WO2023216641A1

WO2023216641A1 - Security protection method and system for power terminal

Info

Publication number: WO2023216641A1
Application number: PCT/CN2023/070408
Authority: WO
Inventors: 孙歆; 汪自翔; 韩嘉佳; 吕磅; 戴桦; 汪溢镭; 李沁园; 孙昌华; 王译锋
Original assignee: 国网浙江省电力有限公司电力科学研究院
Priority date: 2022-05-07
Filing date: 2023-01-04
Publication date: 2023-11-16
Also published as: CN114584405B; CN114584405A

Abstract

The present application belongs to the technical field of power terminal devices. Disclosed are a security protection method and system for a power terminal. Existing protection technology simply performs control and isolation on application services, and cannot really solve the problem of network security of the existing power Internet of Things. In the security protection method for a power terminal in the present application, a zero-trust module is constructed to perform powerful monitoring on a power terminal device, trust scoring needs to be performed on the power terminal device before data collection, and a mode of performing assessment before collection is used, such that physical attacks can be effectively reduced, the accuracy of data collection can be ensured, and lightweight collection of data information of a terminal can be realized. Moreover, a security situation sensing module is constructed to perform situation sensing on collected data, such that the security and compliance of the data are ensured. Furthermore, a real-time management and control module is constructed to manage and control sensed data, and a security instruction is generated to perform security protection on the power terminal device, such that an abnormal situation can be coped with in an efficient and timely manner, so as to perform emergency response.

Description

A power terminal safety protection method and system

Technical field

The invention relates to a power terminal safety protection method and system, belonging to the technical field of power terminal equipment.

Background technique

In response to the business development needs of new power systems, the original wall-type protection system with heavy boundaries and strong protection has been difficult to adapt to.

In terms of terminals, massive power IoT terminals are widely connected, making security management and control more difficult. For example, distributed wind power and photovoltaic business terminals are located in remote areas, where it is difficult to ensure the security of the system and lack real-time sensing and processing methods.

In terms of boundaries, firstly, direct data collection will expose unnecessary attack surfaces, and it is difficult to restrict lateral movement on the platform side and edge side; secondly, new services have high cross-region interaction frequency and large data volume, but currently Cross-regional data interaction efficiency is low. For example, when large-concurrent services such as power trading and high-bandwidth video services such as drones interact across regions, border protection measures become a business performance bottleneck.

In terms of business, firstly, some control-related businesses have been extended outwards, and the demand for access to wireless control-related services is strong, leading to increased risks; secondly, with the expansion of business, various business systems have converged in the data center and are continuously open to the outside world. With shared utilization, data security and compliance risks increase sharply. For example, low-voltage distributed power supplies and user energy storage are connected to distribution stations on a large scale to join the coordinated control of source, grid, load and storage, and business data is connected to the provincial public data platform.

In terms of security management and control, new business interaction requirements and complexity have increased, making it difficult to respond to security emergencies in a timely and efficient manner. For example, if a smart terminal is invaded by physical means, its access and communication cannot be immediately restricted, leading to the expansion of security incidents.

Furthermore, Chinese patent application (publication number: CN112511618A) discloses an edge IoT agent protection method and a power IoT dynamic security and trustworthy system, which relate to the technical field of power IoT security protection. The edge IoT agent protection method is based on Credibility classifies terminal application services, including trusted terminal services and ordinary terminal services; parallel isolation control is performed on the trusted terminal services and ordinary terminal services; wherein, the trusted terminal services are controlled by creating a trusted business domain Processing, by creating a common business domain to process common terminal services.

The above solution classifies terminal application services into trusted terminal services and ordinary terminal services, and performs parallel isolation control on the trusted terminal services and ordinary terminal services, but does not have any protective measures for terminal equipment. After the terminal device is invaded, it is possible to upload false information, or even Trojans and viruses, and it is impossible to ensure that the collected information is not tampered with. Therefore, only controlling and isolating the application business cannot truly solve the network security problems of the existing power Internet of things. .

Contents of the invention

In view of the shortcomings of the existing technology, the first object of the present invention is to provide a zero-trust module to powerfully monitor power terminal equipment. The zero-trust module can collect equipment information of the power terminal equipment; and perform monitoring based on the collected equipment information. Trust score gives a trust value, so that abnormal power terminal equipment can be identified in time, which can effectively prevent power terminal equipment from uploading false information, Trojans, and viruses, and ensure that the collected information has not been tampered with; adopt the method of evaluating first and then collecting , on the one hand, it can actively and quickly verify the security information of the terminal, accurately detect and control the terminal, and reduce physical attacks. On the other hand, it ensures the accuracy of data collection and realizes lightweight collection of terminal data information; at the same time, it builds a security situation awareness module to Collect data for situational awareness to ensure data security and compliance; a real-time management and control module is constructed to manage and control the sensed data and generate safety instructions to carry out safety protection and security reinforcement for power terminal equipment, which can respond to abnormal situations in a timely and efficient manner. Emergency response and power terminal security protection methods to avoid the expansion of security incidents.

The second object of the present invention is to provide an assembly of zero-trust equipment to perform powerful monitoring of power terminal equipment. The equipment information of the power terminal equipment can be collected through the zero-trust equipment; and a trust score is performed based on the collected equipment information to give a trust value. Then, data is collected from power terminal equipment that meets the requirements. Using this method of first evaluation and then collection, abnormal power terminal equipment can be identified in a timely manner, which can effectively reduce physical attacks, ensure the accuracy of data collection, and effectively avoid Power terminal equipment uploads false information, Trojans, and viruses to ensure that the collected information is not tampered with, enabling lightweight collection of terminal data information; setting up a data platform can generate security instructions based on parsed data to provide security protection for power terminal equipment And security reinforcement, a power terminal security protection system that can respond to abnormal situations in a timely and efficient manner, conduct emergency responses, and avoid the expansion of security incidents.

In order to achieve one of the above objects, the first technical solution of the present invention is:

A power terminal safety protection method,

Includes the following steps:

Step 1: Build a zero-trust module to collect equipment information of power terminal equipment; conduct trust scoring based on the collected equipment information and give a trust value;

Evaluate power terminal equipment based on trust value and classify power terminal equipment into trustworthy equipment and abnormal equipment;

Step two: collect data from the trusted device in step one to obtain the collected data;

Step three: Build a security situation awareness module to perform situation awareness on the data collected in step two;

When the perception is qualified, the collected data will be converted into perception data;

The situational awareness includes intrusion detection or/and vulnerability awareness or/and file integrity detection or/and log monitoring operations;

Step 4: Build a real-time management and control module to manage and control the sensing data in step 4 and generate safety instructions;

Step 5: Issue the security instructions in Step 4 to the power terminal equipment to perform safety protection and security reinforcement on the power terminal equipment;

The security protection and security reinforcement include security detection or/and security reinforcement or/and file permission management or/and security upgrade.

After continuous exploration and testing, the present invention constructs a zero-trust module to powerfully monitor power terminal equipment. The zero-trust module can collect equipment information of power terminal equipment, and at the same time performs trust scoring based on the collected equipment information to give a trust value, thereby Abnormal power terminal equipment can be identified in a timely manner, which can effectively prevent power terminal equipment from uploading false information, Trojans, and viruses, and ensure that the collected information is not tampered with.

Furthermore, before data collection, the present invention needs to conduct a trust score on the power terminal equipment, and adopts the method of first evaluation and then collection. Compared with the general passive authentication mode or the direct data collection mode, on the one hand, it can ensure the accuracy of data collection; On the other hand, it can actively and quickly check the security information of the terminal, accurately detect and control the terminal, effectively reduce physical attacks, and realize lightweight collection of terminal data information.

Therefore, the present invention can be applied to new services with high cross-regional interaction frequency and large data volume, and is particularly suitable for boundary protection measures when large-concurrent services such as power transactions and large-bandwidth video services such as drones interact across major regions.

At the same time, the present invention builds a security situation awareness module to perform situation awareness on the collected data, and performs operations such as intrusion detection or/and vulnerability perception or/and file integrity detection or/and log monitoring operations on the collected data to ensure data security and integrity. regulations to further prevent data from being tampered with.

Furthermore, the present invention constructs a real-time management and control module to manage and control the sensing data, generate safety instructions, and perform safety protection and safety reinforcement on the power terminal equipment, so as to respond to abnormal situations in a timely and efficient manner and perform emergency response. For example: when power terminal equipment is invaded by physical means, security instructions can be issued in a timely manner to control the power terminal equipment to immediately restrict its access and communication to avoid the expansion of security incidents.

As preferred technical measures:

In step one, the process of collecting device information by the zero trust module is: reading device data, reading rule files, parsing the rule library, and collecting device information;

At the same time, the zero-trust module performs continuous dynamic device authentication on power terminal equipment to block false device information;

Trust value is an indicator of identity verification, and is obtained by a comprehensive score based on the basic attributes of the device and access delay;

Maintenance of trust values includes the following:

(1) The maximum trust value is M and the minimum is N; M>N

(2) The trust value threshold is H. If it is higher than or equal to H, it is a legitimate user, and if it is lower than H, it is an illegal user;

(3) Each time the verification is successful, the trust value increases by T;

(4) Each time verification fails, the trust value is reduced by T.

Priority, M=100, N=0, H=60, T=1.

The trust value includes direct trust value, delay assessment trust value, and abnormal behavior assessment trust value. The calculation formula is as follows:

T＝T _d +T _t +T _a

T is the trust value, T _d is the direct trust value, T _t is the delay evaluation trust value, and T _a is the abnormal behavior evaluation trust value;

The direct trust value is the S-shaped function SIGMOID, and its calculation formula is:

Among them, T _d is the direct trust value, and f is the direct trust value constraint coefficient of different devices;

The delay assessment trust value and the abnormal behavior assessment trust value constitute the indirect trust value;

The delay evaluation trust value is evaluated based on the device response time, and its calculation formula is:

Among them, T _t is the delay evaluation trust value, τ is the maximum allowable delay of device response, and D is the information transmission delay;

Abnormal behavior evaluation trust value is evaluated based on the proportion of abnormal device behavior and normal behavior. The calculation formula is:

Among them, T _a is the abnormal behavior evaluation trust value, A _u is the amount of abnormal behavior, and A _n is the amount of normal behavior.

As preferred technical measures:

The abnormal situations of the power terminal equipment include the following:

(1) A certain power terminal equipment is set to upload equipment information at a certain time on a certain day, and the equipment information is uploaded with a delay. According to the delay evaluation trust value calculation formula, the trust value of the power terminal equipment is calculated. When the trust value is lower than the threshold When, abnormal equipment alarm is issued;

(2) Power terminal equipment performs identity verification in the form of passwords. If the verification fails, the trust value will be deducted. If a certain power terminal equipment fails verification multiple times, the trust value will continue to be deducted. When the trust value of the power terminal equipment is lower than the trust threshold, Alarm for abnormal equipment;

(3) The information interaction time of power terminal equipment is fixed, the interactive information is fixed, and a certain power information interaction time is chaotic, the interactive information is chaotic, and abnormal behavior is obvious. According to the abnormal behavior evaluation trust value calculation formula, the trust value of the power terminal equipment is calculated. When the trust value of the power terminal equipment is lower than the threshold, an abnormal equipment alarm is issued;

Device information includes the power terminal's operating system kernel version, operating system release version, etc., CPU name, CPU architecture, CPU core number, memory size, storage size, network card information name, network card information address, network card information status, network card information type, network card The amount of information flow.

As preferred technical measures:

In the third step, intrusion detection is divided into anomaly detection and misuse detection;

The anomaly detection includes the following:

Establish a module for normal system access behavior. Any visitor's behavior that does not comply with this module will be judged as an intrusion;

The misuse detection includes the following:

Summarize a number of unfavorable and unacceptable behaviors to establish a module. Any visitor's behavior that conforms to this module will be judged as an intrusion;

The calculation formula of intrusion detection is:

Value(I ₁ ,I ₂ )＝[L(I ₁ ,I ₂ )] ^α [C(I ₁ ,I ₂ )] ^β [S(I ₁ ,I ₂ )] ^γ (1)

Among them, Value(I ₁ ,I ₂ ) is used to express the intrusion detection results;

I ₁ and I ₂ correspond to normal access and undetected access;

L(I ₁ ,I ₂ ) is the access speed difference;

C(I ₁ ,I ₂ ) is the access address difference;

S(I ₁ ,I ₂ ) is the access device difference;

α is the constraint coefficient used to adjust the weight of the access speed difference, usually taking a value of 1;

β is the constraint coefficient used to adjust the weight of access address differences, usually taking a value of 1;

γ is the constraint coefficient used to adjust the difference weight of access devices, usually taking a value of 1;

a is the constraint coefficient of the access speed attribute difference;

b is the constraint coefficient of the access address attribute difference;

c is the constraint coefficient for accessing device attribute differences;

Usually a is a constant 6.5, b is a constant 58.5, and c is a constant 29.25;

u ₁ and u ₂ are the average speeds corresponding to normal access and undetected access respectively;

σ ₁ and σ ₂ are the address values corresponding to normal access and access to be detected respectively;

σ ₁₂ is the fixed information value of the access device.

As preferred technical measures:

The vulnerability sensing is to detect the connection status of relevant network nodes;

The vulnerability perception is to detect the connection status of relevant network nodes, and its calculation formula is:

Among them, s _ij is the vulnerability value, n _i is the connection value of the network node to be detected, n _j is the connection value of adjacent network nodes, and λ is a variable parameter. The corresponding values are selected according to different terminal types to obtain the most suitable network node. Connect the value.

As preferred technical measures:

The file integrity detection includes the following:

Continuously monitor files, folders, and directories specified in its supervision configuration file to capture changes that have occurred;

Monitor entire directory structures or individual files and folders for events;

The events include creating, deleting, or renaming files, folders, and directories; accessing files and folders; changing file and folder attributes; changing security settings for files, folders, or directories;

The calculation formula for file integrity detection is:

Among them, testing is the integrity detection value. When the current file is the same as the original file, it is a true value, otherwise it is a false value;

ture is the truth value judgment function;

false is the false value judgment function;

newfile is the current file;

oldfile is the original file;

The log monitoring is real-time monitoring and analysis of important log files in the system to detect the attack methods of intruders on the system;

Attack methods include brute force attacks, privilege escalation, and scanning.

As preferred technical measures:

In the fifth step, security detection is based on the sensing data statistically analyzed by the security situation awareness module to achieve real-time monitoring of abnormal behavior of power terminals;

The security hardening includes password hardening and kernel virtual patching;

The file permission management includes the following:

Continuously monitor file permissions and detect abnormal permission changes. That is, through changes in the integrity, structure, and permissions of terminal files, risk situations will be discovered in advance and dealt with early;

The security upgrades include the following:

Remote upgrade and local upgrade, remote upgrade provides rapid upgrade service through the security monitoring center, and supports remote deployment of new equipment online; local upgrade performs local upgrade through power terminals.

As preferred technical measures:

It also includes a data storage module and a data visualization module;

The data storage module constructs a database for storing sensing data and control data;

The data visualization module obtains data from the data storage module and can display the terminal type, danger level, network type, and security vulnerability of the power terminal equipment.

In order to achieve one of the above objects, the second technical solution of the present invention is:

A power terminal safety protection method,

Includes the following steps:

Step 1: Build a zero-trust module to collect equipment information of power terminal equipment, and conduct trust value scoring based on the collected equipment information to give a trust value;

When the trust value reaches the standard, the power terminal equipment is trusted and the power terminal equipment is identified as a trusted device;

When the trust value does not meet the standard, the power terminal equipment will be identified as an abnormal equipment and an abnormal equipment alarm will be issued;

Step two: collect data from the trusted equipment in step one to obtain the collected data;

Step three: Build a security situation awareness module to perform intrusion detection, vulnerability awareness, file integrity detection, log monitoring operations on the collected data in step two, and convert the collected data into sensing data;

Step 4: Build a real-time management and control module to detect and control the sensing data in step 3, and generate safety instructions;

Step 5: Issue the security instructions in Step 4 to the power terminal equipment to perform security protection and security reinforcement on the power terminal equipment to achieve security detection, security reinforcement, file permission management, and security upgrade of the power terminal equipment.

The zero-trust module of the present invention can collect equipment information of power terminal equipment, and at the same time perform trust scoring based on the collected equipment information and give a trust value, so that abnormal power terminal equipment can be identified in a timely manner, and thus the upload of power terminal equipment can be effectively avoided. False information, Trojans, and viruses to ensure that the collected information is not tampered with.

Furthermore, before data collection, the present invention needs to perform trust scoring on power terminal equipment. By adopting the method of first evaluation and then collection, it can effectively reduce physical attacks, ensure the accuracy of data collection, and realize lightweight collection of terminal data information; Compared with the general passive authentication mode, the evaluation method of the present invention can proactively and quickly verify the security information of the terminal and accurately detect the management and control terminal. Therefore, it can be applied to new businesses with high cross-regional interaction frequency and large data volume, especially power transactions. Boundary protection measures when large concurrent services and high-bandwidth video services such as drones interact across regions.

At the same time, the present invention builds a security situation awareness module to collect data to perform a series of operations such as intrusion detection, vulnerability perception, file integrity detection, log monitoring, etc., and can convert the collected data into sensing data to ensure data security and compliance, and further avoid Data has been tampered with.

Moreover, the present invention builds a real-time management and control module to manage and control the sensing data, generate safety instructions, and perform operations such as safety detection, safety reinforcement, file permission management, and safety upgrades on power terminal equipment, so as to respond to abnormal situations in a timely and efficient manner. , carry out emergency response. For example, when a certain power terminal equipment is invaded by physical means, security instructions can be issued in a timely manner to control the power terminal equipment to immediately restrict its access and communication to avoid the expansion of security incidents.

In order to achieve one of the above objects, the third technical solution of the present invention is:

A power terminal safety protection system,

Apply the above-mentioned power terminal security protection method, which includes zero-trust terminals, network probes, edge IoT agents, and data platforms;

The zero-trust terminal collects the equipment information of the power terminal, obtains the equipment data stream, and performs trust value scoring based on the equipment information to give a trust value;

The network probe collects security information of power terminal equipment and obtains security data streams;

The edge IoT agent reads and parses the device data stream and security data stream to obtain parsed data, and uploads the parsed data to the data platform;

The data platform processes the parsed data and generates safety instructions;

Security instructions are issued to the power terminal equipment through the edge IoT agent to perform security protection and security reinforcement on the power terminal equipment.

After continuous exploration and testing, the present invention assembles zero-trust equipment to powerfully monitor power terminal equipment. The zero-trust equipment can collect equipment information of power terminal equipment, and at the same time perform trust scoring based on the collected equipment information to give a trust value, thereby Abnormal power terminal equipment can be identified in a timely manner, which can effectively prevent power terminal equipment from uploading false information, Trojans, and viruses, and ensure that the collected information is not tampered with.

Furthermore, before data collection, the present invention needs to perform trust scoring on power terminal equipment. By adopting the method of first evaluation and then collection, it can effectively reduce physical attacks, ensure the accuracy of data collection, and realize lightweight collection of terminal data information; Compared with the general passive authentication mode, the protection system of the present invention can proactively and quickly verify the security information of the terminal and accurately detect the management and control terminal. Therefore, it can be applied to new businesses with high cross-regional interaction frequency and large data volume, especially power transactions. Boundary protection measures when large concurrent services and high-bandwidth video services such as drones interact across regions.

Moreover, the present invention is equipped with a data platform that can generate safety instructions based on parsed data, perform safety protection and safety reinforcement on power terminal equipment, and can respond to abnormal situations in a timely and efficient manner and perform emergency responses. For example, when a smart terminal is invaded by physical means, security instructions can be issued in a timely manner to control the power terminal equipment to immediately restrict its access and communication to avoid the expansion of security incidents.

Compared with the prior art, the present invention has the following beneficial effects:

Furthermore, the present invention constructs a real-time management and control module to manage and control the sensing data, generate safety instructions, and perform safety protection and safety reinforcement on the power terminal equipment, so as to respond to abnormal situations in a timely and efficient manner and perform emergency response. For example, when a smart terminal is invaded by physical means, security instructions can be issued in a timely manner to control the power terminal equipment to immediately restrict its access and communication to avoid the expansion of security incidents.

Description of the drawings

Figure 1 is a flow chart of the protection method of the present invention;

Figure 2 is a structural diagram of the protection system of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention and are not intended to limit the present invention.

On the contrary, the invention covers any alternatives, modifications, equivalent methods and solutions that fall within the spirit and scope of the invention as defined by the claims. Furthermore, in order to enable the public to have a better understanding of the present invention, some specific details are described in detail in the following detailed description of the present invention. It is possible for a person skilled in the art to fully understand the present invention without these detailed descriptions.

Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the technical field to which the invention belongs. The terminology used herein is for the purpose of describing specific embodiments only and is not intended to be limiting of the invention. As used herein, the term "or/and" includes any and all combinations of one or more of the associated listed items.

As shown in Figure 1, a specific embodiment of the power terminal security protection method of the present invention:

A power terminal safety protection method,

Includes the following steps:

Step 1: Build a zero-trust module to collect equipment information of power terminal equipment, and conduct trust scoring based on the collected equipment information to give a trust value;

A best embodiment of the power terminal safety protection method of the present invention:

A power terminal safety protection method,

Includes the following steps:

As shown in Figure 2, a specific embodiment of the power terminal safety protection system of the present invention:

A power terminal safety protection system,

The data platform processes the parsed data and generates safety instructions;

A specific embodiment of applying the present invention:

Taking a certain power terminal equipment in a certain substation as an example, the specific implementation process of the present invention is demonstrated, which specifically includes hardware connection, system startup, identity verification, security perception, security protection, and security visualization.

The hardware connections include the following:

First, connect the zero-trust terminal and network probe to the power terminal respectively, and then use 485 shielded twisted pair and network cable to connect to the edge IoT agent device. The edge IoT agent device is connected to the data platform through a network cable. Among them, the zero-trust terminal and network probe The needle, edge IoT agent device and data platform are configured in the same LAN, so that the edge IoT agent device can access the zero trust terminal, network probe and data platform.

The system startup includes the following:

Start the zero trust terminal, network probe, edge IoT agent and data platform respectively. The system will start automatically after booting. Then enter the preset address and log in to the data platform. Applications of the data platform include front-end, back-end, database and MQTTbroker.

Said authentication includes the following

The power terminal equipment requests identity verification. The zero-trust terminal gives a trust value based on the trust value score of the device information and performs two operations based on the trust threshold. If the trust value reaches the standard, the device is trusted and information can be collected normally. Otherwise, abnormal device alarms are issued.

The principles for maintaining trust value are:

(1) The maximum trust value is 100 and the minimum is 0;

(2) The trust value threshold is 60. If it is higher than or equal to 60, it is a legitimate user, and if it is lower than 60, it is an illegal user;

(3) The trust value increases by 1 for each successful verification;

(4) The trust value is reduced by 1 for each verification failure.

Examples of abnormal device trust values:

(1) The power terminal equipment is set to upload equipment information at six o'clock on Saturday evening. There is a delay in uploading the information of a certain power equipment. According to the delay evaluation trust value evaluation method, it is learned that the trust value of the equipment is lower than the threshold, so an abnormal equipment alarm is issued.

(2) Electric power equipment performs identity verification in the form of passwords. If the verification fails, the trust value will be deducted. If a certain electric power fails to be verified multiple times, the trust value will continue to be deducted. The trust value is lower than the trust threshold, so abnormal equipment alarms are issued.

(3) The power equipment information interaction time is fixed, the interaction information is fixed, and a certain power information interaction time is disordered, the interaction information is confusing, and the abnormal behavior is obvious. Based on the abnormal behavior evaluation, it is determined that the trust value of the equipment is lower than the threshold, so an abnormal equipment alarm is performed.

The security awareness includes the following:

In the system module, zero-trust terminals and network probes are used to collect equipment information and security information of power terminals and upload them to the edge IoT agent; the edge IoT agent is responsible for reading and parsing the data uploaded by zero-trust terminals and network probes Stream to upload the parsed data to the data platform.

In the method module, the security situation awareness module collects power terminal data, performs intrusion detection, vulnerability awareness, file integrity detection, log monitoring and other operations, and sends the data to the real-time management and control module and data storage module, and the data storage module further uploads it. to the data visualization module.

Intrusion detection: (1) Define the characteristics of events that violate security policies, such as certain header information of network data packets. Detection mainly determines whether such features appear in the collected data. (2) Define a set of values for "normal" conditions of the system, such as CPU utilization, memory utilization, file checksums, etc. (This type of data can be defined manually, or it can be obtained by observing the system and using statistical methods), The running values of the system are then compared with the defined "normal" conditions to determine whether there are signs of an attack.

Vulnerability perception: Use simulated hacker attacks to detect known security vulnerabilities that may exist on the target one by one. Security vulnerabilities can be detected on various objects such as workstations, servers, switches, databases, etc.

File Integrity Detection: Continuously monitors files, folders, and directories specified in its supervision configuration file. It captures changes that have occurred and can monitor the entire directory structure or individual files and folders for events, such as: creation, deletion Or rename files, folders and directories; access files and folders; change file and folder properties; change security settings of files, folders or directories, such as permission changes, etc.

In the event of an intruder attack, file integrity monitoring can determine which files have been changed. Using this information, damage can be quickly assessed and incident response initiated. If employees or administrators often modify files unintentionally. Sometimes these changes are so subtle that they go unnoticed, but they can lead to security breaches or hinder business operations. File integrity monitoring helps zero in on changes to files so they can be rolled back or other remedial action taken.

Log monitoring: The process of gaining real-time visibility into the records generated by a host or device. Extract system log characteristic data, detect system log anomalies, feed back additions, deletions, modifications and check operations of system logs, and detect whether system logs have been tampered with.

The security protection includes the following

On the basis of security perception, in the protection system, the data platform analyzes and processes equipment information and security information, issues security protection and security reinforcement instructions, and alarms abnormal terminal equipment; in the method module, the real-time management and control module responds to the received security situation Perceive the security information sent by the module, perform security detection, security reinforcement, file permission management, security audit and other operations, issue relevant security instructions to the power terminal, and send the control data to the data storage module, which is further uploaded to data visualization. module.

Said security visualization includes the following

On the basis of security protection, in the protection system, the data platform displays the data sent by the edge generation; in the method module, the data visualization module reads relevant data from the data storage module database, and displays the terminal type and terminal type when the power terminal is running in the form of a chart. Network information, security vulnerabilities, danger levels, etc.

Those skilled in the art will understand that embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions executed by the processor of the computer or other programmable data processing device produce a use A device for realizing the functions specified in one process or multiple processes of the flowchart and/or one block or multiple blocks of the block diagram.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that the present invention can still be modified. Modifications or equivalent substitutions may be made to the specific embodiments, and any modifications or equivalent substitutions that do not depart from the spirit and scope of the invention shall be covered by the scope of the claims of the invention.

Claims

A power terminal safety protection method, characterized by:

Includes the following steps:

Step 1: Build a zero-trust module to collect equipment information of power terminal equipment;

And perform trust scoring based on the collected device information and give a trust value;

Evaluate power terminal equipment based on trust value and classify power terminal equipment into trustworthy equipment and abnormal equipment;

The process of collecting device information by the zero trust module is: reading device data, reading rule files, parsing the rule library, and collecting device information;

At the same time, the zero-trust module performs continuous dynamic device authentication on power terminal equipment to block false device information;

Trust value is an indicator of identity verification, and is obtained by a comprehensive score based on the basic attributes of the device and access delay;

Maintenance of trust values includes the following:

(1) The maximum trust value is M and the minimum is N; M>N

(2) The trust value threshold is H. If it is higher than or equal to H, it is a legitimate user, and if it is lower than H, it is an illegal user;

(3) Each time the verification is successful, the trust value increases by T;

(4) The trust value is reduced by T for each verification failure;

The trust value includes direct trust value, delay assessment trust value, and abnormal behavior assessment trust value. The calculation formula is as follows:

T＝T d +T t +T a

T is the trust value, T d is the direct trust value, T t is the delay evaluation trust value, and T a is the abnormal behavior evaluation trust value;

The direct trust value is an S-shaped function, and its calculation formula is:

Among them, T d is the direct trust value, and f is the direct trust value constraint coefficient of different devices;

The delay assessment trust value and the abnormal behavior assessment trust value constitute the indirect trust value;

The delay evaluation trust value is evaluated based on the device response time, and its calculation formula is:

Among them, T t is the delay evaluation trust value, τ is the maximum allowable delay of device response, and D is the information transmission delay;

Abnormal behavior evaluation trust value is evaluated based on the proportion of abnormal device behavior and normal behavior. The calculation formula is:

Among them, T a is the abnormal behavior evaluation trust value, A u is the amount of abnormal behavior, and A n is the amount of normal behavior.

Step two: collect data from the trusted device in step one to obtain the collected data;

Step three: Build a security situation awareness module to perform situation awareness on the data collected in step two;

When the perception is qualified, the collected data will be converted into perception data;

The situational awareness includes intrusion detection or/and vulnerability awareness or/and file integrity detection or/and log monitoring operations;

Step 4: Build a real-time management and control module to manage and control the sensing data in step 4 and generate safety instructions;

Step 5: Issue the security instructions in Step 4 to the power terminal equipment to perform safety protection and security reinforcement on the power terminal equipment;

The security protection and security reinforcement include security detection or/and security reinforcement or/and file permission management or/and security upgrade.
A power terminal safety protection method as claimed in claim 1, characterized in that:

The abnormal situations of the power terminal equipment include the following:

(1) A certain power terminal equipment is set to upload equipment information at a certain time on a certain day, and the equipment information is uploaded with a delay. According to the delay evaluation trust value calculation formula, the trust value of the power terminal equipment is calculated. When the trust value is lower than the threshold When, abnormal equipment alarm is issued;

(2) Power terminal equipment performs identity verification in the form of passwords. If the verification fails, the trust value will be deducted. If a certain power terminal equipment fails verification multiple times, the trust value will continue to be deducted. When the trust value of the power terminal equipment is lower than the trust threshold, Alarm for abnormal equipment;

(3) The information interaction time of power terminal equipment is fixed, the interactive information is fixed, and a certain power information interaction time is chaotic, the interactive information is chaotic, and abnormal behavior is obvious. According to the abnormal behavior evaluation trust value calculation formula, the trust value of the power terminal equipment is calculated. When the trust value of the power terminal equipment is lower than the threshold, an abnormal equipment alarm is issued;

Device information includes the power terminal's operating system kernel version, operating system release version, etc., CPU name, CPU architecture, CPU core number, memory size, storage size, network card information name, network card information address, network card information status, network card information type, network card The amount of information flow.
A power terminal safety protection method as claimed in claim 1, characterized in that:

In the third step, intrusion detection is divided into anomaly detection and misuse detection;

The anomaly detection includes the following:

Establish a module for normal system access behavior. Any visitor's behavior that does not comply with this module will be judged as an intrusion;

The misuse detection includes the following:

Summarize a number of unfavorable and unacceptable behaviors to establish a module. Any visitor's behavior that conforms to this module will be judged as an intrusion;

The calculation formula of intrusion detection is:

Value(I 1 ,I 2 )＝[L(I 1 ,I 2 )] α [C(I 1 ,I 2 )] β [S(I 1 ,I 2 )] γ

Among them, Value(I 1 ,I 2 ) is used to express the intrusion detection results;

I 1 and I 2 correspond to normal access and undetected access;

L(I 1 ,I 2 ) is the access speed difference;

C(I 1 ,I 2 ) is the access address difference;

S(I 1 ,I 2 ) is the access device difference;

α is the constraint coefficient used to adjust the weight of the access speed difference;

β is the constraint coefficient used to adjust the weight of access address differences;

γ is the constraint coefficient used to adjust the difference weight of access devices;

a is the constraint coefficient of the access speed attribute difference;

b is the constraint coefficient of the access address attribute difference;

c is the constraint coefficient for accessing device attribute differences;

u 1 and u 2 are the average speeds corresponding to normal access and undetected access respectively;

σ 1 and σ 2 are the address values corresponding to normal access and access to be detected respectively;

σ 12 is the fixed information value of the access device.
A power terminal safety protection method as claimed in claim 3, characterized in that:

The vulnerability perception is to detect the connection status of relevant network nodes, and its calculation formula is:

Among them, s ij is the vulnerability value, n i is the connection value of the network node to be detected, n j is the connection value of adjacent network nodes, and λ is a variable parameter. The corresponding values are selected according to different terminal types to obtain the most suitable network node. Connect the value.
A power terminal safety protection method as claimed in claim 4, characterized in that:

The file integrity detection includes the following:

Continuously monitor files, folders, and directories specified in its supervision configuration file to capture changes that have occurred;

Monitor entire directory structures or individual files and folders for events;

The events include creating, deleting, or renaming files, folders, and directories; accessing files and folders; changing file and folder attributes; changing security settings for files, folders, or directories;

The calculation formula for file integrity detection is:

Among them, testing is the integrity detection value. When the current file is the same as the original file, it is a true value, otherwise it is a false value;

ture is the truth value judgment function;

false is the false value judgment function;

newfile is the current file;

oldfile is the original file;

The log monitoring is real-time monitoring and analysis of important log files in the system to detect the attack methods of intruders on the system; attack methods include brute force attacks, privilege escalation, and scanning.
A power terminal safety protection method as claimed in claim 1, characterized in that:

In the fifth step, security detection is based on the sensing data statistically analyzed by the security situation awareness module to achieve real-time monitoring of abnormal behavior of power terminals;

The security hardening includes password hardening and kernel virtual patching;

The file permission management includes the following:

Continuously monitor file permissions and detect abnormal permission changes. That is, through changes in the integrity, structure, and permissions of terminal files, risk situations will be discovered in advance and dealt with early;

The security upgrades include the following:

Remote upgrade and local upgrade, remote upgrade provides rapid upgrade services through the security monitoring center, and supports remote deployment of new equipment online; local upgrade performs local upgrade through power terminals.
A power terminal security protection method according to any one of claims 1 to 6, characterized in that it also includes a data storage module and a data visualization module;

The data storage module constructs a database for storing sensing data and control data;

The data visualization module obtains data from the data storage module and can display the terminal type, danger level, network type, and security vulnerability of the power terminal equipment.
A power terminal safety protection method, characterized by:

Includes the following steps:

Step 1: Build a zero-trust module to collect equipment information of power terminal equipment, and conduct trust value scoring based on the collected equipment information to give a trust value;

When the trust value reaches the standard, the power terminal equipment is trusted and the power terminal equipment is identified as a trusted device;

When the trust value does not meet the standard, the power terminal equipment will be identified as an abnormal equipment and an abnormal equipment alarm will be issued;

The process of collecting device information by the zero trust module is: reading device data, reading rule files, parsing the rule library, and collecting device information;

At the same time, the zero-trust module performs continuous dynamic device authentication on power terminal equipment to block false device information;

Trust value is an indicator of identity verification, and is obtained by a comprehensive score based on the basic attributes of the device and access delay;

Maintenance of trust values includes the following:

(1) The maximum trust value is M and the minimum is N; M>N

(2) The trust value threshold is H. If it is higher than or equal to H, it is a legitimate user, and if it is lower than H, it is an illegal user;

(3) Each time the verification is successful, the trust value increases by T;

(4) The trust value is reduced by T for each verification failure;

The trust value includes direct trust value, delay assessment trust value, and abnormal behavior assessment trust value. The calculation formula is as follows:

T＝T d +T t +T a

T is the trust value, T d is the direct trust value, T t is the delay evaluation trust value, and T a is the abnormal behavior evaluation trust value;

The direct trust value is an S-shaped function, and its calculation formula is:

Among them, T d is the direct trust value, and f is the direct trust value constraint coefficient of different devices;

The delay assessment trust value and the abnormal behavior assessment trust value constitute the indirect trust value;

The delay evaluation trust value is evaluated based on the device response time, and its calculation formula is:

Among them, T t is the delay evaluation trust value, τ is the maximum allowable delay of device response, and D is the information transmission delay;

Abnormal behavior evaluation trust value is evaluated based on the proportion of abnormal device behavior and normal behavior. The calculation formula is:

Among them, T a is the abnormal behavior evaluation trust value, A u is the amount of abnormal behavior, and A n is the amount of normal behavior.

Step two: collect data from the trusted equipment in step one to obtain the collected data;

Step three: Build a security situation awareness module to perform intrusion detection, vulnerability awareness, file integrity detection and log monitoring operations on the collected data in step two, and convert the collected data into sensing data;

Step 4: Build a real-time management and control module to detect, manage and control the sensing data in step 3, and generate safety instructions;

Step 5: Issue the security instructions in Step 4 to the power terminal equipment to perform security protection and security reinforcement on the power terminal equipment to achieve security detection, security reinforcement, file permission management, and security upgrade of the power terminal equipment.

Security detection is based on the sensory data statistically analyzed by the security situation awareness module to realize real-time monitoring of abnormal behavior of power terminals;

The security hardening includes password hardening and kernel virtual patching;

The file permission management includes the following:

Continuously monitor file permissions and detect abnormal permission changes. That is, through changes in the integrity, structure, and permissions of terminal files, risk situations will be discovered in advance and dealt with early;

The security upgrades include the following:

Remote upgrade and local upgrade, remote upgrade provides rapid upgrade services through the security monitoring center, and supports remote deployment of new equipment online; local upgrade performs local upgrade through power terminals.
A power terminal safety protection system, characterized by:

Apply a power terminal security protection method as described in any one of claims 1-8, which includes a zero-trust terminal, a network probe, an edge IoT agent, and a data platform;

The zero-trust terminal collects the equipment information of the power terminal, obtains the equipment data stream, and performs trust value scoring based on the equipment information to give a trust value;

The network probe collects security information of power terminal equipment and obtains security data streams;

The edge IoT agent reads and parses the device data stream and security data stream to obtain parsed data, and uploads the parsed data to the data platform;

The data platform processes the parsed data and generates safety instructions;

Security instructions are issued to the power terminal equipment through the edge IoT agent to perform security protection and security reinforcement on the power terminal equipment.