Power system edge node adaptation method, system, device and medium based on modular host security component

Abstract

This invention relates to the field of power system network security technology. It discloses a method, system, device, and medium for power system edge node adaptation based on a modular host security component. The security component is a lightweight embedded component integrated into the edge service host, comprising a standardized security service layer, a pluggable adaptation layer, and a core security engine. It achieves collaborative scheduling of the three-layer architecture through standardized internal call interfaces, and enables universal adaptation to heterogeneous environments through hot-swappable plug-ins. It integrates the national cryptographic system and Trusted Computing 3.0 technology to construct end-to-end security protection. This invention enables rapid deployment of unified security capabilities in resource-constrained edge environments, balancing high security strength with low performance loss, and adapting to the protection needs of new power system source-grid-load-storage interaction scenarios.

Description

Technical Field

[0001] This invention relates to the field of power system network security technology, and in particular to a method, system, device and medium for power system edge node adaptation based on modular host security components. Background Technology

[0002] With the rapid construction of new power systems, the frequency and scale of interaction among power generation, grid, load, and storage have exploded. A large number of distributed and heterogeneous edge nodes are widely deployed across the entire power generation, transmission, distribution, and consumption chain. These edge nodes generally have diverse hardware architectures (ARM, x86, RISC-V, etc.), complex operating system types, and limited computing and storage resources. As the final entry point for power system business interactions, they face increasingly prominent cybersecurity risks such as identity spoofing, unauthorized access, data tampering, and information leakage, placing extremely high demands on the access security, data transmission security, and operational integrity of edge hosts.

[0003] Currently, host security protection solutions for edge nodes in power systems mainly suffer from the following technical deficiencies: First, existing host security components mostly adopt an integrated and customized design architecture, which is developed for specific hardware platforms and operating systems. They lack standardized security interfaces and pluggable adaptation mechanisms. Existing integrated security components only support specific hardware architectures and operating systems. Adapting to new environments requires redeveloping the entire component, with an adaptation cycle of more than 15 working days. Furthermore, they cannot support hot-swappable updates. In the face of massive heterogeneous edge nodes in new power systems, there are problems such as long adaptation cycles, high deployment costs, and poor scalability, making it impossible to achieve rapid deployment and flexible configuration of unified security capabilities. Secondly, existing security protection solutions have high functional redundancy and insufficient lightweight optimization. In operating environments with limited edge node resources, security operations such as identity authentication and data encryption / decryption consume a large amount of host computing power and bandwidth resources. Existing similar security protection systems generally have a CPU utilization rate of over 12% and a memory usage of over 100MB during steady-state operation. When running on power distribution terminals with limited computing power, this can lead to an increase in business data transmission latency of over 30%, which seriously affects the normal operation of host services and cannot meet the high-volume, low-latency business transmission requirements in scenarios with frequent interactions between source, network, load, and storage. Third, existing security capabilities are fragmented and distributed, with security functions such as identity authentication, access control, data encryption, and integrity verification being isolated from each other. There is a lack of a unified security engine for scheduling and management, making it difficult to form an end-to-end full-process security protection system. At the same time, most existing solutions rely solely on cryptographic or trusted computing technologies, failing to address the validity of identity credential generation, the security of storage, and the integrity of content. The security protection strength of access authentication is insufficient, making it difficult to resist high-level network attacks. Fourth, existing solutions lack the ability to universally adapt to boundary security devices, failing to effectively extend standardized authentication and encryption capabilities to various edge nodes in new power systems. Furthermore, in scenarios involving dynamic cluster expansion, they lack optimized scheduling mechanisms for isolated data transmission, failing to meet the reliable transmission and version security management requirements for large-volume data in source-grid-load-storage interaction scenarios, and are ill-suited to the dynamically changing business operation scenarios of new power systems. Therefore, this invention is proposed. Summary of the Invention

[0004] In view of the above-mentioned existing problems, the present invention provides a method, system, device and medium for power system edge node adaptation based on modular host security components.

[0005] Therefore, the technical problem solved by the present invention is that existing power system edge security protection schemes have weak heterogeneous adaptability, high resource consumption, fragmented security capabilities, and difficulty in adapting to high-volume, low-latency scenarios when facing a large number of heterogeneous nodes.

[0006] To address the aforementioned technical problems, this invention provides the following technical solution: a power system edge node adaptation method based on modular host security components, comprising: loading an adaptation plugin and performing integrity verification based on the operating environment information of the target edge node; Based on the resource conditions and security requirements of the edge nodes, the security function modules of the core security engine are tailored and configured. Establish and initiate a trust chain and generate identity credentials to complete the initialization of the trusted execution environment; Enable the trimmed security function modules to perform two-way authentication, message protocol parsing and encryption, host integrity verification and dynamic access control; Monitor business traffic and node access status, dynamically adjust the size of the security component cluster and transmission scheduling, and perform version verification on the transmitted data.

[0007] As a preferred embodiment of the power system edge node adaptation method based on modular host security components described in this invention, the step of trimming and configuring the security function modules of the core security engine includes: after completing the adaptation of the underlying environment, a security capability scheduler is built into the standardized security service layer, and a service registration interface is provided for the dynamic registration and deregistration of security function modules. The service registration interface is used to obtain the computing and storage resource parameters of the edge node, as well as the security protection level requirements of the business scenario. Based on the resource parameters and security protection level requirements, enable or disable the security function modules in the core security engine, disable redundant functions, and configure the operating parameters for the enabled modules. The security capability scheduler sets the initial resource allocation ratio for each enabled security function module and dynamically adjusts the resource allocation ratio based on the real-time load of the edge nodes. When the service load of the edge nodes exceeds a preset threshold, the resource allocation of non-core security function modules is adjusted.

[0008] As a preferred embodiment of the power system edge node adaptation method based on modular host security components described in this invention, the step of constructing and starting a trust chain and generating identity credentials to complete the initialization of the trusted execution environment includes: using the trusted platform control module as the root of trust, employing the national cryptographic hash algorithm, performing pre-start static measurements on the host BIOS, BootLoader, operating system kernel, system critical files, and the security component itself in sequence, generating integrity measurement benchmark values ​​for each link, and storing the benchmark values ​​in a designated storage area of ​​the trusted platform control module; A unique key pair between the edge node and the business host is generated using the national cryptographic asymmetric cryptographic algorithm, and an identity credential bound to the node identity is generated using the national cryptographic identifier cryptographic algorithm. The private key and identity credentials are encrypted and stored in the secure storage area of ​​the trusted platform control module, and the private key is set to be non-exportable. Complete the startup trust chain construction from the hardware root of trust to the operating system, security components and business applications, and initialize the trusted execution environment.

[0009] As a preferred embodiment of the power system edge node adaptation method based on modular host security components described in this invention, the two-way authentication includes: the initiator generating a first random number, encapsulating its own identity identifier and the first random number into an authentication request message and sending it to the responder; The responder verifies the binding relationship between the identity identifier and the public key using the national cryptographic algorithm, signs the request message using the private key of the trusted platform control module, obtains the local integrity measurement report, and encapsulates the signature, measurement report, and second random number into a response message and sends it back. The initiator verifies the respondent's signature and measurement report. If the verification is successful and the measurement value meets the pre-stored benchmark value, the two-way authentication is completed and a secure communication link is established. If the verification fails or the measurement is abnormal, the authentication is terminated and the respondent is added to the access blacklist. The blacklist validity period is set according to the abnormality level, and an alarm is sent to the security management platform. In the authentication process, the identity identifier and public key are bound using the national cryptographic algorithm, eliminating the need to transmit digital certificates.

[0010] As a preferred embodiment of the power system edge node adaptation method based on modular host security components described in this invention, the message protocol parsing and encryption includes: performing deep protocol parsing on the business messages through the core security engine, identifying the message type and extracting core business fields and non-core fields according to the frame format characteristics of the power system business protocol; For the core business fields, selective encryption and decryption are performed using the national standard symmetric encryption algorithm; for the non-core fields, integrity verification is performed using the national standard cryptographic hash algorithm. The encryption and decryption process is completed at the host operating system kernel layer and is transparent to upper-layer business applications. By identifying business priorities, differentiated encryption processing strategies are adopted based on message type; During the selective encryption and decryption process, the message header and length fields are preserved as plaintext, and the encrypted message maintains a frame format that conforms to the corresponding protocol.

[0011] As a preferred embodiment of the power system edge node adaptation method based on modular host security components described in this invention, the dynamic adjustment of the security component cluster size and transmission scheduling includes: real-time collection of operational data such as service traffic load, number of nodes accessed, link transmission delay and packet loss rate, and constructing a prediction model based on the operational data and historical data to predict future traffic trends; When it is predicted that the business traffic will exceed the preset cluster capacity threshold, the horizontal dynamic expansion of the security component cluster is triggered, and new nodes are registered and security policies are synchronized; when the business traffic falls back below the threshold, the cluster is triggered to shrink and node resources are reclaimed. Dynamic load balancing is performed on isolated transmission links, and data traffic is scheduled and allocated according to the real-time transmission status and service priority of each link, and priority transmission rights are allocated to high-priority services. Version identifiers and time information are added to the transmitted business data, and copies are sent through a multi-link redundant transmission mechanism. The receiving end performs consistency comparison based on the version identifier, discards expired or duplicate data, and performs version management.

[0012] As a preferred embodiment of the power system edge node adaptation method based on modular host security components described in this invention, the method is based on modular host security components, which include a standardized security service layer, a pluggable adaptation layer, and a core security engine. The pluggable adaptation layer is used to load adaptation plugins and includes a hardware adaptation unit, a system adaptation unit, and a boundary security device adaptation unit. The hardware adaptation unit has pre-set standardized adaptation plugins for different hardware architectures; The system adaptation unit has pre-set standardized adaptation plugins for different operating systems; The boundary security device adapter unit is pre-loaded with standardized adapter plug-ins for different types of boundary security devices. The adapter plugin is based on a unified standardized interface specification, adopts the form of a dynamic link library, supports hot-swapping, and does not require restarting the business host during loading and unloading. It is also decoupled from the core security engine. When the hardware, operating system, or boundary security device changes, the corresponding adapter plugin is updated to complete the adaptation without modifying the main code of the core security engine and the standardized security service layer. The integrity verification of the plugin before loading includes: using the national cryptographic hash algorithm to perform integrity calculation on the plugin file through the plugin verification module, comparing it with the pre-stored benchmark value, and only legitimate plugins that pass the verification are allowed to run; third-party developed adaptation plugins also need to be verified by digital signature using the national cryptographic algorithm.

[0013] This invention provides a power system edge node adaptation system based on modular host security components.

[0014] As a preferred embodiment of the power system edge node adaptation system based on modular host security components described in this invention, it includes a pluggable adaptation layer, a standardized security service layer, and a core security engine. The pluggable adaptation layer has a built-in hardware adaptation unit, system adaptation unit, boundary security device adaptation unit, and plug-in verification unit. It is used to load the corresponding adaptation plug-in according to the running environment information of the edge node. The plug-in verification unit performs integrity verification on the plug-in before loading. Each adaptation unit connects to different hardware architectures, operating systems, and boundary security devices to provide a unified underlying call channel for the standardized security service layer. The standardized security service layer includes a service registration unit, a security invocation unit, and a security capability scheduling unit. These units enable or disable the security function modules of the core security engine and configure their operating parameters based on the resource parameters and security protection requirements of the edge nodes. The service registration unit performs dynamic registration and deregistration of security capabilities, and the security capability scheduling unit adjusts the resource allocation ratio of each security function module. The core security engine is based on the national cryptographic system and uses trusted computing technology as the root of trust. It incorporates a lightweight two-way identity authentication module, a message protocol parsing and encryption module, a host integrity verification module, a dynamic authorization access control module, and a cluster transmission optimization module. It is used to build and start a trust chain and generate identity credentials, perform two-way identity authentication, transparent encryption and decryption of business messages, host integrity verification and dynamic access control, monitor business traffic and node access status, dynamically adjust the cluster size and transmission scheduling strategy, and perform version verification of transmitted data.

[0015] The present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of a power system edge node adaptation method based on a modular host security component.

[0016] The present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of a power system edge node adaptation method based on a modular host security component.

[0017] The beneficial effects of this invention are as follows: Through a three-unit modular design with a pluggable adaptation layer, this invention achieves full-dimensional decoupling and adaptation of hardware platforms, operating systems, and boundary security devices. The standardized hot-swappable plug-in mechanism can complete the adaptation of new environments without modifying the main component code. Compared with existing integrated security components, the adaptation cycle for new environments is shortened from 15 working days to less than 1 working day, a reduction of more than 93%. It enables the rapid deployment and flexible configuration of unified security capabilities on massive heterogeneous edge nodes in new power systems. Through two-way identity authentication processes, selective field encryption and decryption of power-specific protocols, and a lightweight customization mechanism for on-demand tailoring of security capabilities, the computing power and bandwidth overhead of security operations are minimized. Compared with existing similar security protection systems, the CPU utilization rate during steady-state operation is reduced from more than 12% to less than 3%, a reduction of 75%; memory usage is reduced from more than 100MB to less than 30MB, a reduction of 70%. At the same time, the transparent encryption and decryption processing in kernel mode is non-intrusive to upper-layer business applications, perfectly adapting to the resource-constrained operating environment of edge nodes. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a schematic flowchart of a power system edge node adaptation method based on a modular host security component, provided as an embodiment of the present invention.

[0020] Figure 2 This is a low-level environment adaptive adaptation judgment diagram for a power system edge node adaptation method based on a modular host security component, provided in one embodiment of the present invention.

[0021] Figure 3This is a timing diagram for building a trusted execution environment for a power system edge node adaptation method based on modular host security components, provided in one embodiment of the present invention. Detailed Implementation

[0022] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0023] Example 1, referring to Figure 1 This is the first embodiment of the present invention, which provides a power system edge node adaptation method based on a modular host security component, including: S1: Based on the runtime environment information of the target edge node, load the adaptation plugin and perform integrity verification.

[0024] S2: Based on the resource conditions and security requirements of the edge nodes, the security function modules of the core security engine are trimmed and configured.

[0025] S3: Build and start the trust chain and generate identity credentials to complete the initialization of the trusted execution environment.

[0026] S4: Enable the trimmed security function modules to perform two-way authentication, message protocol parsing and encryption, host integrity verification and dynamic access control.

[0027] S5: Monitors business traffic and node access status, dynamically adjusts the size of the security component cluster and transmission scheduling, and performs version verification on transmitted data.

[0028] It should be noted that this method is based on the national cryptographic system and uses Trusted Computing 3.0 technology as the root of trust. It integrates and schedules the four core security capabilities of identity authentication, data encryption and decryption, integrity verification, and access control. At the same time, it achieves full-dimensional protection of the validity of identity credential generation, storage security, and content integrity. It solves the problems of fragmented security capabilities, incomplete protection system, and insufficient protection strength of single technology in existing technologies. It constructs end-to-end trusted security protection from host startup to business interaction. Through the cluster transmission optimization module, it constructs a dynamically expandable isolated data transmission scheduling mechanism, which can automatically complete cluster expansion and link load balancing according to the business traffic changes in the source-network-load-storage interaction scenario. At the same time, it realizes the version consistency verification of business data. In the scenario of 1000 edge nodes concurrently accessing and 10Gbps peak traffic, the end-to-end transmission latency is controlled within 10ms, and the data transmission success rate reaches 99.999%, which meets the high-volume, low-latency, and high-reliability transmission requirements of the frequent interaction scenario of the new power system.

[0029] Example 2, refer to Figure 2 As an embodiment of the present invention, based on the above embodiment, a power system edge node adaptation method based on modular host security components is provided.

[0030] Furthermore, in this embodiment, step S1 loads the adaptation plugin and performs integrity verification based on the runtime environment information of the target edge node. The specific steps include: S101: The method is based on a modular host security component, which includes a standardized security service layer, a pluggable adaptation layer, and a core security engine. The pluggable adaptation layer is used to load adaptation plugins and includes a hardware adaptation unit, a system adaptation unit, and a boundary security device adaptation unit, wherein: The hardware adaptation unit has pre-set standardized adaptation plugins for different hardware architectures; The system adaptation unit has pre-set standardized adaptation plugins for different operating systems; The boundary security device adapter unit is pre-loaded with standardized adapter plug-ins for different types of boundary security devices.

[0031] S102: The adapter plugin is based on a unified standardized interface specification, adopts the form of a dynamic link library, supports hot-swapping, and does not require restarting the business host during loading and unloading. It is also decoupled from the core security engine. When the hardware, operating system or boundary security device changes, the adaptation is completed by updating the corresponding adapter plugin without modifying the main code of the core security engine and the standardized security service layer. Specifically, information is collected on the hardware architecture, operating system version, and model of the boundary security device connected to the target edge business host to generate an environment compatibility list; The main program of the security component is deployed to the / opt / sec_component directory of the business host. The main program contains the basic framework of the standardized security service layer and the core security engine, but does not contain environment-related adaptation code.

[0032] S103: The plugin verification module uses the national cryptographic hash algorithm to perform integrity calculation on the plugin file and compares it with the pre-stored benchmark value. Only legitimate plugins that pass the verification are allowed to run. Third-party developed adaptation plugins also need to be verified by digital signature using the national cryptographic algorithm.

[0033] Specifically, based on the environment adaptation list, hardware adaptation plugins, system adaptation plugins, and boundary security device adaptation plugins are loaded in the pluggable adaptation layer. The plugin loading process adopts a hot-swappable method, which does not require restarting the business host and business process. The adaptation layer completes the adaptation and conversion of the underlying interface through plugins, establishes a unified underlying call channel for the upper standardized security service layer, completes the compatibility and docking of security components with edge hosts and boundary security devices, and automatically reports the adaptation results to the security management platform after the adaptation is completed.

[0034] Furthermore, in this embodiment, step S2 involves tailoring and configuring the security function modules of the core security engine based on the resource conditions and security requirements of the edge nodes. Specific steps include: S201: After completing the underlying environment adaptation, a security capability scheduler is built into the standardized security service layer, and a service registration interface is provided for the dynamic registration and deregistration of security function modules. Specifically, the system collects the CPU computing power, memory size, and storage capacity resource parameters of the target edge nodes, as well as the security protection level requirements of the business scenario, and generates a security capability configuration list.

[0035] S202: Obtain the computing and storage resource parameters of the edge node and the security protection level requirements of the business scenario through the service registration interface; By standardizing the service registration interface of the security service layer, the five functional modules of the core security engine can be tailored as needed. For example, for a power distribution terminal with only 256MB of memory, the cluster transmission optimization and dynamic auditing functions can be turned off, and only the core capabilities of identity authentication and data encryption and decryption can be retained.

[0036] S203: Based on the resource parameters and security protection level requirements, enable or disable the security function modules in the core security engine, disable redundant functions, and configure the operating parameters for the enabled modules. The security capability scheduler sets the initial resource allocation ratio for each enabled security function module and dynamically adjusts the resource allocation ratio based on the real-time load of the edge nodes. When the service load of the edge nodes exceeds a preset threshold, the resource allocation of non-core security function modules is adjusted.

[0037] Specifically, configure the parameters of the enabled security function modules, including authentication timeout (set to 30s), encryption / decryption algorithm mode (set to SM4-CBC-128), integrity measurement period (set to 1s), access control policy, and traffic threshold parameters; The initial resource allocation ratio of each module can be set through the security capability scheduler. For example, the CPU usage limit of the identity authentication module can be set to 10%, and the CPU usage limit of the data encryption and decryption module can be set to 15%. After configuration, perform resource usage tests on the security component instance to ensure that the CPU utilization of the security component does not exceed 5% of the host single core and the memory usage does not exceed 50MB, thus meeting the operating requirements of resource-constrained edge nodes.

[0038] Furthermore, in this embodiment of the application, step S3 constructs and initiates the trust chain and generates identity credentials to complete the initialization of the trusted execution environment. The specific steps include: S301: Using the Trusted Platform Control Module as the root of trust, and employing the national cryptographic hash algorithm, perform pre-boot static measurements on the host BIOS, BootLoader, operating system kernel, critical system files, and security components in sequence to generate integrity measurement benchmark values ​​for each link, and store the benchmark values ​​in the PCR register of the TPCM.

[0039] S302: Generate a unique key pair between the edge node and the business host using the national cryptographic asymmetric cryptographic algorithm, and generate an identity credential bound to the node identity identifier using the national cryptographic identifier cryptographic algorithm; The private key and identity credentials are encrypted and stored in the secure storage area of ​​the trusted platform control module, and the private key is set to be non-exportable. Complete the startup trust chain construction from the hardware root of trust to the operating system, security components and business applications, and initialize the trusted execution environment.

[0040] Specifically, a unique public-private key pair between the edge node and the business host is generated using the national cryptographic SM2 algorithm, and an identity credential bound to the node's identity is generated based on the SM9 algorithm. The private key and identity credential are encrypted and stored in the secure storage area of ​​TPCM and cannot be exported. Complete the integrity measurement of the security component itself, synchronously store the measurement benchmark value in TPCM, and establish a complete trusted execution environment from the hardware root of trust to the security component and business application; After initialization, the node's trusted status is reported to the security management platform, including static measurement results, identity credential information, and security component version information.

[0041] Furthermore, in this embodiment, step S4 enables the trimmed security function module to perform two-way authentication, message protocol parsing and encryption, host integrity verification, and dynamic access control. The specific steps include: S401: Enable the configured security function module. When the edge node initiates a service access request, the lightweight two-way authentication module completes two-way authentication between the node and the service host, and between the service host and the boundary security device, and simultaneously completes the trusted status assessment of the peer node. Two-way authentication includes: the initiator generates a first random number, encapsulates its own identity identifier and the first random number into an authentication request message, and sends it to the responder; The responder verifies the binding relationship between the identity identifier and the public key using the national cryptographic algorithm, signs the request message using the private key of the trusted platform control module, obtains the local integrity measurement report, and encapsulates the signature, measurement report, and second random number into a response message and sends it back. The initiator verifies the respondent's signature and measurement report. If the verification is successful and the measurement value meets the pre-stored benchmark value, the two-way authentication is completed and a secure communication link is established. If the verification fails or the measurement is abnormal, the authentication is terminated and the respondent is added to the access blacklist. The blacklist validity period is set according to the abnormality level, and an alarm is sent to the security management platform. In the authentication process, the identity identifier and public key are bound using the national cryptographic algorithm, eliminating the need to transmit digital certificates.

[0042] It should be noted that a secure communication link is established only when both identity authentication and trusted status verification pass. If the trusted status of the peer node is abnormal, the authentication process is immediately terminated and the node is added to the access blacklist. The validity period of the blacklist is set from 1 hour to permanent, depending on the level of abnormality. At the same time, an alarm message is reported to the security management platform. S402: Message protocol parsing and encryption includes: performing deep protocol parsing on business messages through the core security engine, identifying message types and extracting core business fields and non-core fields based on the frame format characteristics of the power system business protocol; For the core business fields, selective encryption and decryption are performed using the national standard symmetric encryption algorithm; for the non-core fields, integrity verification is performed using the national standard cryptographic hash algorithm. The encryption and decryption process is completed at the host operating system kernel layer and is transparent to upper-layer business applications. By identifying business priorities, differentiated encryption processing strategies are adopted based on message type; During the selective encryption and decryption process, the message header and length fields are preserved as plaintext, and the encrypted message maintains a frame format that conforms to the corresponding protocol.

[0043] S403: During host operation, the host integrity verification module performs real-time dynamic measurement of the host's operating status, and the dynamic authorization access control module performs fine-grained permission verification on the node's access requests, immediately intercepts and handles illegal access and abnormal behavior, and generates audit logs simultaneously. All security operations are transparent to upper-layer business applications, and business applications can achieve end-to-end security protection without adjusting their business processes.

[0044] Furthermore, in this embodiment, step S5 monitors service traffic and node access status, dynamically adjusts the security component cluster size and transmission scheduling, and performs version verification on the transmitted data. Specific steps include: S501: Real-time collection of operational data such as service traffic load, number of node accesses, link transmission latency, and packet loss rate; based on the operational data and historical data, a prediction model is constructed to predict future traffic trends. When it is predicted that the business traffic will exceed the preset cluster capacity threshold, the horizontal dynamic expansion of the security component cluster is triggered, and new nodes are registered and security policies are synchronized; when the business traffic falls back below the threshold, the cluster is triggered to shrink and node resources are reclaimed. Specifically, when it is predicted that business traffic will exceed 80% of the cluster's capacity limit within the next 5 minutes, the cluster will automatically be dynamically expanded horizontally, and newly added security component nodes will automatically complete cluster registration, security policy synchronization, and link access; when business traffic drops to below 50% of the cluster's capacity limit, the cluster will automatically shrink, releasing computing resources and achieving elastic scheduling of cluster resources.

[0045] S502: Performs dynamic load balancing on isolated transmission links, scheduling and allocating data traffic according to the real-time transmission status and service priority of each link, and allocating priority transmission rights to high-priority services. Version identifiers and time information are added to the transmitted business data, and copies are sent through a multi-link redundant transmission mechanism. The receiving end performs consistency comparison based on the version identifier, discards expired or duplicate data, and performs version management.

[0046] Example 3 is the third embodiment of the present invention, which differs from the previous two embodiments in that: This embodiment also provides a power system edge node adaptation system based on modular host security components, including: a pluggable adaptation layer, a standardized security service layer, and a core security engine; The pluggable adaptation layer has built-in hardware adaptation unit, system adaptation unit, boundary security device adaptation unit and plug-in verification unit. It is used to load the corresponding adaptation plug-in according to the running environment information of the edge node. The plug-in verification unit performs integrity verification on the plug-in before loading. Each adaptation unit connects to different hardware architectures, operating systems and boundary security devices respectively, providing a unified underlying call channel for the standardized security service layer. The standardized security service layer has a built-in service registration unit, security invocation unit, and security capability scheduling unit. It is used to enable or disable the security function modules of the core security engine and configure the running parameters according to the resource parameters and security protection requirements of the edge nodes. The service registration unit completes the dynamic registration and deregistration of security capabilities, and the security capability scheduling unit adjusts the resource allocation ratio of each security function module. The core security engine is based on the national cryptographic system and uses trusted computing technology as the root of trust. It incorporates a lightweight two-way identity authentication module, a message protocol parsing and encryption module, a host integrity verification module, a dynamic authorization access control module, and a cluster transmission optimization module. It is used to build and start a trust chain and generate identity credentials, perform two-way identity authentication, transparent encryption and decryption of business messages, host integrity verification and dynamic access control, monitor business traffic and node access status, dynamically adjust the cluster size and transmission scheduling strategy, and perform version verification of transmitted data.

[0047] This embodiment also provides an electronic device, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the power system edge node adaptation method based on modular host security components proposed in the above embodiment.

[0048] This embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements the power system edge node adaptation method based on modular host security components as proposed in the above embodiments.

[0049] The storage medium proposed in this embodiment and the method for adapting power system edge nodes based on modular host security components proposed in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0050] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0051] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

[0052] Example 4 is applied to a distributed photovoltaic grid-connected demonstration project of a provincial power grid company. The target edge nodes include four types of typical edge devices: distributed photovoltaic grid-connected terminals, energy storage converter control hosts, distribution automation terminals, and charging pile control hosts. The hardware architecture covers three types: ARM Cortex-A53, RISC-V RV64GC, and x86-64. The operating systems include embedded Linux 5.4, VxWorks 7.0, and FreeRTOS V10.0. The interfaced boundary security devices include NARI RCS-9600 vertical encryption authentication device, Huawei USG6000 industrial firewall, and Topsec TopGate isolation gateway. The business scenarios cover distributed power grid-connected scheduling, energy storage charging and discharging control, distribution automation monitoring, and charging pile metering and billing. It needs to meet the requirements of high-volume, low-latency transmission under frequent interaction between power sources, grids, loads, and storage, as well as the Level 3 security protection requirements of the power industry's Information Security Protection Standard 2.0.

[0053] The modular host security component described in this embodiment is a lightweight embedded component integrated within the aforementioned edge service host. It adopts a layered and decoupled architecture design, consisting of three layers from top to bottom: a standardized security service layer, a pluggable adaptation layer, and a core security engine. Each layer communicates with the others through a dedicated encrypted channel based on UNIX domain sockets. The communication data is encrypted and protected using the national cryptographic algorithm SM4. The specific implementation methods of each layer are as follows: 1. Implementation of standardized security service layer The standardized security service layer serves as the unified interaction entry point for components, providing two types of standardized interfaces: Standardized secure API: The API combines a RESTful style with native C language interfaces, supporting both HTTP / HTTPS calls and local system calls. The RESTful API uses JSON format for data transmission; an example API is POST / api / v1 / auth / authenticate, used to initiate authentication requests. The native C language API example is intsec_auth_authenticate(const char* node_id, const char* credential), with a return value of 0 indicating successful authentication and a non-zero value indicating failure. API parameters comply with relevant standards such as the "Security Protection Regulations for Power Monitoring Systems" in the power industry, supporting rapid integration with business systems.

[0054] Service registration interface: Following the plug-in registration specification, it supports dynamic registration, deregistration, and status updates of security capability modules within the core security engine. It also supports standardized integration of third-party security capabilities, enabling flexible expansion of security capabilities. This layer has a built-in security capability scheduler that uses a feedback-based dynamic resource allocation algorithm to monitor the CPU and memory usage of each security module in real time. When the service load of an edge node exceeds 80%, it automatically reduces the resource allocation ratio of non-core security modules, prioritizing the operation of core business and core security functions. For example, in high-load scenarios at power distribution terminals, the CPU usage limit of the dynamic audit module can be reduced from 5% to 2% to ensure that business data transmission is not affected. This layer provides on-demand configuration of security capabilities for edge nodes with different resource constraints: for power distribution terminals and charging pile terminals with extremely limited computing power and storage resources, only the core capabilities of identity authentication and data encryption / decryption are opened; for energy storage control hosts and photovoltaic grid-connected hosts with relatively sufficient resources, all security capabilities are opened to achieve lightweight adaptation of security components.

[0055] 2. Implementation of pluggable adapter layer The pluggable adaptation layer is the core of the component's underlying adaptation. It consists of three independent units: a hardware adaptation unit, a system adaptation unit, and a boundary security device adaptation unit. Each unit adopts a unified standardized plugin interface specification. The plugin format is an ELF dynamic link library, with a single plugin size not exceeding 2MB. Hot-plugging is supported. This layer has a built-in plugin verification module that automatically calculates the SM3 hash value of the plugin file before loading and compares it with pre-stored valid hash values. Only plugins that pass the verification are allowed to run, preventing malicious plugin injection. The specific implementation is as follows: Hardware adaptation unit: It is equipped with standardized adaptation plugins for ARM Cortex-A series, ARM Cortex-M series, RISC-V RV32IMA, and x86-64 architectures. The plugins encapsulate the underlying drivers, cryptographic operation hardware acceleration interfaces, and TPCM hardware access interfaces for the corresponding hardware architecture. For example, the plugin for ARM Cortex-A53 architecture encapsulates the NEON instruction set acceleration interface, which can improve the operation speed of the national cryptographic SM4 algorithm by more than 3 times. It can automatically match and load the corresponding plugin according to the hardware architecture of the target host, and shield the differences in instruction sets, registers, and peripheral interfaces of different hardware architectures.

[0056] System adaptation unit: It comes pre-loaded with standardized adaptation plugins for Linux kernel versions 3.10 and above, VxWorks 7.0, and FreeRTOSV10.0. The plugins encapsulate the system call interfaces, memory management interfaces, and network protocol stack interfaces of the corresponding operating systems, providing a unified system call abstraction layer for the upper layer without the need to modify the upper-layer security logic for different operating systems.

[0057] Boundary security device adaptation unit: It is equipped with universal adaptation plug-ins that conform to the power industry standards for vertical encryption authentication devices, industrial firewalls, and isolation gateways. The plug-ins encapsulate the dedicated communication protocols, data interaction interfaces, and security policy synchronization interfaces of the corresponding devices, so as to realize the linkage of security policies and seamless data interaction between business hosts and boundary security devices.

[0058] In this embodiment, when a new edge node of the LoongArch architecture is added, only the corresponding hardware adaptation plugin needs to be developed according to the standardized interface specification. After the plugin is uploaded to the / opt / sec_component / plugins / hardware directory of the host, the adaptation layer can automatically recognize and load the plugin. There is no need to modify the main program of the security component or restart the host and business processes. The adaptation cycle is shortened from the traditional 15 working days to within 1 working day.

[0059] 3. Implementation of the core security engine The core security engine serves as the core of the component's security capabilities. It is based on the national cryptographic SM2 / SM3 / SM4 / SM9 algorithm system and uses the TPCM trusted platform control module of Trusted Computing 3.0 as the root of trust. It integrates five major functional modules, and the specific implementation methods of each module are as follows: Lightweight two-way authentication module: Based on the national cryptographic SM2 algorithm, a simplified three-way handshake authentication process is constructed, eliminating redundant message interactions in the traditional authentication process and merging signature verification and key negotiation steps. A single two-way authentication requires only 3 message interactions, with a total message length not exceeding 384 bytes. The unique identity credential and private key of the node are stored through the TPCM hardware module. The private key cannot be exported or read. The binding of the node identity identifier and public key is realized through the SM9 algorithm, and identity legitimacy verification can be completed without the need to deploy an additional certificate management system. At the same time, the trusted status measurement report of the peer node is obtained synchronously during the identity authentication process. Authentication is completed only when the measurement result meets the trusted benchmark, realizing dual verification of identity trust and environment trust.

[0060] The message protocol parsing and encryption module has a built-in deep parsing engine for the power system 104, 101, MMS, and OPC UA protocols. It can automatically identify message type, message structure, and core business fields. For core business fields such as telemetry, remote signaling, remote control, and remote adjustment, it uses the national cryptographic SM4 algorithm for CBC mode encryption. For non-core message header and length fields, it uses the SM3 algorithm for integrity verification. There is no need to encrypt and decrypt the entire message, which greatly reduces the cryptographic computation overhead. The encryption and decryption process is completed in the network protocol stack of the host operating system kernel, which is completely transparent to the upper-layer business applications. Business applications can achieve secure protection of transmitted data without modifying any code.

[0061] Host Integrity Verification Module: Based on Trusted Computing 3.0 technology, a complete boot trust chain is constructed, consisting of "BIOS → BootLoader → Operating System Kernel → System Critical Files → Security Components → Business Applications". Before booting, each link is statically measured using the SM3 algorithm. The measured values ​​are compared with the baseline values ​​pre-stored in TPCM. The host boot is completed only when the measurements of all links are consistent, thus achieving a trusted static environment. During host operation, the memory image of business processes, system configuration files, and security policy files are dynamically measured in real time. When abnormal measurement values ​​are detected, abnormal processes are immediately terminated, unauthorized access is blocked, and alarm information is reported to the security management platform through an encrypted channel.

[0062] Dynamic Authorization Access Control Module: Based on a subject-object-operation access control model, with the principle of least privilege as its core, it generates dynamic access control policies by combining node trust status, business scenarios, and time dimensions. It performs fine-grained verification of access requests from edge nodes using a five-tuple plus operation permissions, allowing only requests that pass identity authentication and integrity verification and have corresponding authorization to access. At the same time, it performs full-process auditing of all access behaviors. The audit log contains all elements of access subject, object, time, operation, and result. The logs are signed and solidified using the SM2 algorithm and stored in the secure storage area of ​​TPCM, which is tamper-proof and undeletable, meeting the security audit requirements of the power industry.

[0063] Cluster Transmission Optimization Module: Addressing the high-volume transmission demands of source-network-load-storage interaction scenarios, this module constructs a clustered deployment architecture. It monitors real-time data on business traffic load, number of connected nodes, link transmission latency, and packet loss rate. When the load exceeds a preset threshold, it automatically triggers horizontal cluster expansion. Newly added security component nodes automatically complete cluster registration and policy synchronization. Simultaneously, it performs dynamic load balancing for multi-link isolated transmission, adjusting data distribution ratios based on real-time link status. This supports redundant transmission of business data across multiple links and version number consistency verification, preventing packet loss, out-of-order delivery, and tampering during data transmission, ensuring low-latency and highly reliable transmission of high-volume business data.

Claims

1. A power system edge node adaptation method based on modular host security components, characterized in that, include: Based on the runtime environment information of the target edge node, load the adaptation plugin and perform integrity verification; Based on the resource conditions and security requirements of the edge nodes, the security function modules of the core security engine are tailored and configured. Establish and initiate a trust chain and generate identity credentials to complete the initialization of the trusted execution environment; Enable the trimmed security function modules to perform two-way authentication, message protocol parsing and encryption, host integrity verification and dynamic access control; Monitor business traffic and node access status, dynamically adjust the size of the security component cluster and transmission scheduling, and perform version verification on the transmitted data.

2. The power system edge node adaptation method based on modular host security components as described in claim 1, characterized in that, The configuration and customization of the security function modules of the core security engine includes: after completing the adaptation of the underlying environment, a security capability scheduler is built into the standardized security service layer, and a service registration interface is provided for the dynamic registration and deregistration of security function modules; The service registration interface is used to obtain the computing and storage resource parameters of the edge node, as well as the security protection level requirements of the business scenario. Based on the resource parameters and security protection level requirements, enable or disable the security function modules in the core security engine, disable redundant functions, and configure the operating parameters for the enabled modules. The security capability scheduler sets the initial resource allocation ratio for each enabled security function module and dynamically adjusts the resource allocation ratio based on the real-time load of the edge nodes. When the service load of the edge nodes exceeds a preset threshold, the resource allocation of non-core security function modules is adjusted.

3. The power system edge node adaptation method based on modular host security components as described in claim 2, characterized in that, The process of building and starting the trust chain and generating identity credentials to complete the initialization of the trusted execution environment includes: using the trusted platform control module as the root of trust, employing the national cryptographic hash algorithm, performing pre-boot static measurements on the host BIOS, BootLoader, operating system kernel, system critical files, and security components themselves in sequence, generating integrity measurement benchmark values ​​for each link, and storing the benchmark values ​​in the designated storage area of ​​the trusted platform control module. A unique key pair between the edge node and the business host is generated using the national cryptographic asymmetric cryptographic algorithm, and an identity credential bound to the node identity is generated using the national cryptographic identifier cryptographic algorithm. The private key and identity credentials are encrypted and stored in the secure storage area of ​​the trusted platform control module, and the private key is set to be non-exportable. Complete the startup trust chain construction from the hardware root of trust to the operating system, security components and business applications, and initialize the trusted execution environment.

4. The power system edge node adaptation method based on modular host security components as described in claim 3, characterized in that, The two-way authentication includes: the initiator generates a first random number, encapsulates its own identity identifier and the first random number into an authentication request message and sends it to the responder; The responder verifies the binding relationship between the identity identifier and the public key using the national cryptographic algorithm, signs the request message using the private key of the trusted platform control module, obtains the local integrity measurement report, and encapsulates the signature, measurement report, and second random number into a response message and sends it back. The initiator verifies the respondent's signature and measurement report. If the verification is successful and the measurement value meets the pre-stored benchmark value, the two-way authentication is completed and a secure communication link is established. If the verification fails or the measurement is abnormal, the authentication is terminated and the respondent is added to the access blacklist. The blacklist validity period is set according to the abnormality level, and an alarm is sent to the security management platform. In the authentication process, the identity identifier and public key are bound using the national cryptographic algorithm, eliminating the need to transmit digital certificates.

5. The power system edge node adaptation method based on modular host security components as described in claim 4, characterized in that, The message protocol parsing and encryption includes: performing deep protocol parsing on business messages through the core security engine, identifying message types based on the frame format characteristics of the power system business protocol, and extracting core business fields and non-core fields; For the core business fields, selective encryption and decryption are performed using the national standard symmetric encryption algorithm; for the non-core fields, integrity verification is performed using the national standard cryptographic hash algorithm. The encryption and decryption process is completed at the host operating system kernel layer and is transparent to upper-layer business applications. By identifying business priorities, differentiated encryption processing strategies are adopted based on message type; During the selective encryption and decryption process, the message header and length fields are preserved as plaintext, and the encrypted message maintains a frame format that conforms to the corresponding protocol.

6. The power system edge node adaptation method based on modular host security components as described in claim 5, characterized in that, The dynamic adjustment of the security component cluster size and transmission scheduling includes: real-time collection of operational data such as service traffic load, number of nodes accessed, link transmission latency and packet loss rate, and construction of a prediction model based on the operational data and historical data to predict future traffic trends; When it is predicted that the business traffic will exceed the preset cluster capacity threshold, the horizontal dynamic expansion of the security component cluster is triggered, and new nodes are registered and security policies are synchronized; when the business traffic falls back below the threshold, the cluster is triggered to shrink and node resources are reclaimed. Dynamic load balancing is performed on isolated transmission links, and data traffic is scheduled and allocated according to the real-time transmission status and service priority of each link, and priority transmission rights are allocated to high-priority services. Version identifiers and time information are added to the transmitted business data, and copies are sent through a multi-link redundant transmission mechanism. The receiving end performs consistency comparison based on the version identifier, discards expired or duplicate data, and performs version management.

7. The power system edge node adaptation method based on modular host security components as described in claim 6, characterized in that, The method is based on a modular host security component, which includes a standardized security service layer, a pluggable adaptation layer, and a core security engine. The pluggable adaptation layer is used to load adaptation plugins and includes a hardware adaptation unit, a system adaptation unit, and a boundary security device adaptation unit, wherein: The hardware adaptation unit has pre-set standardized adaptation plugins for different hardware architectures; The system adaptation unit has pre-set standardized adaptation plugins for different operating systems; The boundary security device adapter unit is pre-loaded with standardized adapter plug-ins for different types of boundary security devices. The adapter plugin is based on a unified standardized interface specification, adopts the form of a dynamic link library, supports hot-swapping, and does not require restarting the business host during loading and unloading. It is also decoupled from the core security engine. When the hardware, operating system, or boundary security device changes, the corresponding adapter plugin is updated to complete the adaptation without modifying the main code of the core security engine and the standardized security service layer. The integrity verification of the plugin before loading includes: using the national cryptographic hash algorithm to perform integrity calculation on the plugin file through the plugin verification module, comparing it with the pre-stored benchmark value, and only legitimate plugins that pass the verification are allowed to run; third-party developed adaptation plugins also need to be verified by digital signature using the national cryptographic algorithm.

8. A power system edge node adaptation system based on modular host security components, employing the power system edge node adaptation method based on modular host security components as described in any one of claims 1 to 7, characterized in that, include: Pluggable adapter layer, standardized security service layer, and core security engine; The pluggable adaptation layer has a built-in hardware adaptation unit, system adaptation unit, boundary security device adaptation unit, and plug-in verification unit. It is used to load the corresponding adaptation plug-in according to the running environment information of the edge node. The plug-in verification unit performs integrity verification on the plug-in before loading. Each adaptation unit connects to different hardware architectures, operating systems, and boundary security devices to provide a unified underlying call channel for the standardized security service layer. The standardized security service layer includes a service registration unit, a security invocation unit, and a security capability scheduling unit. These units enable or disable the security function modules of the core security engine and configure their operating parameters based on the resource parameters and security protection requirements of the edge nodes. The service registration unit performs dynamic registration and deregistration of security capabilities, and the security capability scheduling unit adjusts the resource allocation ratio of each security function module. The core security engine is based on the national cryptographic system and uses trusted computing technology as the root of trust. It incorporates a lightweight two-way identity authentication module, a message protocol parsing and encryption module, a host integrity verification module, a dynamic authorization access control module, and a cluster transmission optimization module. It is used to build and start a trust chain and generate identity credentials, perform two-way identity authentication, transparent encryption and decryption of business messages, host integrity verification and dynamic access control, monitor business traffic and node access status, dynamically adjust the cluster size and transmission scheduling strategy, and perform version verification of transmitted data.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the power system edge node adaptation method based on modular host security components as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the power system edge node adaptation method based on the modular host security component as described in any one of claims 1 to 7.

Images