recovery deviation threshold, and the recovery confirmation flag for the current session is successful, the current recovery segment is determined to be in a normal recovery state. When the recovery deviation assessment value is greater than the recovery deviation threshold, the current recovery segment is determined to have an abnormal recovery risk, the current session is marked as an abnormal recovery segment, and the system enters the local anomaly analysis process to determine the characteristics of the abnormal recovery segment. The recovery status type is structurally bound to the current session ID hash value, node number, exception type code, recovery confirmation flag, and current valid key segment number to generate a recovery status behavior label; In the local anomaly resolution process, an isolation correction flag is set for the session in the anomaly recovery segment, and the current timestamp, node identifier, and anomaly type code are written. After all session recovery tasks are completed, summarize all recovery status behavior tags and generate a recovery status report.

Images