A power grid device-oriented secure access method, system, device and medium

Abstract

The application discloses a kind of security access methods, systems, equipment and medium for power grid equipment, which is characterized in that, comprising: obtaining the anonymous attribute credential corresponding to the power grid equipment to be accessed;Collect the start state information, program running information and configuration state information of the power grid equipment to be accessed on the agent side, respectively calculate the corresponding digest value to generate device integrity measurement digest;Based on anonymous attribute credential, device integrity measurement digest and preset access strategy, generate access proof information;Determine session-associated access proof based on access proof information and the current communication session obtained;Receive the verification result information corresponding to session-associated access proof to determine the security access state;When the security access state is the access state allowed, obtain the write control instruction, control the data interaction between the power grid equipment to be accessed and the target access object based on the write control instruction.The present application can improve the security and reliability of power grid equipment in the access process.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a secure access method, system, device, and medium for power grid equipment. Background Technology

[0002] With the continuous advancement of smart grid, digital substation, and new power system construction, the number of terminal equipment, protection devices, automated control equipment, and edge computing nodes in the power grid is constantly increasing, and the demand for data interaction between power grid equipment and dispatching systems, station control systems, and operation and maintenance management platforms is constantly strengthening. Due to the increasing number of power grid equipment access objects, the more complex communication environment, and the continuous development of remote control services, traditional secure access methods relying on network boundary isolation and fixed identity authentication are no longer sufficient to meet the current secure access requirements of power grid equipment in open network environments.

[0003] Existing secure access technologies for power grid equipment typically rely on device identity information, digital certificates, or access permission information for access verification, and execute corresponding data interaction controls after establishing a communication session. However, these methods still have certain shortcomings in practical applications: Firstly, existing technologies rely on a single criterion for judging the trustworthiness of device access, making it difficult to simultaneously verify the legitimacy of the device's identity attributes and the trustworthiness of the device's current operating environment, potentially leading to access risks from abnormal devices or devices with untrusted operating states. Secondly, existing technologies usually focus on permission judgments during the communication connection establishment process, lacking a verification mechanism for command-level access control of specific interaction requests during the access process, making it difficult to identify and block abnormal access behaviors in a timely manner. Furthermore, in complex power grid operating environments, when the communication status changes or the access policy needs to be updated, existing technologies cannot guarantee the continued validity of the access status, thus affecting the security, stability, and reliability of the power grid equipment access process. Summary of the Invention

[0004] This invention provides a secure access method, system, device, and medium for power grid equipment, which can improve the security and reliability of power grid equipment during the access process.

[0005] In a first aspect, embodiments of the present invention provide a secure access method for power grid equipment, comprising: Obtain the anonymous attribute certificate corresponding to the power grid equipment to be connected; The startup status information, program running information, and configuration status information of the equipment to be connected to the power grid are collected on the agent side. The digest values ​​corresponding to the startup status information, program running information, and configuration status information are calculated respectively, so as to generate a device integrity metric digest based on each digest value. Based on the anonymous attribute credential, the device integrity metric digest, and the preset access policy, access proof information is generated. Obtain the current communication session between the power grid device to be connected and the secure access management platform, and determine the session-associated access certificate based on the access certificate information and the current communication session; Receive the verification result information corresponding to the session-associated access certificate, and determine the security access status of the power grid equipment to be accessed based on the verification result information; When the secure access state is the allowed access state, a write control instruction to be executed is obtained, and the power grid equipment to be accessed and the target access object are controlled to interact with each other based on the write control instruction to be executed.

[0006] This invention reduces the risk of sensitive identity information leakage and improves the security and reliability of power grid devices during the access process by enabling devices to provide attribute proof for trusted verification to the secure access management platform without directly exposing their complete device identity information. Furthermore, it enables the secure access management platform to comprehensively assess the current trusted operating status of devices based on their startup environment, program running status, and configuration status, preventing devices with abnormal operating states or tampered proxy environments from accessing the power grid system, thus improving the security and reliability of power grid devices during the access process. Finally, it enables devices to prove that their attributes meet access requirements and their operating status meets trusted conditions without directly submitting sensitive attribute information, thereby achieving joint verification of device identity trustworthiness and operating environment trustworthiness, and improving the security and reliability of power grid devices during the access process. The system enhances the security and reliability of the access process. By establishing a correlation between access authentication information and the current communication process, it prevents the reuse of historical access credentials or their incorrect binding to other communication processes, thereby improving the effectiveness of the power grid equipment access authentication process and enhancing the security and reliability of power grid equipment during access. Furthermore, by dynamically determining whether a power grid equipment to be accessed is qualified based on the access credentials verification results, it prevents unverified devices from entering the power grid business environment, thereby improving the accuracy of power grid equipment access control and enhancing the security and reliability of power grid equipment during access. Finally, by ensuring that only devices that have passed secure access verification can further perform subsequent control interaction operations, it prevents unauthorized or illegal devices from participating in the power grid control process, thereby enhancing the interaction security of power grid equipment after access and enhancing the security and reliability of power grid equipment during access.

[0007] Furthermore, the step of calculating the digest values ​​corresponding to the startup status information, the program running information, and the configuration status information, respectively, to generate a device integrity metric digest based on each digest value, includes: The startup state information, the program running information, and the configuration state information are calculated using a preset cryptographic hash algorithm to obtain the startup firmware digest, the proof generation program digest, the protocol normalization rule digest, and the command template cache file digest, respectively. The device integrity metric summary is generated based on the boot firmware summary, the proof generation program summary, the protocol normalization rule summary, and the command template cache file summary.

[0008] The above steps involve calculating digests for the startup firmware, proof generation program, protocol standardization rules, and command template cache file of the equipment to be connected to the power grid, and generating a device integrity metric digest based on each digest value. This enables the secure access management platform to accurately determine whether the critical operating environment of the access agent on the device side has undergone abnormal changes, avoiding unauthorized access due to program tampering, abnormal configuration, or untrusted operating environment, thereby improving the security and reliability of power grid equipment during the access process.

[0009] Furthermore, the step of generating access proof information based on the anonymous attribute credential, the device integrity metric digest, and the preset access policy includes: Obtain random challenge information, and obtain the credential index information corresponding to the anonymous attribute credential and the protected attribute information in the anonymous attribute credential; The access policy is compiled into an access proof circuit, and the random challenge information, the device integrity metric digest, the credential index information, and the protected attribute information are input into the access proof circuit for calculation to obtain the access proof information.

[0010] The above steps convert the access policy into an access proof circuit and combine random challenge information, device integrity metric digest, and protected attribute information in anonymous attribute credentials to generate access proof information. This enables the grid equipment to complete access qualification verification without exposing sensitive attribute content, while ensuring the validity and replay resistance of the access proof, thereby improving the security and reliability of grid equipment during the access process.

[0011] Furthermore, the step of obtaining the current communication session between the power grid device to be connected and the secure access management platform, in order to determine the session-associated access certificate based on the access certificate information and the current communication session, includes: Obtain the current communication session between the power grid device to be connected and the secure access management platform, and calculate the digest value of the session key information corresponding to the current communication session to obtain the current session public key digest; Write the current session public key digest into a preset data bit in the access proof information to perform association binding and generate the session association access proof.

[0012] The above steps associate and bind the session key information digest corresponding to the current communication session with the access certificate information, so that the access certificate has a unique correspondence with the current communication process, preventing the access certificate from being copied to other sessions for reuse, thereby enhancing the effectiveness of the access authentication process and the anti-replay capability, and improving the security and reliability of power grid equipment during the access process.

[0013] Furthermore, receiving the verification result information corresponding to the session-associated access certificate and determining the security access status of the power grid device to be accessed based on the verification result information includes: Receive the verification result information corresponding to the session-associated access proof, wherein the verification result information includes the anonymous attribute credential verification result, the device integrity metric digest comparison result, and the credential revocation status verification result; When the anonymous attribute credential verification result is that the anonymous attribute credential satisfies the access policy, the device integrity metric digest comparison result is that the device integrity metric digest is consistent with the preset integrity baseline, and the credential revocation status verification result is that the anonymous attribute credential is in a valid state, the secure access state is determined to be an allowed access state. If any verification result in the verification result information does not meet the corresponding verification pass condition, the secure access status is determined to be access denied status.

[0014] The above steps comprehensively assess the validity of anonymous attribute credentials, the consistency of device integrity metric digests, and the credential revocation status. This allows for the determination of access to the power grid from multiple dimensions, including device identity attributes, the trustworthiness of the operating environment, and credential validity. This prevents abnormal or untrusted devices from accessing the power grid system, thereby improving the security and reliability of power grid devices during the access process.

[0015] Furthermore, the step of controlling the grid access device to interact with the target access object based on the write control instruction to be executed includes: Obtain the write control command to be executed corresponding to the power grid device to be connected; The execution of the write control instruction is semantically parsed and field normalized according to the preset protocol rules, so as to convert the execution of the write control instruction into a unified command tuple, and a command digest is generated based on the unified command tuple; Obtain the main authorization token corresponding to the current communication session, and generate a one-time sub-authorization token based on the command digest, the current session public key digest, and the object identifier corresponding to the target access object; Based on the command digest, the one-time sub-authorization token, and the preset command template set, an instruction proof is generated; The validity of the main authorization token, the one-time sub-authorization token, and the instruction proof is verified until the verification is successful. Then, the write control instruction to be executed is sent to the target access object.

[0016] The above steps achieve independent authorization verification of specific write control commands by performing unified semantic parsing on the write control commands to be executed and generating command proofs by combining one-time sub-authorization tokens and command templates. This prevents established sessions from being abused to execute unauthorized operations and ensures that the issued commands meet preset control constraints, thereby improving the security and reliability of power grid equipment during the access process.

[0017] Secondly, embodiments of the present invention provide a secure access system for power grid equipment, comprising: a credential acquisition module, an integrity measurement module, a proof generation module, a session binding module, an access determination module, and an instruction control module; The credential acquisition module is used to acquire the anonymous attribute credential corresponding to the power grid equipment to be connected; The integrity measurement module is used to collect the startup status information, program running information, and configuration status information of the grid-connected equipment on the agent side, and calculate the summary values ​​corresponding to the startup status information, program running information, and configuration status information respectively, so as to generate a device integrity measurement summary based on each summary value. The proof generation module is used to generate access proof information based on the anonymous attribute credential, the device integrity metric digest, and the preset access policy. The session binding module is used to obtain the current communication session between the power grid equipment to be connected and the secure access management platform, so as to determine the session-associated access certificate based on the access certificate information and the current communication session; The access determination module is used to receive the verification result information corresponding to the session-associated access certificate, and determine the security access status of the power grid equipment to be accessed based on the verification result information. The instruction control module is used to acquire a write control instruction to be executed when the secure access state is an allowed access state, so as to control the grid device to be connected and the target access object to perform data interaction based on the write control instruction to be executed.

[0018] Thirdly, embodiments of the present invention provide a terminal device, including: a processor, a memory, a communication interface, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus; The memory is used to store at least one executable instruction that causes the processor to perform operations as described in this application of a secure access method for power grid equipment.

[0019] Fourthly, embodiments of the present invention provide a computer-readable storage medium comprising a stored computer program, wherein, when the computer program is executed, it controls the device or system where the computer-readable storage medium is located to perform a secure access method for power grid equipment as described in this application.

[0020] The above description is merely an overview of the technical solutions of the embodiments of the present invention. In order to better understand the technical means of the embodiments of the present invention and to implement them in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the embodiments of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0021] To more clearly illustrate the technical solution of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0022] Figure 1 This is a flowchart illustrating one embodiment of a secure access method for power grid equipment provided in this application; Figure 2 This is a schematic diagram of the process for generating the device integrity metric summary provided in this application; Figure 3 This is a schematic diagram of the process for generating access proof based on anonymous attribute credentials provided in this application; Figure 4 This is a schematic diagram of the write control process based on instruction-level authorization provided in this application; Figure 5 This is a schematic diagram of an embodiment of a secure access system for power grid equipment provided in this application. Detailed Implementation

[0023] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0024] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0025] In the description of the embodiments of this application, technical terms such as "first" and "second" are used only to distinguish different objects and should not be construed as indicating or implying relative importance or implicitly specifying the number, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, "multiple" means two or more, unless otherwise explicitly defined.

[0026] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0027] In the description of the embodiments in this application, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this document generally indicates that the preceding and following related objects have an "or" relationship.

[0028] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), similarly, "multiple sets" refers to two or more (including two sets), and "multiple pieces" refers to two or more (including two pieces).

[0029] In the description of the embodiments of this application, unless otherwise expressly specified and limited, technical terms such as "installation," "connection," "joining," and "fixing" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral part; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; they can refer to the internal communication of two components or the interaction between two components. For those skilled in the art, the specific meaning of the above terms in the embodiments of this application can be understood according to the specific circumstances.

[0030] With the surge in the number of power grid devices and the increasing complexity of the communication environment, traditional access methods based on identity, certificates, or permissions have shortcomings such as single verification criteria, lack of instruction-level access control, and difficulty in adapting to dynamic policy updates. This makes it difficult to fully assess the trustworthiness of device identity and operating environment, difficult to block abnormal behavior in a timely manner, and the continued validity of access status cannot be guaranteed when communication status changes, thus affecting the security, stability, and reliability of power grid device access.

[0031] See Figure 1 In order to improve the security and reliability of power grid equipment during the access process, an embodiment of the present invention provides a secure access method for power grid equipment, including steps S101 to S106. Step S101: Obtain the anonymous attribute certificate corresponding to the power grid device to be connected; In some embodiments, anonymous attribute credentials are pre-generated based on the device root key of the grid device to be connected and a binding relationship is established with the grid device. When the grid device to be connected completes registration initialization, the device root key stored in the security chip, trusted execution environment, or other trusted key storage medium with anti-export capability on the grid device side is obtained, and the identity of the grid device to be connected is initialized based on the device root key. Anonymous attribute credentials are generated according to the device registration information corresponding to the grid device to be connected. The device registration information includes at least the device category, its subdomain, manufacturer identifier, protocol capability set, licensed operation level, valid start time, valid end time, and credential sequence information. Anonymous attribute credentials are used to describe the attribute information of the grid device to be connected that meets the secure access conditions in the form of anonymous attributes, without directly containing the complete registration identifier of the grid device to be connected. This allows the grid device to prove its corresponding access qualifications during subsequent access verification, while avoiding the direct exposure of sensitive identity information. Corresponding credential index information is generated based on the anonymous attribute credentials, and the credential index information is associated with and saved with the valid status of the anonymous attribute credentials for subsequent verification of whether the anonymous attribute credentials are in a valid state. The corresponding traceability seed is generated based on the anonymous attribute certificate, and the traceability seed is mapped and saved to the registration identifier of the power grid equipment to be connected. The traceability seed is not directly disclosed during normal access verification, control interaction and auditing, and is only used to restore the registration identifier of the power grid equipment to be connected when the preset traceability conditions are met.

[0032] Through the above steps, the access qualifications of the devices to be connected to the power grid are described in a privacy-preserving manner using anonymous attribute credentials, enabling the devices to complete trusted access verification without exposing their complete identity information. At the same time, the validity status of credentials is managed through credential index information, and controlled traceability is maintained through traceability association seeds, thereby taking into account the needs of identity privacy protection, security verification, and post-event responsibility tracking during the power grid device access process.

[0033] Step S102: Collect the startup status information, program running information, and configuration status information of the power grid equipment to be connected on the agent side, and calculate the summary values ​​corresponding to the startup status information, program running information, and configuration status information respectively, so as to generate a device integrity metric summary based on each summary value; Please refer to Figure 2 In some embodiments, the step of calculating the digest values ​​corresponding to the startup status information, the program running information, and the configuration status information respectively, and generating a device integrity metric digest based on each digest value, includes: steps S201 to S202. Step S201: The startup state information, the program running information, and the configuration state information are calculated using a preset cryptographic hash algorithm to obtain the startup firmware digest, the proof generation program digest, the protocol normalization rule digest, and the command template cache file digest, respectively. Step S202: Generate the device integrity metric digest based on the boot firmware digest, the proof generation program digest, the protocol normalization rule digest, and the command template cache file digest.

[0034] In this first embodiment, to ensure the reliability of the access agent's operating environment on the grid-connected device side, after the grid-connected device is started, the integrity of the key programs, configuration files, and rule files that the device-side access agent currently relies on is measured. After the device-side access agent starts, it obtains the startup firmware information loaded during the current startup phase. This startup firmware information includes firmware version information, firmware code files, and startup configuration parameters loaded during the device-side access agent's startup process. After obtaining the startup firmware information, it reads the firmware information byte-by-byte according to a preset data reading order, and inputs the read firmware data into a preset cryptographic hash algorithm for hash calculation. The cryptographic hash algorithm can be SHA-256, SM3, or other hash algorithms that meet integrity verification requirements. Through hash calculation, the startup firmware data of variable length is converted into a hash result of fixed length, and this hash result is used as the startup firmware digest. The device-side access agent obtains the proof generation program information currently used to generate access proofs and instruction proofs. This proof generation program information includes at least the proof generation program code file, program version information, and program runtime dependency files. The proof generation program information is sorted according to a preset file organization structure. The sorted program file content and corresponding version information are combined to form the program data to be calculated. The program data to be calculated is then calculated using a cryptographic hash algorithm to obtain the corresponding hash value. This hash value is used as the proof generation program digest.

[0035] In this first embodiment, the device-side access agent obtains the currently stored protocol standardization rule file information. This file describes the control field parsing methods and control semantic conversion relationships in different industrial communication protocols. For example, for the IEC 61850 MMS protocol, IEC 60870-5-104 protocol, DNP3 protocol, and Modbus protocol, the protocol standardization rule file information stores the corresponding protocol's data field mapping relationships, object identifier parsing rules, and operation type conversion rules. After obtaining the protocol standardization rule file information, the agent combines the protocol type identifier, field mapping table, parsing rule parameters, and version information contained therein, and calculates the corresponding hash value using a cryptographic hash algorithm. This hash value is then used as the protocol standardization rule digest. The device-side access agent also obtains the currently cached command template file information. This file stores the command template set issued by the secure access management platform. The command template set includes the allowed object range, allowed operation type, parameter value range, execution time window, and response constraint information corresponding to different target access objects. The command templates in the currently cached command template file are sorted according to a preset arrangement rule, and the template content, template version information and template index information corresponding to each command template are combined to form the template data to be calculated. The template data to be calculated is hashed using a cryptographic hash algorithm to obtain the corresponding hash value, and the hash value is used as the digest of the command template cache file.

[0036] In this first embodiment, the boot firmware digest, proof generation program digest, protocol normalization rule digest, and command template cache file digest are arranged and combined according to a preset combination order to form an integrity digest set. The preset combination order is consistent with the digest arrangement order in the integrity baseline pre-saved by the secure access management platform. For example, the four types of digests can be combined sequentially according to the order of boot environment, proof generation environment, protocol processing environment, and control rule environment, so that the generated device integrity metric digest can correspond to the overall state of each key operational stage of the device-side access agent. The integrity digest set is input into a preset combination hash process for secondary hash calculation to obtain the final fixed-length digest value, which is then determined as the device integrity metric digest. The secure access management platform pre-saved the integrity baseline information corresponding to trusted devices. The integrity baseline information is generated by the device in a trusted state using the same digest calculation method. When the device to be connected to the power grid subsequently initiates an access request, it sends the currently generated device integrity metric digest to the secure access management platform, which then compares it with the corresponding integrity baseline. If the current device integrity metric summary is consistent with the preset integrity baseline, it means that the startup environment, proof generation program, protocol processing rules, and command template cache content of the access agent on the power grid side to be connected have not been modified without authorization, and the current device operation status meets the trusted access requirements; if the two are inconsistent, it means that at least one key operating component has changed, and the device needs to be rejected from continuing to execute the subsequent access proof process.

[0037] Through the above steps, by performing multi-dimensional integrity measurements on the startup firmware, proof generation program, protocol standardization rules, and command template cache files of the device-side access agent, and generating a unified device integrity measurement summary, the secure access management platform can accurately determine whether the device's operating environment is trustworthy, avoiding untrusted device access caused by program tampering, rule anomalies, or illegal configuration modifications, thereby improving the security and reliability of the zero-trust access process for power grid equipment.

[0038] Step S103: Generate access proof information based on the anonymous attribute credential, the device integrity metric digest, and the preset access policy; Please refer to Figure 3 In some embodiments, generating access proof information based on the anonymous attribute credential, the device integrity metric digest, and the preset access policy includes steps S301 to S302. Step S301: Obtain random challenge information, and obtain the credential index information corresponding to the anonymous attribute credential and the protected attribute information in the anonymous attribute credential; Step S302: Compile the access policy into an access proof circuit, and input the random challenge information, the device integrity metric digest, the credential index information, and the protected attribute information into the access proof circuit for calculation to obtain the access proof information.

[0039] In this first embodiment, when a device seeking to access the power grid requests access to a target access object, the secure access management platform first generates random challenge information based on the current access request and sends the random challenge information to the device-side access agent. The random challenge information is used to associate with the current access verification process, enabling the device-side access agent to generate a unique access certificate for the current access request, preventing the reuse of historical access certificates. The secure access management platform can generate a random string of a preset length based on a random number generation algorithm and use this random string as the random challenge information corresponding to the current access verification. The random challenge information can be generated by combining the target access object identifier corresponding to the current access request, the current time information, and a random seed to ensure that the random challenge information corresponding to different access requests is not duplicated. After receiving the random challenge information, the device-side access agent reads the anonymous attribute certificate corresponding to the device seeking to access the power grid from its local protected storage area. The anonymous attribute certificate contains attribute information used to prove that the device is qualified to access, but does not directly disclose the complete identity information of the device. The device-side access agent reads the corresponding certificate index information from the anonymous attribute certificate. The certificate index information is used to uniquely associate with the current anonymous attribute certificate and is associated with the validity status, revocation status, and version status of the anonymous attribute certificate. After reading the credential index information, the device-side access agent uses it as public input in the subsequent access certificate generation process. This allows the secure access management platform to query the corresponding credential status based on the credential index information without needing to obtain the full content of the anonymous attribute credential. According to preset attribute protection rules, the device-side access agent extracts protected attribute information from the anonymous attribute credential. This protected attribute information includes, but is not limited to, device category, domain, protocol capability set, licensed operation level, and valid time range—attributes used to determine whether the device meets the access conditions. This protected attribute information is not directly sent to the secure access management platform but is used as private witness information in the certificate generation process.

[0040] In this first embodiment, before generating the access certificate, the secure access management platform first obtains the currently valid access policy based on the access control requirements corresponding to the target access object. The access policy is used to limit the constraints that the grid equipment to be accessed must meet when establishing a communication session. The access policy includes at least device attribute constraints, device integrity constraints, credential validity constraints, and access environment constraints. For example, device attribute constraints are used to determine whether the device category, station domain, and protocol capabilities in the anonymous attribute credential meet the access requirements of the target access object; device integrity constraints are used to determine whether the current operating status of the device-side access agent meets the trust requirements; credential validity constraints are used to determine whether the anonymous attribute credential is in a valid state; and access environment constraints are used to restrict access time or other operating conditions. The above access policy is converted into a verifiable access certificate circuit; based on the various constraints in the access policy, different judgment logics are converted into corresponding circuit constraint relationships. For example, for device attribute constraints, the data corresponding to the protected attributes in the anonymous attribute credential is encoded as circuit input, and attribute comparison logic is set up so that the access verification circuit can verify whether the protected attributes meet the preset device category range, site range, and permitted operation level requirements; for device integrity constraints, the device integrity metric digest is used as circuit input, and digest matching logic is set up so that the access verification circuit can verify whether the current device integrity metric digest corresponds to a trusted operating state; for credential validity constraints, the valid state corresponding to the credential index information is used as the verification condition so that the access verification circuit can determine whether the current anonymous attribute credential is allowed to continue to be used.

[0041] In this first embodiment, after obtaining the access proof circuit, the device-side access agent uses random challenge information, device integrity metric digest, credential index information, and protected attribute information as inputs for proof generation, and performs proof calculation in conjunction with the private proof materials corresponding to the anonymous attribute credential. The device-side access agent first inputs the random challenge information into the access proof circuit to bind the generated access proof to the current access request; it then inputs the device integrity metric digest into the access proof circuit to prove that the current device operating environment meets integrity requirements; it inputs the credential index information into the access proof circuit to associate it with the status of the currently used anonymous attribute credential; and it inputs the protected attribute information into the access proof circuit to prove that the attributes in the anonymous attribute credential satisfy the current access policy. During the proof calculation process, the device-side access agent does not directly output the protected attribute information, but instead generates the corresponding proof result through zero-knowledge proof, enabling the verification end to verify that the device has attributes that meet the access policy requirements, but without obtaining the specific attribute content of the device. After completing the calculation, the access proof circuit outputs the corresponding access proof information; the access proof information includes at least proof of the validity of the anonymous attribute credential, proof that the attributes of the anonymous attribute credential satisfy the access policy, proof of binding of the device integrity metric digest, and proof that the anonymous attribute credential is not in a revoked state. The device-side access agent sends the access authentication information to the secure access management platform for verification. The secure access management platform verifies the access authentication information based on pre-saved verification information, integrity baseline, and the current valid policy version. When the verification is successful, it indicates that the grid device to be connected has the legal attributes, the current operating environment is trustworthy, and the anonymous attribute certificate is valid, thus allowing the subsequent establishment of a controlled communication session.

[0042] Through the above steps, and by using an access proof generation mechanism based on zero-knowledge proof, the joint verification of the legality of device attributes, the trustworthiness of the operating environment, and the validity of credentials can be achieved without disclosing sensitive device attribute information. This avoids the problems of sensitive information exposure and proof reuse in traditional identity authentication, thereby improving the security, privacy protection, and anti-attack capabilities of the power grid equipment access process.

[0043] Step S104: Obtain the current communication session between the power grid device to be connected and the secure access management platform, so as to determine the session-associated access certificate based on the access certificate information and the current communication session; In some embodiments, obtaining the current communication session between the grid device to be connected and the secure access management platform, and determining the session-associated access certificate based on the access certificate information and the current communication session, includes: obtaining the current communication session between the grid device to be connected and the secure access management platform, calculating the digest value of the session key information corresponding to the current communication session to obtain the current session public key digest; writing the current session public key digest into a preset data bit in the access certificate information for association binding, and generating the session-associated access certificate.

[0044] In some embodiments, the current communication session between the grid device to be connected and the secure access management platform is obtained, and the digest value of the session key information corresponding to the current communication session is calculated to obtain the current session public key digest. Specifically, after the grid device to be connected completes the initial communication connection, the access agent on the grid device side and the secure access management platform first establish a current communication session. The access agent on the grid device side sends a session establishment request to the secure access management platform. The session establishment request may include temporary session parameters generated by the device-side access agent, communication negotiation information, and the target access object identifier. After receiving the session establishment request, the secure access management platform negotiates the session with the device-side access agent according to the currently supported communication security protocol to generate the corresponding session key information. The current communication session is used to limit the scope of subsequent proof interactions between the grid device to be connected and the secure access management platform. The session key information includes at least one or more of the following: session public key, session key negotiation parameters, and session valid identifier; wherein, the session public key is used to characterize the unique cryptographic association corresponding to the current communication session, so as to form isolation between different communication sessions and avoid the repeated application of historical session information to new access processes.

[0045] In some embodiments, after obtaining the session key information corresponding to the current communication session, the access agent or secure access management platform on the power grid device side performs a digest calculation on the session key information according to a preset cryptographic hash rule. The session public key, session negotiation random number, and session identifier information in the session key information are concatenated in a preset order to form data to be digested. This data is then input into a preset cryptographic hash algorithm for calculation, yielding a fixed-length digest result, which is used as the current session public key digest. For example, when the power grid device to be connected establishes a new communication session with the secure access management platform, the device-side access agent obtains the session public key information corresponding to the current session and combines it with the current communication session generation time information and the session unique identifier information to form session association data. After calculating the session association data using a cryptographic hash algorithm, the current session public key digest is obtained. The current session public key digest does not directly represent the original session key content but serves as a unique association identifier for the current communication session, used to subsequently bind access proof information with the current communication state.

[0046] In some embodiments, the current session public key digest is written into a preset data bit in the access proof information for association and binding, generating the session-associated access proof. Specifically, after obtaining the current session public key digest, the device-side access agent obtains the pre-generated access proof information. The access proof information is a comprehensive proof result calculated based on anonymous attribute credentials, device integrity metric digests, and access proof circuits. It is used to prove that the grid device to be accessed has legitimate access attributes, the current operating environment meets the trust requirements, and the anonymous attribute credentials are not in a revoked state. To establish a unique association between the access proof information and the current communication session, data bits for storing session association information are preset when generating the access proof information. The preset data bits can be located in the session association field in the data structure of the access proof information, used to carry the association digest information corresponding to the current communication session. The device-side access agent reads the preset data bits in the access proof information, writes the current session public key digest into the preset data bits, and combines the original content of the access proof information and the current session public key digest according to preset encoding rules to obtain the associated proof data. The integrity check value is recalculated or associated signature information is generated for the associated proof data to ensure that the integrity of the access proof information is not compromised after the current session public key digest is written, and finally, session-associated access proof is generated.

[0047] It should be noted that the access proof information may include fields for proving the validity of anonymous attribute credentials, proving that attributes satisfy the access policy, proving the binding of device integrity metric digests, proving the credential revocation status, and the session association field. Specifically, the device-side access proxy writes the current session public key digest into the session association field, enabling the access proof verification module to simultaneously verify whether the access proof content meets the access policy requirements and whether the access proof corresponds to the current communication session upon receiving the session-associated access proof. When the secure access management platform receives the session-associated access proof, it first extracts the current session public key digest and compares it with the session key digest corresponding to the current communication session. If they match, the access proof information originates from the current communication session; if they do not match, the access proof information may originate from other historical sessions or be at risk of being tampered with, and the secure access management platform refuses to continue the subsequent verification process.

[0048] By binding the session public key digest corresponding to the current communication session to the access proof information through the above steps, a unique association is established between the access proof and the specific communication session, avoiding the replay or reuse of historical proofs across sessions; at the same time, session integrity verification is achieved without exposing the original session key information, thereby improving the security and reliability of the power grid equipment access authentication process.

[0049] Step S105: Receive the verification result information corresponding to the session-associated access certificate, and determine the security access status of the power grid device to be accessed based on the verification result information; In some embodiments, receiving the verification result information corresponding to the session-associated access certificate and determining the security access status of the grid device to be accessed based on the verification result information includes: receiving the verification result information corresponding to the session-associated access certificate, wherein the verification result information includes anonymity attribute credential verification result, device integrity metric digest comparison result, and credential revocation status verification result; when the anonymity attribute credential verification result is that the anonymity attribute credential satisfies the access policy, the device integrity metric digest comparison result is that the device integrity metric digest is consistent with a preset integrity baseline, and the credential revocation status verification result is that the anonymity attribute credential is in a valid state, the security access status is determined to be an allowed access state; when any verification result in the verification result information does not meet the corresponding verification pass condition, the security access status is determined to be a denied access state.

[0050] In some embodiments, verification result information corresponding to the session-associated access certificate is received. This verification result information includes anonymous attribute credential verification results, device integrity metric digest comparison results, and credential revocation status verification results. Specifically, after the grid device to be connected completes the generation of the session-associated access certificate, the device-side access agent sends the session-associated access certificate to the secure access management platform, which then verifies the certificate. The secure access management platform first obtains the verification information corresponding to the current access certificate. This verification information includes at least the verification parameters corresponding to the access certificate circuit, the current valid access policy version, anonymous attribute credential status information, and preset integrity baseline information. During verification, the secure access management platform first parses the access certificate subject information, the current session public key digest, anonymous attribute credential association information, and device integrity metric digest from the session-associated access certificate. Based on the verification parameters corresponding to the access certificate circuit, zero-knowledge proof verification is performed on the access certificate subject information to determine whether the anonymous attribute credential provided by the grid device to be connected meets the requirements of the current access policy. The anonymous attribute credential verification process specifically includes: querying the status information of the corresponding anonymous attribute credential based on the credential index information contained in the access certificate; and verifying whether the grid device to be accessed meets the device category requirements, substation domain requirements, protocol capability requirements, permitted operation level requirements, and valid time range requirements in the access policy based on the proof result corresponding to the protected attribute in the anonymous attribute credential. For example, when the access policy requires that only devices belonging to a specified substation domain, possessing specified protocol capabilities, and within the valid time range are allowed to establish communication sessions, the secure access management platform determines whether the grid device to be accessed meets the above constraints by verifying the attribute proof result corresponding to the anonymous attribute credential, without needing to obtain the complete identity information of the device.

[0051] In some embodiments, after completing the anonymous attribute credential verification, the secure access management platform obtains the device integrity metric digest from the session-associated access certificate and reads the pre-saved integrity baseline information. The secure access management platform obtains the boot firmware digest, certificate generation program digest, protocol normalization rule digest, and command template cache file digest from the device integrity metric digest, and compares each digest with the corresponding integrity baseline to obtain the device integrity metric digest comparison result. Based on the credential index information in the session-associated access certificate, the secure access management platform queries the revocation status information corresponding to the anonymous attribute credential and determines whether the anonymous attribute credential is in a valid usage state. If the anonymous attribute credential has not been revoked and the credential version information is compatible with the current policy version information, a credential revocation status verification pass result is generated. After completing the above verifications, the secure access management platform combines the anonymous attribute credential verification result, the device integrity metric digest comparison result, and the credential revocation status verification result to generate corresponding verification result information; wherein, the verification result information includes at least the pass status, failure status, and failure reason identifier for each verification item, so that corresponding secure access control can be executed according to different verification results.

[0052] In some embodiments, when the anonymous attribute credential verification result is that the anonymous attribute credential satisfies the access policy, the device integrity metric digest comparison result is that the device integrity metric digest is consistent with the preset integrity baseline, and the credential revocation status verification result is that the anonymous attribute credential is in a valid state, the secure access state is determined to be an allowed access state. Specifically, after receiving the verification result information corresponding to the session-associated access certificate, the secure access management platform jointly judges the anonymous attribute credential verification result, the device integrity metric digest comparison result, and the credential revocation status verification result contained therein. The secure access management platform first determines whether the anonymous attribute credential verification result meets the requirements of the current access policy; if the anonymous attribute credential verification result shows that the device category, substation domain, protocol capability, permitted operation level, and valid time range corresponding to the grid device to be accessed all meet the preset access conditions, then the anonymous attribute credential is determined to have the attribute qualification to establish a controlled communication session. The secure access management platform determines whether the device integrity metric digest comparison result is consistent; the startup firmware digest, certificate generation program digest, protocol normalization rule digest, and command template cache file digest uploaded by the device-side access agent are matched with the corresponding digests in the preset integrity baseline. When all digests are consistent, it indicates that the key operating environment, proof generation procedures, and protocol processing rules of the current device-side access agent have not undergone abnormal modifications, confirming that the device's operating environment meets the trust requirements. The secure access management platform determines whether the credential revocation status verification result indicates that the anonymous attribute credential is valid. If the query result shows that the anonymous attribute credential has not been revoked, and the credential version information, policy version information, and validity time information all meet the current operating requirements, then it is determined that the anonymous attribute credential can continue to be used for device access verification. When the above three verification conditions are met simultaneously, it indicates that the grid device to be accessed not only has the anonymous attribute qualification to meet the access policy requirements, but also that the current operating environment is in a trust state, and the anonymous attribute credential used is not invalid. Therefore, the secure access management platform determines the secure access status corresponding to the grid device to be accessed as an allowed access status and sends status information allowing the establishment of a controlled communication session to the subsequent authorization process. After determining that the secure access status is an allowed access status, the secure access management platform generates a master authorization token bound to the current communication session based on the current session public key, enabling subsequent write control commands to continue to execute instruction-level authorization verification under the constraints of the master authorization token.

[0053] In some embodiments, when any verification result in the verification result information fails to meet the corresponding verification pass condition, the security access status is determined to be an access denial status. Specifically, when judging the verification result information, the security access management platform uses a joint constraint method to determine whether the grid device to be accessed is allowed to access. Only when the anonymous attribute credential verification result, the device integrity metric digest comparison result, and the credential revocation status verification result all meet the corresponding verification conditions are the device allowed to enter the subsequent communication control process. When the anonymous attribute credential verification result does not meet the access policy requirements, it indicates that the device attributes corresponding to the grid device to be accessed do not meet the current access control conditions. For example, if the grid device to be accessed belongs to a station domain that is not within the allowed access range, the protocol capabilities cannot meet the requirements of the target access object, the license operation level is insufficient, or the anonymous attribute credential has exceeded its validity period, the security access management platform determines that the device is not qualified to establish a controlled communication session. When the device integrity metric summary comparison results are inconsistent, it indicates that at least one of the following—the startup firmware, proof generation program, protocol standardization rule file, or command template cache file corresponding to the device-side access agent—differences from the preset integrity baseline. This may indicate program tampering, abnormal configuration, or an untrusted operating environment. In this case, the secure access management platform refuses to continue the access authorization process. When the credential revocation status verification result indicates that the anonymous attribute credential is invalid (e.g., the anonymous attribute credential has been revoked, the credential version has expired, or the current credential version is incompatible with the policy version), it means that the access credential currently held by the device no longer meets the security usage conditions, and the secure access management platform refuses the device's access. When any of the above verification results fail, the secure access management platform generates a corresponding access refusal status and records the corresponding failure reason type. The failure reason types include at least the following: anonymous attribute credential does not meet the policy, device integrity baseline does not match, credential revocation status is abnormal, random challenge fails, and verification information version is inconsistent. When the same grid device to be connected fails verification multiple times consecutively, the secure access management platform triggers a risk recording mechanism based on the number of failures and temporarily restricts the time window for the device to initiate access requests again, in order to reduce the risk of abnormal devices continuously attempting to access.

[0054] By jointly verifying anonymous attribute credentials, device integrity status, and credential validity status, the system comprehensively assesses the identity attributes, operational environment trustworthiness, and authorization validity of the devices to be connected to the power grid. This prevents untrusted devices from accessing the grid without exposing sensitive device identity information, thereby improving the security, accuracy, and reliability of power grid device access control.

[0055] Step S106: When the secure access state is the allowed access state, obtain the write control instruction to be executed, and control the grid device to be accessed and the target access object to perform data interaction based on the write control instruction to be executed.

[0056] Please refer to Figure 4 In some embodiments, controlling the grid device to be connected and the target access object to perform data interaction based on the write control instruction to be executed includes: steps S401 to S405; Step S401: Obtain the write control command to be executed corresponding to the power grid device to be connected; Step S402: Perform semantic parsing and field normalization on the write control instruction to be executed according to the preset protocol rules, so as to convert the write control instruction to be executed into a unified command tuple, and generate a command digest based on the unified command tuple; Step S403: Obtain the main authorization token corresponding to the current communication session, and generate a one-time sub-authorization token based on the command digest, the current session public key digest, and the object identifier corresponding to the target access object; Step S404: Generate an instruction proof based on the command digest, the one-time sub-authorization token, and the preset command template set; Step S405: Verify the validity of the main authorization token, the one-time sub-authorization token, and the instruction proof until the verification is successful, and then send the execution control instruction to the target access object.

[0057] In this first embodiment, after the grid access device completes trusted access verification and establishes a controlled communication session with the target access object, if the device-side access agent needs to perform a control operation on the target access object, it first obtains the currently pending write control instruction. The device-side access agent receives control requests generated from local control programs, scheduling applications, or operation and maintenance terminals, and extracts the pending write control instruction from the control requests. The pending write control instruction includes at least target access object information, target control object information, the type of operation to be performed, and corresponding operation parameters; wherein, the target access object information is used to determine the grid control device to which the current write control instruction needs to be sent, and the target access object may include station control layer servers, protection and measurement and control devices, remote control master stations, and bay layer control devices, etc.; the target control object information is used to determine the specific control point within the target access object where the control operation needs to be performed. For example, in a circuit breaker remote control scenario, the write control instruction to be executed obtained by the device-side access agent may include a target object of a control point of a certain circuit breaker bay, an operation type of remote tripping, and an empty parameter. In a protection setting adjustment scenario, the write control instruction to be executed obtained by the device-side access agent may include a target object of a current threshold parameter item in the protection device setting area, an operation type of setting write, and a corresponding target parameter value. After obtaining the write control instruction to be executed, the device-side access agent obtains the session status information corresponding to the current communication session and determines whether the write control instruction to be executed falls within the control range allowed by the current communication session. If the target access object corresponding to the write control instruction to be executed is consistent with the object bound to the current communication session, the subsequent instruction standardization processing flow is entered; otherwise, the write control instruction to be executed is rejected to avoid mixing control instructions between different sessions.

[0058] In this first embodiment, since different power grid devices may use different industrial communication protocols for control interaction, the device-side access agent first identifies the protocol of the acquired write control command to be executed according to preset protocol rules, and performs semantic parsing based on the data structure of the corresponding protocol. The device-side access agent first determines the communication protocol type corresponding to the write control command to be executed. Communication protocol types may include IEC 61850 MMS protocol, IEC 60870-5-104 protocol, DNP3 protocol, and Modbus protocol, etc. According to the pre-configured field mapping rules of the corresponding protocol, the protocol fields in the original control message are parsed to extract key fields that can represent the control meaning. Specifically, for IEC 61850 MMS protocol control messages, the device-side access agent extracts the logical node identifier, data object identifier, and control operation type from the message; for IEC 60870-5-104 protocol control messages, it extracts the information body address, control type, and control parameters; for DNP3 protocol control messages, it extracts the point number information, function code, and operation value; and for Modbus protocol control messages, it extracts the register address, function code, and write data. The device-side access agent converts control fields from different protocols into unified command tuples based on unified field mapping rules. A unified command tuple includes at least an object identifier, operation type, parameter constraints, execution sequence number, and a current session public key digest. The object identifier uniquely identifies the power grid device object to be controlled; the operation type indicates the current control action, such as remote tripping, setting value writing, or mode threshold adjustment; parameter constraints indicate the value range or constraint conditions corresponding to the control parameters; the execution sequence number indicates the execution order of the current control command within the current communication session; and the current session public key digest is used to associate the communication session to which the current control command belongs.

[0059] It should be noted that for remote circuit breaker tripping commands, the device-side access agent converts the circuit breaker control address, tripping operation code, and session identifier information in different protocol messages into a unified command tuple, and sets the object identifier to the circuit breaker control point, the operation type to remote tripping, and the parameter constraints to empty parameters. For protection setting write commands, the protection device parameter address, write operation type, and target parameter value are converted into a unified command tuple. After obtaining the unified command tuple, the device-side access agent uses a preset cryptographic hash algorithm to calculate the digest of the unified command tuple, obtaining the corresponding command digest. The command digest is used to uniquely identify the semantic content of the current write control command, so that the subsequently generated one-time sub-authorization token and command proof are bound to this specific control command.

[0060] In this first embodiment, after generating the command digest, the device-side access agent does not directly use the master authorization token generated during the access phase to execute write control. Instead, it generates a one-time sub-authorization token for the current write control command to be executed. The device-side access agent first obtains the master authorization token corresponding to the current communication session. This master authorization token is generated by the secure access management platform after the device passes anonymous attribute credential verification, integrity verification, and credential validity verification, and is bound to the current communication session. The device-side access agent obtains the current session public key digest corresponding to the current communication session and reads the object identifier of the target access object corresponding to the write control command to be executed. Simultaneously, the command digest, the current session public key digest, the object identifier of the target access object, and the current execution sequence number are used as inputs for generating the one-time sub-authorization token. Based on the above input information, the device-side access agent generates a one-time sub-authorization token using a preset token generation algorithm and binds the one-time sub-authorization token to the current write control command. The one-time sub-authorization token corresponds only to the current write control command. Once the command is verified and executed, the one-time sub-authorization token immediately becomes invalid and cannot be used again for verification of other write control commands. For example, when the equipment needs to continuously perform circuit breaker tripping operations and protection setting write operations, even if the two operations belong to the same communication session, different one-time sub-authorization tokens need to be generated according to their respective command digests, object identifiers and execution sequence numbers, so as to avoid the reuse of already authorized control results.

[0061] In this first embodiment, after obtaining the command digest and one-time sub-authorization token, the device-side access agent generates an instruction proof based on a preset command template set to verify the legality of the current write control command. The device-side access agent obtains the currently valid command template set, which includes multiple command templates configured for different power grid control scenarios. Each command template includes at least a set of allowed objects, a set of allowed operations, a parameter value range, an execution time window, and a target response constraint. The device-side access agent matches the corresponding target command template in the command template set according to the object identifier and operation type in the unified command tuple. For example, for a circuit breaker remote tripping operation, the device-side access agent queries whether there exists a command template whose allowed object set includes the current circuit breaker control point and whose allowed operation set includes a remote tripping operation; for a protection setting write operation, it queries whether the corresponding protection parameter item belongs to an allowed write object and determines whether the target parameter value is within a preset safety range. After completing the command template matching, the device-side access agent uses the command digest, current session public key digest, execution sequence number, target access object identifier, one-time sub-authorization token digest, and the matched command template information as public input. It inputs the unified command tuple's internal information, command template index information, and parameter value constraint relationships as private proof information into the proof generation algorithm. When the current write control command includes parameter adjustments, the device-side access agent also obtains the previously confirmed parameter value corresponding to the same object and operation type, and calculates the change between the current parameter value and the previously confirmed parameter value to determine whether the step size constraint in the command template is satisfied. When all the above constraints are satisfied, the corresponding instruction proof is generated; if any of the object identifier, operation type, parameter range, or step size constraint does not meet the command template requirements, a valid instruction proof is not generated.

[0062] In this first embodiment, before actually sending the write control command, the device-side access agent performs joint verification on the main authorization token, the one-time sub-authorization token, and the instruction proof to ensure that the current control operation simultaneously meets the session authorization requirements and the instruction-level authorization requirements. The device-side access agent first verifies the validity of the main authorization token, including determining whether the main authorization token is within its valid time range, whether it is bound to the current communication session, and whether it corresponds to the current grid device to be connected. The device-side access agent verifies the validity of the one-time sub-authorization token, specifically determining whether the one-time sub-authorization token matches the current command digest, the current session public key digest, the target access object identifier, and the execution sequence number, and confirms that the one-time sub-authorization token has not been used. The device-side access agent sends the instruction proof to the instruction proof verification logic for verification to determine whether the unified command tuple corresponding to the current command digest belongs to the allowed range of the command template set, and verifies whether the corresponding parameter value range, execution time window, and step size constraints meet the requirements. When the primary authorization token, the one-time sub-authorization token, and the instruction proof verification all pass, the device-side access agent determines that the current write control instruction is qualified for execution. It then uses protocol-isolated execution logic to convert the write control instruction, which matches the command digest, into an industrial protocol message corresponding to the target access object and sends it to the target access object. After transmission, the device-side access agent receives the execution response information returned by the target access object. The execution response information includes at least the execution status, response sequence number, or monotonic status value, and uses this response information for subsequent one-time sub-authorization token generation and control instruction auditing. If any verification result fails, the device-side access agent prohibits the sending of the pending write control instruction and records the corresponding failure reason, including primary authorization token failure, one-time sub-authorization token failure, command template mismatch, parameter constraint anomaly, or instruction proof verification failure.

[0063] In some embodiments, after the write control instruction to be executed completes instruction verification and the target access object returns the execution result, the secure access management platform obtains the command digest, one-time sub-authorization token digest, execution result digest, current execution time information, and the preceding chain value corresponding to the previous audit record corresponding to the current write control instruction. The command digest identifies the content of the currently executed control instruction, the one-time sub-authorization token digest identifies the authorization status corresponding to the current control instruction, the execution result digest identifies the status feedback result after the target access object's actual execution, and the preceding chain value associates the current audit record with the previous audit record. When generating the current audit record, the secure access management platform first generates an association marker corresponding to the current control behavior based on the traceability association seed corresponding to the grid device to be accessed. The secure access management platform obtains the traceability association seed generated during the registration phase of the grid device to be accessed, and performs association calculations based on the current command digest, execution time information, and device-side access agent identifier information to obtain the association marker corresponding to the current audit record. The association marker does not directly contain the actual registration identifier of the grid device to be accessed, but serves as intermediate index information for restoring the device identity association during subsequent controlled traceability processes. The secure access management platform combines the previous chain value, the current command digest, the current one-time sub-authorization token digest, the current execution result digest, the current timestamp, and the associated marker according to a preset chained storage rule to form the current audit data block. It then performs hash calculation on the audit data block based on a preset cryptographic hash algorithm to obtain the current audit chain value. For example, in a protection setting write scenario, after the target access object completes the writing of the protection device setting parameters, the secure access management platform obtains the command digest, one-time sub-authorization token digest, and the write confirmation status returned by the target access object corresponding to this write operation. It combines this information with the chain value of the previous audit record to obtain the current audit chain value, and uses this current audit chain value as the previous chain value in the audit record corresponding to the next protection setting write operation, thus establishing a unique association between multiple consecutively executed write control commands.

[0064] In some embodiments, when the device-side access agent is in a short-term disconnection state and performs a restricted continuation operation based on a continuity packet, the device-side access agent generates a corresponding continuation audit record after each successful execution of a write control command. The continuation audit record includes at least a command digest, a one-time sub-authorization token digest, an execution time, an execution result digest, the result of the remaining write quota change, and the current chain value. The device-side access agent chains each continuation audit record according to the execution time sequence, and uploads the complete continuation audit chain formed during the disconnection period to the security access management platform after resuming communication with the security access management platform. After receiving the continuation audit chain, the security access management platform first obtains the last valid audit chain value saved before the disconnection and uses this last valid audit chain value as the starting chain value for recovery verification; it reads the command digest, one-time sub-authorization token digest, execution result digest, and current chain value one by one according to the time sequence of the continuation audit record, and recalculates the theoretical chain value based on the same chain value calculation rules; it then compares the recalculated theoretical chain value with the current chain value uploaded by the device-side access agent one by one. When the theoretical chain value corresponding to any continuing audit record is inconsistent with the uploaded chain value, or when an abnormal audit record time sequence, missing audit record, or duplicate inserted record is detected, the security access management platform determines that the audit chain continuity verification corresponding to the current device-side access agent has failed and generates an audit exception event; at the same time, it freezes the one-time sub-authorization token issuance process corresponding to the device-side access agent, so that it cannot continue to execute new write control instructions and only allows restricted read operations.

[0065] Through the above steps, a fine-grained write control mechanism combining session authorization and command-level authorization is realized. This ensures that each write control command must undergo command semantic verification, one-time sub-authorization verification, and command proof verification before execution, thereby preventing the abuse of legitimate sessions or the reuse of authorized commands. At the same time, by unifying command tuples, command template constraints, and audit chain continuity verification, unified verification of control commands of different protocols, reliable tracking of execution behavior, and controlled continuation in disconnection scenarios are achieved, improving the security, reliability, and auditability of the remote control process of power grid equipment.

[0066] like Figure 5 As shown, based on the above method embodiments, corresponding apparatus embodiments are provided; An embodiment of the present invention provides a schematic diagram of a secure access system for power grid equipment, including: a credential acquisition module 100, an integrity measurement module 200, a proof generation module 300, a session binding module 400, an access determination module 500, and an instruction control module 600; The credential acquisition module 100 is used to acquire the anonymous attribute credential corresponding to the power grid equipment to be connected. The integrity measurement module 200 is used to collect the startup status information, program running information and configuration status information of the power grid equipment to be connected on the agent side, and calculate the summary value corresponding to the startup status information, the program running information and the configuration status information respectively, so as to generate a device integrity measurement summary based on each summary value; The proof generation module 300 is used to generate access proof information based on the anonymous attribute credential, the device integrity metric digest, and the preset access policy. The session binding module 400 is used to obtain the current communication session between the power grid equipment to be connected and the secure access management platform, so as to determine the session-associated access certificate based on the access certificate information and the current communication session; The access determination module 500 is used to receive the verification result information corresponding to the session-associated access certificate, and determine the security access status of the power grid equipment to be accessed based on the verification result information. The instruction control module 600 is used to acquire a write control instruction to be executed when the secure access state is an allowed access state, so as to control the grid device to be accessed and the target access object to perform data interaction based on the write control instruction to be executed.

[0067] It is understood that the above-described device embodiments correspond to the method embodiments of the present invention, and can implement any of the above-described method embodiments of the present invention to provide a secure access method for power grid equipment. More detailed workflows and principles of this system can be found, but are not limited to, in the relevant descriptions of the above methods.

[0068] It should be noted that the device embodiments described above are merely illustrative, and some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can specifically be implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0069] Based on the above-described embodiment of a secure access method for power grid equipment, another embodiment of the present invention provides a terminal device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements a secure access method for power grid equipment according to any embodiment of the present invention.

[0070] For example, in this embodiment, the computer program can be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program in the terminal device.

[0071] The terminal device may be a desktop computer, laptop, handheld computer, or cloud server, etc. The terminal device may include, but is not limited to, a processor and a memory.

[0072] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of the terminal device, connecting all parts of the terminal device via various interfaces and lines.

[0073] Based on the above-described method embodiments, another embodiment of the present invention provides a computer-readable storage medium including a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute a secure access method for power grid equipment as described in any of the above-described method embodiments of the present invention.

[0074] The modules / units integrated in the device / terminal equipment, if implemented as software functional units and sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.

[0075] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A secure access method for power grid equipment, characterized in that, Applicable to a secure access system, the secure access system including the power grid equipment to be accessed, a secure access management platform, and the target access object, the method includes: Obtain the anonymous attribute certificate corresponding to the power grid equipment to be connected; The startup status information, program running information, and configuration status information of the equipment to be connected to the power grid are collected on the agent side. The digest values ​​corresponding to the startup status information, program running information, and configuration status information are calculated respectively, so as to generate a device integrity metric digest based on each digest value. Based on the anonymous attribute credential, the device integrity metric digest, and the preset access policy, access proof information is generated. Obtain the current communication session between the power grid device to be connected and the secure access management platform, and determine the session-associated access certificate based on the access certificate information and the current communication session; Receive the verification result information corresponding to the session-associated access certificate, and determine the security access status of the power grid equipment to be accessed based on the verification result information; When the secure access state is the allowed access state, a write control instruction to be executed is obtained, and the power grid equipment to be accessed and the target access object are controlled to interact with each other based on the write control instruction to be executed.

2. The secure access method for power grid equipment as described in claim 1, characterized in that, The step of calculating the digest values ​​corresponding to the startup status information, the program running information, and the configuration status information, respectively, and generating a device integrity metric digest based on each digest value, includes: The startup state information, the program running information, and the configuration state information are calculated using a preset cryptographic hash algorithm to obtain the startup firmware digest, the proof generation program digest, the protocol normalization rule digest, and the command template cache file digest, respectively. The device integrity metric summary is generated based on the boot firmware summary, the proof generation program summary, the protocol normalization rule summary, and the command template cache file summary.

3. The secure access method for power grid equipment as described in claim 1, characterized in that, The process of generating access proof information based on the anonymous attribute credential, the device integrity metric digest, and the preset access policy includes: Obtain random challenge information, and obtain the credential index information corresponding to the anonymous attribute credential and the protected attribute information in the anonymous attribute credential; The access policy is compiled into an access proof circuit, and the random challenge information, the device integrity metric digest, the credential index information, and the protected attribute information are input into the access proof circuit for calculation to obtain the access proof information.

4. The secure access method for power grid equipment as described in claim 1, characterized in that, The step of obtaining the current communication session between the power grid device to be connected and the secure access management platform, and determining the session-associated access certificate based on the access certificate information and the current communication session, includes: Obtain the current communication session between the power grid device to be connected and the secure access management platform, and calculate the digest value of the session key information corresponding to the current communication session to obtain the current session public key digest; Write the current session public key digest into a preset data bit in the access proof information to perform association binding and generate the session association access proof.

5. A secure access method for power grid equipment as described in claim 3, characterized in that, The step of receiving the verification result information corresponding to the session-associated access certificate and determining the security access status of the power grid device to be accessed based on the verification result information includes: Receive the verification result information corresponding to the session-associated access proof, wherein the verification result information includes the anonymous attribute credential verification result, the device integrity metric digest comparison result, and the credential revocation status verification result; When the anonymous attribute credential verification result is that the anonymous attribute credential satisfies the access policy, the device integrity metric digest comparison result is that the device integrity metric digest is consistent with the preset integrity baseline, and the credential revocation status verification result is that the anonymous attribute credential is in a valid state, the secure access state is determined to be an allowed access state. If any verification result in the verification result information does not meet the corresponding verification pass condition, the secure access status is determined to be access denied status.

6. A secure access method for power grid equipment as described in claim 4, characterized in that, The step of controlling the grid access device to interact with the target access object based on the write control instruction to be executed includes: Obtain the write control command to be executed corresponding to the power grid device to be connected; The execution of the write control instruction is semantically parsed and field normalized according to the preset protocol rules, so as to convert the execution of the write control instruction into a unified command tuple, and a command digest is generated based on the unified command tuple; Obtain the main authorization token corresponding to the current communication session, and generate a one-time sub-authorization token based on the command digest, the current session public key digest, and the object identifier corresponding to the target access object; Based on the command digest, the one-time sub-authorization token, and the preset command template set, an instruction proof is generated; The validity of the main authorization token, the one-time sub-authorization token, and the instruction proof is verified until the verification is successful. Then, the write control instruction to be executed is sent to the target access object.

7. A secure access system for power grid equipment, characterized in that, The system includes: a credential acquisition module, an integrity measurement module, a proof generation module, a session binding module, an access determination module, and an instruction control module; The credential acquisition module is used to acquire the anonymous attribute credential corresponding to the power grid equipment to be connected; The integrity measurement module is used to collect the startup status information, program running information, and configuration status information of the grid-connected equipment on the agent side, and calculate the summary values ​​corresponding to the startup status information, program running information, and configuration status information respectively, so as to generate a device integrity measurement summary based on each summary value. The proof generation module is used to generate access proof information based on the anonymous attribute credential, the device integrity metric digest, and the preset access policy. The session binding module is used to obtain the current communication session between the power grid equipment to be connected and the secure access management platform, so as to determine the session-associated access certificate based on the access certificate information and the current communication session; The access determination module is used to receive the verification result information corresponding to the session-associated access certificate, and determine the security access status of the power grid equipment to be accessed based on the verification result information. The instruction control module is used to acquire a write control instruction to be executed when the secure access state is an allowed access state, so as to control the grid device to be connected and the target access object to perform data interaction based on the write control instruction to be executed.

8. A secure access system for power grid equipment as described in claim 7, characterized in that, The instruction control module further includes: an instruction acquisition unit, a command parsing unit, a token generation unit, a proof generation unit, and an instruction execution unit; The instruction acquisition unit is used to acquire the write control instruction to be executed corresponding to the grid-connected equipment; The command parsing unit is used to perform semantic parsing and field normalization on the write control instruction to be executed according to preset protocol rules, so as to convert the write control instruction to be executed into a unified command tuple and generate a command digest based on the unified command tuple; The token generation unit is used to obtain the main authorization token corresponding to the current communication session, and generate a one-time sub-authorization token based on the command digest, the current session public key digest and the object identifier corresponding to the target access object; The proof generation unit is used to generate an instruction proof based on the command digest, the one-time sub-authorization token, and a preset set of command templates. The instruction execution unit is used to verify the validity of the main authorization token, the one-time sub-authorization token, and the instruction proof until the verification is successful, and then send the write control instruction to be executed to the target access object.

9. A terminal device, characterized in that, The device includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements a secure access method for power grid equipment as described in any one of claims 1-6.

10. A computer-readable storage medium, characterized in that, include: A stored computer program, wherein, when the computer program is executed, it controls the device containing the computer-readable storage medium to perform a secure access method for power grid equipment as described in any one of claims 1-6.

Images