Method and device for data access control in energy safety operation system

Abstract

The invention discloses a method and a device for data access control in an energy safety operation system, which are beneficial to timely discovery and prevention of unauthorized data access by analyzing a historical data access data set so as to enhance the access safety, subdivide data access attributes into three dimensions of a main body, an environment and resources, and improve the data access efficiency. A corresponding attribute data matrix is constructed, so that an access control strategy can be more accurately formulated according to specific conditions, the fine-grained control is beneficial to reducing unnecessary permission granting, a graph clustering algorithm is utilized to perform clustering analysis on the attribute data matrix to form a data cluster, and the access control strategy can be more accurately formulated according to the specific conditions. Strategy making based on the data cluster makes strategy adjustment more flexible and can quickly adapt to changes of a system environment, the technical scheme is a continuous iteration process, and along with continuous accumulation and deep analysis of historical data access data sets, a data access strategy can be continuously optimized and adjusted so as to adapt to new security threats and access requirements.

Description

Technical Field

[0001] The present invention relates to the technical field of data access control, and in particular to a method and device for data access control in an energy security operation system. Background Art

[0002] With the rapid development of the energy industry and the acceleration of digital transformation, the importance of energy safety operation systems, as core systems to ensure the safe and stable operation of energy production, transmission, distribution and consumption, has become increasingly prominent. These systems usually contain a large amount of sensitive data and key business logic, involving multiple aspects such as monitoring, control, and scheduling of energy facilities.

[0003] However, with the expansion of system scale and the increase of complexity, data access control has become an urgent problem to be solved. Traditional access control methods, such as role-based access control (RBAC), can manage user access rights to a certain extent, but they are often difficult to cope with complex and changeable access scenarios and dynamically changing security needs. Especially in energy security operation systems, different users (such as operation and maintenance personnel, managers, third-party service providers, etc.) have different access requirements for data at different times and in different environments, and the data itself also has different sensitivities and importance.

[0004] Therefore, a more flexible and intelligent data access control method is needed to achieve refined management and security protection of data in energy security operation systems. Summary of the invention

[0005] In view of this, the present invention proposes a method and device for data access control in an energy security operation system, which can solve the defects of the prior art that it is difficult to cope with complex and changeable access scenarios and dynamically changing security requirements.

[0006] The technical solution of the present invention is achieved in this way:

[0007] A method for data access control in an energy security operation system, specifically comprising:

[0008] Obtain historical data access datasets for energy security operation systems;

[0009] Access the data set based on historical data to generate the subject attribute data matrix, environmental attribute data matrix and resource attribute data matrix;

[0010] According to the graph clustering algorithm, the subject attribute data matrix, the environment attribute data matrix and the resource attribute data matrix are converted into subject attribute data clusters, environment attribute data clusters and resource attribute data clusters;

[0011] The data access strategy is defined based on the subject attribute data cluster, the environment attribute data cluster and the resource attribute data cluster.

[0012] As a further optional solution of the method for data access control in the energy security operation system, the generation of subject attribute data matrix, environmental attribute data matrix and resource attribute data matrix based on the historical data access data set specifically includes:

[0013] Analyze the user's historical access patterns based on the historical data access data set, divide the users into different behavior groups, and obtain the initial subject attribute data matrix;

[0014] Use time series analysis to analyze the external environmental conditions when the historical data is accessed and obtain the initial environmental attribute data matrix;

[0015] Use statistical analysis tools to analyze the utilization and access methods of different resources in the historical data access data set to obtain the initial resource attribute data matrix;

[0016] Calculate the hash values ​​of the initial subject attribute data matrix, the initial environment attribute data matrix, and the initial resource attribute data matrix, and use the hash values ​​as labels of the initial subject attribute data matrix, the initial environment attribute data matrix, and the initial resource attribute data matrix to obtain the final subject attribute data matrix, the environment attribute data matrix, and the resource attribute data matrix.

[0017] As a further optional solution of the method for data access control in the energy security operation system, the hash values ​​of the initial subject attribute data matrix, the initial environment attribute data matrix and the initial resource attribute data matrix are calculated using the following formula:

[0018]

[0019] Wherein, n is the number of fields in the input data x, wherein the initial subject attribute data matrix, the initial environment attribute data matrix and the initial resource attribute data matrix are all input data x;

[0020] x i is the i-th field of the input data x;

[0021] w i is the weight associated with the ith field;

[0022] h i is the local hash function applied to the ith field;

[0023] M is the size of the hash space, which is used to ensure that the hash values ​​are evenly distributed in the range of 0 to M-1.

[0024] As a further optional solution of the method for data access control in the energy security operation system, the subject attribute data matrix, the environment attribute data matrix and the resource attribute data matrix are converted into subject attribute data clusters, environment attribute data clusters and resource attribute data clusters according to the graph clustering algorithm, specifically including:

[0025] Standardize the subject attribute data matrix, environmental attribute data matrix and resource attribute data matrix;

[0026] Extracting each row or column from the standardized subject attribute data matrix, the environment attribute data matrix and the resource attribute data matrix as a subject node, an environment node and a resource node, respectively, to obtain a plurality of subject nodes, environment nodes and resource nodes;

[0027] Calculate the similarities between the subject nodes, the environment nodes and the resource nodes respectively, and determine the edges between the subject nodes, the environment nodes and the resource nodes according to the similarities;

[0028] Based on the edges between the main nodes, the edges between the environment nodes and the edges between the resource nodes, a graph structure of the main nodes, a graph structure of the environment nodes and a graph structure of the resource nodes are constructed;

[0029] According to the graph structure of the subject node, the graph structure of the environment node and the graph structure of the resource node, the similarity matrix and the degree matrix of the subject node, the environment node and the resource node are calculated respectively;

[0030] According to the similarity matrix and degree matrix of the subject node, the environment node and the resource node, the Laplacian matrix of the subject node, the environment node and the resource node is calculated respectively;

[0031] Clustering is performed according to the Laplace matrices of the main nodes, environment nodes and resource nodes to obtain clustering results of the main nodes, environment nodes and resource nodes;

[0032] Based on the clustering results, subject attribute data clusters, environmental attribute data clusters and resource attribute data clusters are generated.

[0033] As a further optional solution of the method for data access control in the energy security operation system, the similarity matrix of the computing subject node, the environment node and the resource node adopts the following formula:

[0034]

[0035] Among them, S ij Any two child nodes v in the main node, environment node and resource node i and v j The similarity between

[0036] N(vi ) is the child node v i The set of directly connected nodes, N(v j ) is the child node v j The set of directly connected nodes;

[0037] N(v i )∩N(v j )|is v i and v j The number of common neighbors.

[0038] As a further optional solution of the method for data access control in the energy security operation system, clustering is performed according to the Laplace matrix of the main node, the environment node and the resource node to obtain the clustering results of the main node, the environment node and the resource node, specifically including:

[0039] Perform eigenvalue decomposition on the Laplace matrices of the main node, the environment node and the resource node to obtain the eigenvalues ​​and eigenvectors of the main node, the environment node and the resource node;

[0040] Select the eigenvectors corresponding to the first k eigenvalues, where k is the number of target clusters;

[0041] The selected eigenvectors are used as new coordinate axes to form a new feature space;

[0042] The K-means clustering algorithm is used to cluster the data in the new feature space to obtain the clustering results of the main nodes, environment nodes and resource nodes.

[0043] As a further optional solution of the method for data access control in the energy security operation system, generating subject attribute data clusters, environmental attribute data clusters and resource attribute data clusters according to clustering results specifically includes:

[0044] According to the clustering results, a cluster label is assigned to each attribute data, and these cluster labels indicate the cluster to which the attribute data belongs;

[0045] The attribute data are grouped according to the cluster labels to form subject attribute data clusters, environment attribute data clusters and resource attribute data clusters.

[0046] A device for data access control in an energy security operation system, comprising:

[0047] An acquisition module, used to obtain historical data access data sets of energy security operation systems;

[0048] A generation module is used to access the data set based on historical data and generate a subject attribute data matrix, an environmental attribute data matrix and a resource attribute data matrix;

[0049] A conversion module, used for converting the subject attribute data matrix, the environment attribute data matrix and the resource attribute data matrix into subject attribute data clusters, environment attribute data clusters and resource attribute data clusters according to a graph clustering algorithm;

[0050] The definition module is used to define data access strategies based on the subject attribute data cluster, the environment attribute data cluster and the resource attribute data cluster.

[0051] A computing device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method for data access control in the energy security operation system when executing the computer program.

[0052] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for data access control in the above energy security operation system.

[0053] The beneficial effects of the present invention are as follows: by analyzing historical data access data sets, common access patterns, abnormal access behaviors, and potential security risks can be identified, which helps to timely discover and prevent unauthorized data access, thereby enhancing access security, and subdividing data access attributes into three dimensions: subject, environment, and resource, and constructing a corresponding attribute data matrix, so that access control policies can be more accurately formulated for specific situations. This fine-grained control helps to reduce unnecessary permission grants and further improve access security. Using a graph clustering algorithm to perform cluster analysis on the attribute data matrix, access behaviors or attributes with similar characteristics can be classified into one category to form data clusters. These data clusters not only reflect It not only understands the rules and patterns of data access, but also provides a scientific basis for formulating data access strategies. At the same time, strategy formulation based on data clusters makes strategy adjustment more flexible and can quickly adapt to changes in the system environment. Through automated data processing and cluster analysis processes, it can more quickly identify key information in data access requests and make access control decisions based on this information, which helps to reduce manual intervention and decision-making time and improve response speed. This technical solution is a continuous iterative process. With the continuous accumulation of historical data access data sets and in-depth analysis, data access strategies can be continuously optimized and adjusted to adapt to new security threats and access requirements. This continuous optimization capability can maintain long-term security and stability. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0055] Figure 1 A schematic flow chart of a method for data access control in an energy security operation system according to the present invention;

[0056] Figure 2 This is a schematic diagram of the composition of a device for data access control in an energy security operation system of the present invention. DETAILED DESCRIPTION

[0057] The technical solutions in the embodiments of the present invention are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] refer to Figure 1 to Figure 2 , a method for data access control in an energy security operation system, specifically comprising:

[0059] Obtain historical data access datasets for energy security operation systems;

[0060] Access the data set based on historical data to generate the subject attribute data matrix, environmental attribute data matrix and resource attribute data matrix;

[0061] According to the graph clustering algorithm, the subject attribute data matrix, the environment attribute data matrix and the resource attribute data matrix are converted into subject attribute data clusters, environment attribute data clusters and resource attribute data clusters;

[0062] The data access strategy is defined based on the subject attribute data cluster, the environment attribute data cluster and the resource attribute data cluster.

[0063] In this embodiment, by analyzing the historical data access data set, common access patterns, abnormal access behaviors and potential security risks can be identified, which helps to timely discover and prevent unauthorized data access, thereby enhancing the security of access. The data access attributes are subdivided into three dimensions: subject, environment and resource, and a corresponding attribute data matrix is ​​constructed, so that the access control strategy can be more accurately formulated for specific situations. This fine-grained control helps to reduce unnecessary permission grants and further improve the security of access. The attribute data matrix is ​​clustered using a graph clustering algorithm, and access behaviors or attributes with similar characteristics can be classified into one category to form data clusters. These data clusters not only reflect The rules and patterns of data access also provide a scientific basis for formulating data access strategies. At the same time, strategy formulation based on data clusters makes policy adjustments more flexible and can quickly adapt to changes in the system environment. Through automated data processing and cluster analysis processes, key information in data access requests can be identified more quickly and access control decisions can be made accordingly. This helps to reduce manual intervention and decision-making time and improve response speed. This technical solution is a continuous iterative process. With the continuous accumulation of historical data access data sets and in-depth analysis, data access strategies can be continuously optimized and adjusted to adapt to new security threats and access requirements. This continuous optimization capability can maintain long-term security and stability.

[0064] Preferably, the step of accessing the data set based on historical data to generate a subject attribute data matrix, an environmental attribute data matrix and a resource attribute data matrix specifically includes:

[0065] Analyze the user's historical access patterns based on the historical data access data set, divide the users into different behavior groups, and obtain the initial subject attribute data matrix;

[0066] Use time series analysis to analyze the external environmental conditions when the historical data is accessed and obtain the initial environmental attribute data matrix;

[0067] Use statistical analysis tools to analyze the utilization and access methods of different resources in the historical data access data set to obtain the initial resource attribute data matrix;

[0068] Calculate the hash values ​​of the initial subject attribute data matrix, the initial environment attribute data matrix, and the initial resource attribute data matrix, and use the hash values ​​as labels of the initial subject attribute data matrix, the initial environment attribute data matrix, and the initial resource attribute data matrix to obtain the final subject attribute data matrix, the environment attribute data matrix, and the resource attribute data matrix.

[0069] Preferably, the hash values ​​of the initial subject attribute data matrix, the initial environment attribute data matrix and the initial resource attribute data matrix are calculated using the following formula:

[0070]

[0071] Wherein, n is the number of fields in the input data x, wherein the initial subject attribute data matrix, the initial environment attribute data matrix and the initial resource attribute data matrix are all input data x;

[0072] x i is the i-th field of the input data x;

[0073] w i is the weight associated with the ith field;

[0074] h i is the local hash function applied to the ith field;

[0075] M is the size of the hash space, which is used to ensure that the hash values ​​are evenly distributed in the range of 0 to M-1.

[0076] In this embodiment, users are divided into different behavior groups, and an initial subject attribute data matrix is ​​constructed, so that the behavior characteristics and access patterns of users can be understood more clearly. This classification is helpful for subsequent data analysis and strategy formulation; external environmental conditions are analyzed through time series, and an initial environmental attribute data matrix is ​​constructed, so that the impact of environmental factors such as different times and places on access behavior can be considered, which improves the comprehensiveness and accuracy of the analysis; statistical analysis tools are used to analyze resource utilization and access methods, and an initial resource attribute data matrix is ​​constructed, which helps to understand the popularity of resources, access frequency, and potential access pressure points, and provides strong support for resource management; hash values ​​are calculated and attached as labels for the matrix, which not only adds labels to the data matrix It provides a unique identifier and enhances data security. The hash value is unidirectional and irreversible. Even if the content of the data matrix is ​​tampered with, its hash value will change, helping to quickly identify and respond to potential security threats. As the label of the data matrix, the hash value can play an important role in subsequent data retrieval, matching and comparison. Since the hash value is calculated quickly and occupies little space, it can significantly improve the efficiency of data processing, especially in large-scale data sets. The refined and labeled data matrix provides a basis for formulating more flexible access control strategies. More targeted access rights and rules can be designed according to the characteristics of different user groups, environmental conditions and resource attributes to meet security needs in different scenarios.

[0077] It should be noted that the specific structure of the subject attribute data matrix includes rows and columns. The rows represent different subjects (such as users, user groups, devices, etc.), and the columns represent various attributes of the subjects. These attributes may include but are not limited to subject ID (an identifier that uniquely identifies the subject), role (the role of the subject in the system, such as administrator, ordinary user, visitor, etc.), permission level (the level of access rights of the subject to resources), and behavior pattern (the subject behavior characteristics summarized based on historical access data, such as access frequency, access time distribution, etc.); the specific structure of the environment attribute data matrix includes rows and columns. The rows represent different environments (such as network environment, physical location, time period, etc.), and the columns represent various attributes of the environment. These attributes may include but are not limited to environment ID (an identifier that uniquely identifies the environment), network type (such as intranet, extranet, etc.), and network type (such as TCP, HTTPS, etc.). , VPN, etc.), physical location (such as office, data center, remote location, etc.), time period (such as working day, non-working day, specific time period, such as peak time, etc.), security level (security level assessed based on environmental characteristics); the specific structure of the resource attribute data matrix includes rows and columns, rows represent different resources (such as files, databases, API interfaces, etc.), columns represent various attributes of resources, these attributes may include but are not limited to resource ID (an identifier that uniquely identifies a resource), resource type (such as document, database table, service interface, etc.), sensitivity level (sensitivity level assessed based on resource content or usage), access frequency (the number of times or frequency of access to the resource in historical access records), access mode (resource access characteristics summarized based on historical access data, such as access time distribution, access subject type, etc.). In addition, the mod in modM stands for modular operation, also known as remainder operation. Modular operation is the process of finding the remainder of two numbers divided by each other. In the context of hash functions, modular operation is often used to limit hash values ​​to a fixed range, which is defined by the modulus M. M is usually a large prime number to ensure that hash values ​​are distributed as evenly as possible in the range of 0 to M-1, thereby reducing the possibility of hash conflicts.

[0078] Preferably, the subject attribute data matrix, the environment attribute data matrix and the resource attribute data matrix are converted into subject attribute data clusters, environment attribute data clusters and resource attribute data clusters according to the graph clustering algorithm, specifically including:

[0079] Standardize the subject attribute data matrix, environmental attribute data matrix and resource attribute data matrix;

[0080] Extracting each row or column from the standardized subject attribute data matrix, the environment attribute data matrix and the resource attribute data matrix as a subject node, an environment node and a resource node, respectively, to obtain a plurality of subject nodes, environment nodes and resource nodes;

[0081] Calculate the similarities between the subject nodes, the environment nodes and the resource nodes respectively, and determine the edges between the subject nodes, the environment nodes and the resource nodes according to the similarities;

[0082] Based on the edges between the main nodes, the edges between the environment nodes and the edges between the resource nodes, a graph structure of the main nodes, a graph structure of the environment nodes and a graph structure of the resource nodes are constructed;

[0083] According to the graph structure of the subject node, the graph structure of the environment node and the graph structure of the resource node, the similarity matrix and the degree matrix of the subject node, the environment node and the resource node are calculated respectively;

[0084] According to the similarity matrix and degree matrix of the subject node, the environment node and the resource node, the Laplacian matrix of the subject node, the environment node and the resource node is calculated respectively;

[0085] Clustering is performed according to the Laplace matrices of the main nodes, environment nodes and resource nodes to obtain clustering results of the main nodes, environment nodes and resource nodes;

[0086] Based on the clustering results, subject attribute data clusters, environmental attribute data clusters and resource attribute data clusters are generated.

[0087] In this embodiment, the data matrix is ​​standardized to eliminate the influence of the dimension and magnitude differences between different attributes, making subsequent calculations more accurate and reliable; by calculating the similarity between nodes and constructing a graph structure, the internal connections and differences between the data can be more comprehensively reflected, providing richer information for clustering analysis; using mathematical tools such as similarity matrix, degree matrix and Laplace matrix for clustering can more accurately identify the group structure and pattern in the data, improving the accuracy and effectiveness of clustering; converting the rows or columns in the data matrix into nodes in the graph structure makes the clustering results more intuitive and easy to understand. By observing the node distribution and connection relationship in the graph structure, the boundaries and characteristics between different groups can be clearly seen. The clustering results are presented in the form of data clusters, each of which contains data points with similar attributes, which is convenient for subsequent clustering. It provides a clear basis and direction for subsequent data analysis and strategy formulation; by clustering the subject, environment and resource attribute data separately, it is possible to more finely identify the characteristics and behavior patterns of different user groups, environmental conditions and resource types, which helps to formulate more targeted access control strategies to meet security needs in different scenarios. The generation of data clusters enables the system to dynamically adjust access rights and rules to adapt to new security threats and access patterns. This flexibility helps to maintain the long-term effectiveness and adaptability of the system; graph clustering algorithms can efficiently process large-scale data sets by constructing graph structures and using mathematical tools for calculations, which helps to shorten the time of data processing and analysis and improve response speed and performance. The generation of clustering results can more quickly identify key data points and group structures, providing strong support for subsequent data mining and decision support.

[0088] It should be noted that when calculating the degree matrix of nodes in the graph structure, we mainly focus on the degree of each node (that is, the number of edges directly connected to the node). For an undirected graph, the degree of a node is the number of its neighbors. For the main node, environment node, and resource node, we can build graphs for them respectively and calculate the degree matrix of the nodes in each graph. The degree matrix is ​​a diagonal matrix, and the elements on the diagonal represent the degree of the corresponding node, and the elements on the non-diagonal are all 0.

[0089] Preferably, the similarity matrix of the computing subject node, environment node and resource node adopts the following formula:

[0090]

[0091] Among them, S ij Any two child nodes v in the main node, environment node and resource node i and v j The similarity between

[0092] N(v i) is the child node v i The set of directly connected nodes, N(v j ) is the child node v j The set of directly connected nodes;

[0093] N(v i )∩N(v j )|is v i and v j The number of common neighbors.

[0094] Preferably, clustering is performed according to the Laplace matrix of the main node, the environment node and the resource node to obtain the clustering results of the main node, the environment node and the resource node, specifically including:

[0095] Perform eigenvalue decomposition on the Laplace matrices of the main node, the environment node and the resource node to obtain the eigenvalues ​​and eigenvectors of the main node, the environment node and the resource node;

[0096] Select the eigenvectors corresponding to the first k eigenvalues, where k is the number of target clusters;

[0097] The selected eigenvectors are used as new coordinate axes to form a new feature space;

[0098] The K-means clustering algorithm is used to cluster the data in the new feature space to obtain the clustering results of the main nodes, environment nodes and resource nodes.

[0099] In this embodiment, by performing eigenvalue decomposition on the Laplace matrix, eigenvalues ​​and eigenvectors reflecting the similarity between nodes and graph structure information can be obtained. The eigenvectors corresponding to the first k eigenvalues ​​are selected as new coordinate axes, which can retain the most important information in the graph, while reducing the dimension of the data and reducing the impact of noise and redundant information on the clustering results, thereby improving the accuracy and robustness of clustering; the K-means clustering algorithm is used for clustering in the new feature space. Since the data dimension has been reduced and key information has been retained, the clustering process will be more efficient; the k value in this technical solution represents the number of target clustering clusters and is an adjustable parameter. By adjusting the k value, the granularity of the clustering results can be flexibly controlled, which enables the technical solution to adapt to different application scenarios and requirements and has higher flexibility and practicality; the clustering results are presented in the form of data clusters, each of which contains nodes with similar attributes, which provides a clear basis and direction for subsequent data analysis and application.

[0100] It should be noted that It is a normalization factor used to prevent high-degree nodes (i.e. nodes with many neighbors) from taking too large a weight in the similarity calculation.

[0101] Preferably, generating the subject attribute data cluster, the environment attribute data cluster and the resource attribute data cluster according to the clustering result specifically includes:

[0102] According to the clustering results, a cluster label is assigned to each attribute data, and these cluster labels indicate the cluster to which the attribute data belongs;

[0103] The attribute data are grouped according to the cluster labels to form subject attribute data clusters, environment attribute data clusters and resource attribute data clusters.

[0104] In this embodiment, by assigning attribute data to different clusters, the data is clearly organized and classified, and each data cluster represents a group of data points with similar characteristics, which makes subsequent processing and analysis of the data easier and more intuitive; since the data has been grouped into different clusters, data analysts can perform independent analysis and mining on each cluster without processing the entire data set, which can not only reduce the amount of calculation and improve analysis efficiency, but also more deeply mine the characteristics and laws within each cluster; data clusters based on clustering results provide a finer granularity for decision making. For example, in resource allocation, environmental management or user behavior analysis, more targeted strategies and measures can be formulated according to the characteristics of different data clusters. This refined decision making helps to improve resource utilization efficiency, improve environmental management effects or enhance user experience; the generation of data clusters makes data visualization easier and more effective. By displaying the distribution and characteristics of different data clusters through visualization tools, the overall structure and trend of the data can be intuitively understood, thereby helping people better understand the data and make decisions.

[0105] A device for data access control in an energy security operation system, comprising:

[0106] An acquisition module, used to obtain historical data access data sets of energy security operation systems;

[0107] A generation module is used to access the data set based on historical data and generate a subject attribute data matrix, an environmental attribute data matrix and a resource attribute data matrix;

[0108] A conversion module, used for converting the subject attribute data matrix, the environment attribute data matrix and the resource attribute data matrix into subject attribute data clusters, environment attribute data clusters and resource attribute data clusters according to a graph clustering algorithm;

[0109] The definition module is used to define data access strategies based on the subject attribute data cluster, the environment attribute data cluster and the resource attribute data cluster.

[0110] A computing device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method for data access control in the energy security operation system when executing the computer program.

[0111] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for data access control in the above energy security operation system.

[0112] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for data access control in an energy security operation system, characterized in that: Specifically include: Obtain historical data access datasets for energy security operation systems; Access the data set based on historical data to generate the subject attribute data matrix, environmental attribute data matrix and resource attribute data matrix; According to the graph clustering algorithm, the subject attribute data matrix, the environment attribute data matrix and the resource attribute data matrix are converted into subject attribute data clusters, environment attribute data clusters and resource attribute data clusters; The data access strategy is defined based on the subject attribute data cluster, the environment attribute data cluster and the resource attribute data cluster.

2. The method for data access control in an energy security operation system according to claim 1, characterized in that: The step of accessing the data set based on historical data to generate a subject attribute data matrix, an environmental attribute data matrix and a resource attribute data matrix specifically includes: Analyze the user's historical access patterns based on the historical data access data set, divide the users into different behavior groups, and obtain the initial subject attribute data matrix; Use time series analysis to analyze the external environmental conditions when the historical data is accessed and obtain the initial environmental attribute data matrix; Use statistical analysis tools to analyze the utilization and access methods of different resources in the historical data access data set to obtain the initial resource attribute data matrix; Calculate the hash values ​​of the initial subject attribute data matrix, the initial environment attribute data matrix, and the initial resource attribute data matrix, and use the hash values ​​as labels of the initial subject attribute data matrix, the initial environment attribute data matrix, and the initial resource attribute data matrix to obtain the final subject attribute data matrix, the environment attribute data matrix, and the resource attribute data matrix.

3. The method for data access control in an energy security operation system according to claim 2, characterized in that: The formula for calculating the hash values ​​of the initial subject attribute data matrix, the initial environment attribute data matrix and the initial resource attribute data matrix is ​​as follows: Wherein, n is the number of fields in the input data x, wherein the initial subject attribute data matrix, the initial environment attribute data matrix and the initial resource attribute data matrix are all input data x; x i is the i-th field of the input data x; w i is the weight associated with the ith field; h i is the local hash function applied to the ith field; M is the size of the hash space, which is used to ensure that the hash values ​​are evenly distributed in the range of 0 to M-1.

4. The method for data access control in an energy security operation system according to claim 3, characterized in that: The graph clustering algorithm is used to convert the subject attribute data matrix, the environment attribute data matrix and the resource attribute data matrix into a subject attribute data cluster, an environment attribute data cluster and a resource attribute data cluster, specifically including: Standardize the subject attribute data matrix, environmental attribute data matrix and resource attribute data matrix; Extracting each row or column from the standardized subject attribute data matrix, the environment attribute data matrix and the resource attribute data matrix as a subject node, an environment node and a resource node, respectively, to obtain a plurality of subject nodes, environment nodes and resource nodes; Calculate the similarities between the subject nodes, the environment nodes and the resource nodes respectively, and determine the edges between the subject nodes, the environment nodes and the resource nodes according to the similarities; Based on the edges between the main nodes, the edges between the environment nodes and the edges between the resource nodes, a graph structure of the main nodes, a graph structure of the environment nodes and a graph structure of the resource nodes are constructed; According to the graph structure of the subject node, the graph structure of the environment node and the graph structure of the resource node, the similarity matrix and the degree matrix of the subject node, the environment node and the resource node are calculated respectively; According to the similarity matrix and degree matrix of the subject node, the environment node and the resource node, the Laplacian matrix of the subject node, the environment node and the resource node is calculated respectively; Clustering is performed according to the Laplace matrices of the main nodes, environment nodes and resource nodes to obtain clustering results of the main nodes, environment nodes and resource nodes; Based on the clustering results, subject attribute data clusters, environmental attribute data clusters and resource attribute data clusters are generated.

5. The method for data access control in an energy security operation system according to claim 4, characterized in that: The similarity matrix of the computing subject node, environment node and resource node adopts the following formula: Among them, S ij Any two child nodes v in the main node, environment node and resource node i and v j The similarity between N(v i ) is the child node v i The set of directly connected nodes, N(v j ) is the child node v j The set of directly connected nodes; N(v i )∩N(v j )|is v i and v j The number of common neighbors.

6. The method for data access control in an energy security operation system according to claim 5, characterized in that: The clustering is performed according to the Laplace matrix of the main node, the environment node and the resource node to obtain the clustering results of the main node, the environment node and the resource node, which specifically includes: Perform eigenvalue decomposition on the Laplace matrices of the main node, the environment node and the resource node to obtain the eigenvalues ​​and eigenvectors of the main node, the environment node and the resource node; Select the eigenvectors corresponding to the first k eigenvalues, where k is the number of target clusters; The selected eigenvectors are used as new coordinate axes to form a new feature space; The K-means clustering algorithm is used to cluster the data in the new feature space to obtain the clustering results of the main nodes, environment nodes and resource nodes.

7. The method for data access control in an energy security operation system according to claim 6, characterized in that: The generating of subject attribute data clusters, environment attribute data clusters and resource attribute data clusters according to the clustering results specifically includes: According to the clustering results, a cluster label is assigned to each attribute data, and these cluster labels indicate the cluster to which the attribute data belongs; The attribute data are grouped according to the cluster labels to form subject attribute data clusters, environment attribute data clusters and resource attribute data clusters.

8. A device for data access control in an energy security operation system, characterized in that: include: An acquisition module, used to obtain historical data access data sets of energy security operation systems; A generation module is used to access the data set based on historical data and generate a subject attribute data matrix, an environmental attribute data matrix and a resource attribute data matrix; A conversion module, used for converting the subject attribute data matrix, the environment attribute data matrix and the resource attribute data matrix into subject attribute data clusters, environment attribute data clusters and resource attribute data clusters according to a graph clustering algorithm; The definition module is used to define data access strategies based on the subject attribute data cluster, the environment attribute data cluster and the resource attribute data cluster.

9. A computing device, characterized in that The method comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the method for data access control in the energy security operation system described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the steps of the method for data access control in an energy security operation system according to any one of claims 1 to 7.

Images