Power grid data epitaxial access control method and system

Abstract

The invention discloses a power grid data epitaxial access control method and system, and relates to the technical field of cross-region and cross-domain sharing of power grid data. According to the main technical scheme, a static label is adopted to provide constraint access control for a data calling party, and a dynamic label is adopted to provide propagation access control for a next data calling party, so that when a plurality of iterative data calling parties exist, the data calling parties are subjected to data calling; according to the invention, the static label associated with the target power grid data and the continuously updated dynamic label are utilized to realize propagation monitoring of the target power grid data in cross-geographic areas and / or cross-business fields, so that an effective power grid data epitaxial access control solution is provided.

Description

Technical Field

[0001] The present application relates to the technical field of cross-region and cross-domain sharing of power grid data, and in particular to a method and system for controlling extended access to power grid data. Background Art

[0002] The interaction of power grid data across geographic regions and business domains is a key component of smart grid development, encompassing multiple aspects such as data flow, business collaboration, and resource optimization. Interaction across geographic regions refers to the sharing and collaboration of power grid data between administrative regions (e.g., provinces, cities, and counties) or grid subregions (e.g., East China Power Grid and North China Power Grid). Examples include the interaction of interprovincial transmission line load data and cross-regional renewable energy grid connection data. Interaction across business domains refers to the integration of data from different business segments of the power system, including power generation, transmission, distribution, consumption, dispatching, and marketing. For example, this involves the integration of distribution automation data with power consumption information collection data.

[0003] At present, different from the access control of traditional enterprise internal network boundaries, the focus is on the access management of power grid data by external entities (such as different power grid organizations across geographical regions and business fields). It is necessary to solve the security risks in the "blurred boundaries" scenario. How to control external access is a technical problem that needs to be solved urgently. Summary of the Invention

[0004] The present application provides a method and system for controlling extended access to power grid data. The main purpose is to use static tags to provide constrained access control for data callers, and to use dynamic tags to provide propagation access control for the next data caller. Then, when there are multiple iterative data callers, the static tags associated with the target power grid data and the continuously updated dynamic tags are used to achieve propagation monitoring of the target power grid data across geographical regions and / or business areas, thereby providing an effective solution for extended access control of power grid data.

[0005] In order to achieve the above objectives, this application mainly provides the following technical solutions:

[0006] A first aspect of the present application provides a method for controlling access to extended power grid data, the method comprising:

[0007] Determining target power grid data to be called, wherein the target power grid data is associated with a static tag and a dynamic tag, wherein the static tag is used to provide security rule information for accessing the target power grid data, and the dynamic tag is used to provide propagation rule information corresponding to propagating the target power grid data across geographical regions and / or across business domains;

[0008] Upon receiving a first data call request for the target power grid data from a first data caller, verifying whether the first data caller satisfies the security rule information in the static tag;

[0009] If satisfied, the verification is passed and the first data caller is authorized to obtain the target power grid data;

[0010] When the first data caller obtains the target power grid data, a first contract authorization is established with the first data caller, wherein the dimensions of the propagation constraint conditions provided in the first contract authorization include at least: attribute information of the next data caller, effective duration of data propagation, and effective number of data propagation;

[0011] Filling the first contract authorization into the dynamic tag of the target power grid data to obtain an updated dynamic tag;

[0012] According to the static tag and the updated dynamic tag corresponding to the target power grid data, the target power grid data is monitored to be acquired by the second data caller across geographical regions and / or across business fields.

[0013] A second aspect of the present application provides a power grid data extension access control system, the system comprising:

[0014] a determining unit, configured to determine target power grid data to be called, wherein the target power grid data is associated with a static tag and a dynamic tag, wherein the static tag is used to provide security rule information for accessing the target power grid data, and the dynamic tag is used to provide propagation rule information corresponding to propagating the target power grid data across geographical regions and / or across business domains;

[0015] a verification unit, configured to verify, upon receiving a first data call request from a first data caller for the target power grid data, whether the first data caller satisfies the security rule information in the static tag;

[0016] an authorization unit, configured to, if the conditions are met, authorize the first data caller to obtain the target power grid data if the verification passes;

[0017] an establishing unit, configured to establish a first contract authorization with the first data caller while the first data caller obtains the target power grid data, wherein the dimensions of the propagation constraint conditions provided in the first contract authorization include at least: attribute information of the next data caller, effective duration of data propagation, and effective number of data propagation;

[0018] a filling unit, configured to fill the first contract authorization into the dynamic tag of the target power grid data to obtain an updated dynamic tag;

[0019] A monitoring unit is configured to monitor whether the target power grid data is acquired by a second data caller across geographical regions and / or business domains according to the static tag and the updated dynamic tag corresponding to the target power grid data.

[0020] A third aspect of the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for controlling access to extended power grid data as described above is implemented.

[0021] A fourth aspect of the present application provides an electronic device, the device comprising at least one processor, and at least one memory and a bus connected to the processor;

[0022] The processor and the memory communicate with each other via the bus.

[0023] The processor is used to call the program instructions in the memory to execute the above-mentioned power grid data extension access control method.

[0024] By means of the above technical solution, the technical solution provided by this application has at least the following advantages:

[0025] The present application provides a method and system for controlling extended access to power grid data. In the interaction of power grid data across geographical regions and business fields, the present application associates static tags and dynamic tags with the target power grid data to be called. The static tags are used to provide security rule information for accessing the target power grid data, and the dynamic tags are used to provide propagation rule information corresponding to the propagation of the target power grid data across geographical regions and / or business fields. Then, when a data caller initiates a data call request for the target power grid data, the present application first uses the static tags to verify whether the data caller complies with the security rule information. If so, it authorizes it to obtain the target power grid data, and establishes a contract authorization with the data caller and fills it into the dynamic tag. Since the contract authorization provides the dimension of propagation constraints, although the data caller has obtained the target power grid data, it still needs to determine whether the target power grid data can be shared and passed to the next data caller based on the static tag corresponding to the target power grid data and the updated dynamic tag (filled with the contract authorization).

[0026] Compared with the existing technology's demand for extended access control in the interaction of power grid data across geographical regions and business fields, this application uses static tags to provide constrained access control for data callers, and uses dynamic tags to provide propagation access control for the next data caller. Then, when there are multiple iterative data callers, the static tags associated with the target power grid data and the continuously updated dynamic tags are used to achieve the propagation monitoring of the target power grid data across geographical regions and / or business fields, thereby providing an effective solution for extended access control of power grid data.

[0027] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present application. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0029] Figure 1 A flow chart of a method for controlling extended access to power grid data provided in an embodiment of the present application;

[0030] Figure 2 A flow chart of a method for controlling extended access to power grid data provided in an embodiment of the present application;

[0031] Figure 3 A block diagram of a power grid data extension access control system provided in an embodiment of the present application;

[0032] Figure 4 A block diagram of another power grid data extension access control system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] The following describes exemplary embodiments of the present application in more detail with reference to the accompanying drawings. Although exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0034] The interaction of power grid data across geographic regions and business domains is a key component of smart grid development, encompassing multiple aspects such as data flow, business collaboration, and resource optimization. Interaction across geographic regions refers to the sharing and collaboration of power grid data between administrative regions (e.g., provinces, cities, and counties) or grid subregions (e.g., East China Power Grid and North China Power Grid). Examples include the interaction of interprovincial transmission line load data and cross-regional renewable energy grid connection data. Interaction across business domains refers to the integration of data from different business segments of the power system, including power generation, transmission, distribution, consumption, dispatching, and marketing. For example, this involves the integration of distribution automation data with power consumption information collection data.

[0035] Through such cross-region and cross-domain interactions, the following key values ​​can be achieved, but are not limited to:

[0036] (1) Optimized resource allocation: Through cross-regional data interaction, cross-regional consumption of renewable energy (such as wind power and photovoltaic power) can be achieved, reducing the power curtailment rate. For example, data linkage between the Northwest New Energy Base and the Eastern Load Center can dynamically adjust cross-regional power transmission plans.

[0037] (2) Business collaboration and efficiency improvement: Cross-business data integration can support the integrated dispatching of "source, grid, load and storage". For example, the dispatching department combines the load data on the distribution side with the output data on the generation side to optimize the operation mode of the power grid and reduce the peak-valley difference.

[0038] (3) Intelligent decision support: Integrate multi-dimensional data (such as equipment status, weather data, and user electricity usage behavior) to support scenarios such as grid fault warning and user precision services. For example, by interacting with distribution station area data and user electricity usage data, the power outage repair dispatch path can be optimized.

[0039] However, unlike the access control at the boundaries of traditional enterprise internal networks, the focus is on access management of power grid data by external entities (such as different power grid organizations across geographical regions and business areas). It is necessary to address the security risks in the "blurred boundaries" scenario. How to control external access is a technical problem that needs to be solved urgently.

[0040] Based on the above considerations, the present application embodiment provides a method for controlling access to extended power grid data, such as Figure 1 As shown, the embodiment of the present invention provides the following specific steps:

[0041] 101. Determine the target power grid data to be called. The target power grid data is associated with static tags and dynamic tags. The static tags are used to provide security rule information for accessing the target power grid data, and the dynamic tags are used to provide propagation rule information corresponding to the target power grid data when propagating across geographical regions and / or across business areas.

[0042] In an embodiment of the present application, a label system is established for the origin of data, such as associating static labels and dynamic labels with the target power grid data to be called. Static labels are used to provide security rule information for accessing the target power grid data. The security rule information may include, but is not limited to, key information such as: the sensitivity level of the data (such as public, internal, confidential), usage permissions (such as viewing / editing / transferring only), flow rules (such as prohibiting cross-regional transmission / approval required), and responsible parties (such as data providers / recipients). Thus, constrained access control of the target power grid data is achieved using static labels, that is, precise authorization of permissions before access.

[0043] Dynamic tags are used to provide information about the dissemination rules for target power grid data when it is disseminated across geographic regions and / or business domains. The dimensions of this dissemination rule information include at least the following: the attributes of the next data caller, the effective duration of data dissemination, the number of valid data disseminations, and the data flow path. As the name suggests, dynamic tags, unlike static tags, are allowed to be dynamically populated during the dissemination of target power grid data. However, static tags are defined at the source of the target power grid data, meaning that only the source of the data has permission to modify them. This prevents tampering by any data caller during the data dissemination process, thereby ensuring the security of the target power grid data.

[0044] 102. Upon receiving a first data call request for target power grid data from a first data caller, verify whether the first data caller satisfies security rule information in a static tag.

[0045] 103a. If it is verified that the first data caller meets the security rule information in the static tag, then if the verification is successful, the first data caller is authorized to obtain the target power grid data.

[0046] 103b. If it is verified that the first data caller does not meet the security rule information in the static tag, the verification fails and the first data call request is rejected.

[0047] It should be noted that in order to distinguish different data callers, different data call requests initiated, and different contract authorizations established, the embodiments of this application use the words "first" and "second" for identification, and no further explanation will be given below.

[0048] In addition to the original origin of the target power grid data (i.e., the power grid system in the geographical region and business domain where the data was generated), when receiving a data call request initiated by any data caller, the embodiments of the present application first use the static tag of the target power grid data to verify the identity of the data caller, thereby determining whether the target power grid data can be authorized to be called, to ensure data security. However, if the verified identity of the data caller does not meet the authorization requirements, the data caller's data call request will be rejected.

[0049] 104a. When the first data caller obtains the target power grid data, a first contract authorization is established with the first data caller. The dimensions of the propagation constraint conditions provided in the first contract authorization include at least: attribute information of the next data caller, effective duration of data propagation, and effective number of data propagation.

[0050] After the data caller is verified and authorized to obtain the target power grid data as in 103a, a contract authorization is established with the data caller. The dimensions of the propagation constraint conditions provided in the contract authorization include at least: the attribute information of the next data caller, the effective duration of data propagation, and the effective number of data propagation.

[0051] The attribute information of the next data caller can be, but is not limited to, attribute information related to a geographic region or business domain. For example, if the attribute information is "Beijing," the propagation constraint condition is that the target power grid data can continue to be propagated by the power grid organization in "Beijing." Accordingly, in this embodiment of the application, the "attribute information of the next data caller" can be further refined to include different attribute dimensions, thereby providing diverse constraint conditions.

[0052] The effective duration of data transmission imposes a "timeliness" constraint on the target power grid data. The effective number of data transmissions imposes a "limited call number" constraint on the target power grid data.

[0053] As described above, in the embodiment of the present application, after a data caller obtains the target power grid data, according to the established contract authorization, the target power grid data can be disseminated from this "data caller" under restricted conditions.

[0054] 105a. Fill the first contract authorization into the dynamic tag of the target power grid data to obtain an updated dynamic tag.

[0055] In an embodiment of the present application, after the contract authorization is established, it is filled into the dynamic tag, so that the contract authorization is monitored using the dynamic tag.

[0056] 106a. Monitor the target power grid data to be acquired by the second data caller across geographical regions and / or across business domains according to the static tag and the updated dynamic tag corresponding to the target power grid data.

[0057] In an embodiment of the present application, after a data caller obtains the target power grid data, the target power grid data can be propagated from this "data caller", and this "data caller" can serve as the "new data owner", but the propagation process is constrained by static tags and dynamic tags. For example, when another data caller wants to call the target power grid data from this "new data owner", it is necessary to execute steps such as 102-106a again. Therefore, the power grid data extension access control method provided in the embodiment of the present application is an iterative process until it is stopped due to the constraints of static tags or continuously updated dynamic tags.

[0058] As described above, the embodiment of the present application provides a method for extended access control of power grid data. Compared with the existing technology's demand for extended access control in the interaction of power grid data across geographical regions and across business fields, the embodiment of the present application uses static tags to provide constrained access control for data callers, and uses dynamic tags to provide propagation access control for the next data caller. Then, when there are multiple iterative data callers, the static tags associated with the target power grid data and the continuously updated dynamic tags are used to realize the propagation monitoring of the target power grid data across geographical regions and / or across business fields, thereby providing an effective solution for extended access control of power grid data.

[0059] In order to explain in more detail the above-mentioned "grid data extension access control method is an iterative process", the embodiment of the present application also provides another grid data extension access control method, such as Figure 2 As shown, the embodiment of the present invention provides the following specific steps:

[0060] 201. When a first data caller receives a second data call request for target power grid data from a second data caller, the first data caller verifies whether the second data caller satisfies security rule information in a static tag.

[0061] It should be noted that in the embodiment of the present application, the "first data caller" is the party that has obtained the target power grid data from the data origin location, the "second data caller" is the party that wants to obtain the target power grid data from the "first data caller", and the "third data caller" is the party that obtains the target power grid data from the "second data caller" when the "second data caller" can and has obtained the target power grid data.

[0062] In addition, the embodiments of the present application use the words "first" and "second" as identifiers to distinguish the data call requests and contract authorizations corresponding to different data callers, that is, "first data caller" corresponds to "first call request" corresponding to "first contract authorization"; "second data caller" corresponds to "second call request" corresponding to "second contract authorization", which will not be further explained later.

[0063] Since the target power grid data is associated with static tags and dynamic tags at the data origin location, when the first data caller receives the second data call request for the target power grid data from the second data caller, the static tag is first used to verify whether the second data caller meets the security rule information in the static tag.

[0064] For details on static tags and dynamic tags, please refer to 101, which will not be repeated here.

[0065] 202a. If the security rule information is not satisfied, the second data call request is rejected.

[0066] 202b. If the security rule information is satisfied, verify whether the second data caller satisfies the constraint conditions in the first contract authorization.

[0067] When the first data caller receives the second data call request for the target power grid data from the second data caller, it first uses the static tag of the target power grid data to verify the identity of the second data caller, so as to determine whether the target power grid data can be authorized to be called. If the verification fails, the data call request of the second data caller is directly rejected.

[0068] However, if the verification is successful, since the first data caller established the first contract authorization when obtaining the target power grid data from the data origin location, and since the first contract authorization is filled in the dynamic tag, then at this time, the first contract authorization in the dynamic tag can be used to further verify whether the second data caller meets the requirements.

[0069] It should be noted that, as explained in 104a, “the dimensions of the propagation constraints provided in the first contract authorization include at least: the attribute information of the next data caller, the effective duration of data propagation, and the effective number of data propagation.”

[0070] In the embodiment of the present application, the "dimension of propagation constraints" is still taken as an example. For the "effective duration of data propagation and effective number of data propagation", when the first contract authorization is established, these two dimensions are actually triggered in the "countdown" and "countdown" modes.

[0071] For example, if the "valid duration of data dissemination" in the first contract authorization is 30 days, it means that the "timeliness" of the target power grid data is 30 days, and the "countdown" mode has been turned on; if the "valid number of data disseminations" is 10 times, it means that the "limited number of calls" for the target power grid data is 10 times, and the "countdown" mode has been turned on.

[0072] 203bc. If the constraints in the first contract authorization are not met, the second data call request is rejected.

[0073] 203bd. If the constraints in the first contract authorization are met, authorize the second data caller to obtain the target power grid data from the first data caller.

[0074] 204bd. When the second data caller obtains the target power grid data, a second contract authorization is established with the second data caller. The dimension of the propagation constraint condition of the second contract authorization is the same as that of the first contract authorization.

[0075] Among them, the dimensions of the propagation constraints of the second contract authorization are the same as those of the first contract authorization, and as exemplified in 202b, for the "effective duration of data propagation and effective number of data propagation", in fact, when establishing the first contract authorization, these two dimensions are equivalent to being triggered in the "countdown" and "countdown" modes.

[0076] Then, when establishing the second contract authorization, continue with the example above. Since the "countdown" and "countdown" modes are triggered, the "effective duration" is re-determined in the "effective duration of data transmission" dimension according to the current moment, and the "limited number of calls" is re-determined in the "effective number of data transmission" dimension to establish the second contract authorization.

[0077] For example, in the first contract authorization, the "valid period for data dissemination" is 30 days, and the "valid number of data disseminations" is 10 times. Since 2 days have passed, the "valid period for data dissemination" is re-determined to be 28 days. Moreover, since the second data caller can be authorized to obtain the target power grid data, the "valid number of data disseminations" is re-determined to be 9 times. Based on this, the second contract authorization is established to at least include: the attribute information of the next data caller, the valid period for data dissemination is 28 days, and the valid number of data dissemination is 9 times.

[0078] 205bd. Fill the second contract authorization into the dynamic tag of the target power grid data in a manner of overwriting the first contract authorization, thereby obtaining a dynamic tag that is updated again.

[0079] In order to avoid redundant data information being stored in the dynamic tag, the second contract authorization is filled into the dynamic tag of the target power grid data in a manner of overwriting the first contract authorization.

[0080] 206bd. Based on the static tag corresponding to the target power grid data and the updated dynamic tag, monitor whether the target power grid data is acquired by the third data caller across geographical regions and / or across business domains.

[0081] After steps 201-205bd, the second data caller has obtained the target grid data and established a second contractual authorization. As the "owner" of the target grid data, a third data caller across geographical regions and / or business domains may initiate a data call request to this "owner" to obtain the target grid data. Whether the target grid data can be obtained by the third data caller is determined by iteratively executing steps 201-205bd. Therefore, the extended access control method for grid data provided in this embodiment of the application is an iterative process that stops when constrained by a static tag or a continuously updated dynamic tag. This means that the target grid data is denied access due to failure to meet the security rule information in the static tag, or denied access due to failure to meet the contractual authorization in the "continuously updated dynamic tag."

[0082] In some modified embodiments, for the target contract authorization established between the previous data caller and the next data caller, a timestamp can be added to each target contract authorization in the embodiments of the present application, so that according to the timestamp corresponding to each target contract authorization, the latest added target contract authorization is controlled in the dynamic tag to overwrite the previous target contract authorization adjacent in time.

[0083] As explained in 205bd above, "filling the second contract authorization into the dynamic tag of the target power grid data in a manner that overwrites the first contract authorization to obtain a dynamic tag that is updated again", if the target power grid data is propagated between multiple data callers, so that multiple target contract authorizations are established during this propagation process, then the embodiment of the present application can use the timestamp corresponding to the contract authorization to avoid errors when overwriting the previous invalid target contract authorization, thereby improving accuracy.

[0084] In some modified embodiments, during the process of target power grid data being transmitted across geographical regions and / or across business domains, as explained in 201-206bd, it can be seen that the power grid data extension access control method provided in the embodiments of the present application is an iterative process. In addition to using static tags, how to terminate the iterative process can also be based on continuously updated dynamic tags. For example, the specific implementation method includes the following:

[0085] A1. Determine the remaining data dissemination validity period and the remaining data dissemination validity times based on the current target contract authorization stored in the dynamic tag;

[0086] A2. If the remaining data propagation effective time is less than a first preset threshold, the acquisition operation of the target power grid data corresponding to the next data caller is rejected;

[0087] A3. If the number of valid remaining data transmission times is less than a second preset threshold, the acquisition operation of the target power grid data by the next data caller is rejected.

[0088] As shown above, A1A2 determines whether to continue to authorize the target power grid data to be obtained by the next data caller based on the "data transmission effective duration" dimension in the target contract authorization. As explained in 204bd above, when the first contract authorization is established, these two dimensions are actually triggered in the "countdown" and "countdown" modes.

[0089] Therefore, for the current target contract authorization, the "remaining data dissemination effective duration" can be further determined by combining the data value on the "data dissemination effective duration" dimension with the time difference between the current moment. Furthermore, based on the value on the "data dissemination effective times" dimension in the current target contract authorization, the "remaining data dissemination effective times" can be obtained. Therefore, in this embodiment of the application, a "first preset threshold" can be pre-set as a boundary constraint. When the "remaining data dissemination effective duration" is less than the first preset threshold, the acquisition operation of the target power grid data corresponding to the next data caller is rejected.

[0090] As shown above, A1A3 is a parallel solution to A1A2. In the embodiment of the present application, a "second preset threshold" can be pre-set as a boundary constraint. When the "effective number of remaining data propagation times is less than the second preset threshold", the acquisition operation of the target power grid data corresponding to the next data caller is rejected.

[0091] It should be noted that as long as one of the two parallel solutions above is met, it is determined that the iterative process should be terminated.

[0092] In some modified embodiments, during the propagation of target power grid data across geographical regions and / or across business fields, when the previous data caller establishes a target contract authorization with the next data caller, the embodiment of the present application also provides an operation for obtaining the identification information corresponding to the next data caller, and adds the identification information with the corresponding timestamp to the dynamic tag corresponding to the target power grid data. It should be noted that the "identification information with a timestamp" will not be overwritten in the continuously updated dynamic tag. As the target power grid data propagates among multiple data callers, the propagation path of the target power grid data can be constructed based on each "identification information with a timestamp", thereby realizing the monitoring and tracing of the target power grid data on the propagation path, thereby providing a more diverse management method for the extended access control of power grid data.

[0093] Furthermore, as a response to the above Figure 1 、 Figure 2The embodiment of the present application provides a power grid data extension access control system. This system embodiment corresponds to the aforementioned method embodiment. For ease of reading, this system embodiment will not repeat the details of the aforementioned method embodiment one by one, but it should be clear that the system in this embodiment can implement all the contents of the aforementioned method embodiment. The system is used to control access to power grid data extension across geographical regions and / or across business fields, specifically as follows Figure 3 As shown, the device includes:

[0094] a determination unit 31 configured to determine target power grid data to be called, wherein the target power grid data is associated with a static tag and a dynamic tag, wherein the static tag is configured to provide security rule information for accessing the target power grid data, and the dynamic tag is configured to provide propagation rule information corresponding to propagating the target power grid data across geographical regions and / or business domains;

[0095] A verification unit 32 is configured to verify, upon receiving a first data call request from a first data caller for the target power grid data, whether the first data caller satisfies the security rule information in the static tag;

[0096] The authorization unit 33 is configured to authorize the first data caller to obtain the target power grid data if the verification passes and the conditions are met;

[0097] An establishing unit 34 is configured to establish a first contract authorization with the first data caller while the first data caller obtains the target power grid data, wherein the dimensions of the propagation constraint conditions provided in the first contract authorization include at least: attribute information of the next data caller, effective duration of data propagation, and effective number of data propagation;

[0098] A filling unit 35 is configured to fill the first contract authorization into the dynamic tag of the target power grid data to obtain an updated dynamic tag;

[0099] The monitoring unit 36 ​​is configured to monitor whether the target power grid data is acquired by a second data caller across geographical regions and / or business domains according to the static tag and the updated dynamic tag corresponding to the target power grid data.

[0100] Further, such as Figure 4 As shown, the monitoring unit 36 ​​includes:

[0101] A first verification module 361 is configured to verify whether the second data caller satisfies the security rule information in the static tag when the first data caller receives a second data call request for the target power grid data from the second data caller;

[0102] a rejection module 362, configured to reject the second data call request if the security rule information is not satisfied;

[0103] A second verification module 363 is configured to verify whether the second data caller satisfies the constraint conditions in the first contract authorization if the security rule information is satisfied;

[0104] The rejection module 362 is further configured to reject the second data call request if the constraint conditions in the first contract authorization are not met;

[0105] An authorization module 364 is configured to authorize the second data caller to obtain the target power grid data from the first data caller if the constraint conditions in the first contract authorization are met;

[0106] An establishing module 365 is configured to establish a second contract authorization with the second data caller while the second data caller obtains the target power grid data, wherein the second contract authorization has the same dimension of propagation constraint conditions as the first contract authorization;

[0107] A filling module 366 is configured to fill the second contract authorization into the dynamic tag of the target power grid data in a manner of overwriting the first contract authorization, thereby obtaining a further updated dynamic tag;

[0108] The monitoring module 367 is configured to monitor whether the target power grid data is acquired by a third data caller across geographical regions and / or business domains according to the static tag and the re-updated dynamic tag corresponding to the target power grid data.

[0109] Further, such as Figure 4 As shown, the system further includes an adding unit 37, which is used to:

[0110] For the target contract authorization established between the previous data caller and the next data caller, add a timestamp to each target contract authorization;

[0111] According to the timestamp corresponding to each target contract authorization, the newly added target contract authorization is controlled to overwrite the previous target contract authorization adjacent in time in the dynamic tag.

[0112] Further, such as Figure 4 As shown, during the process of the target power grid data being transmitted across geographical regions and / or across business domains, the monitoring unit 36 ​​is further specifically configured to:

[0113] Determining the remaining data dissemination validity period and the remaining data dissemination validity times according to the current target contract authorization stored in the dynamic tag of the target power grid data;

[0114] If the remaining data propagation effective time is less than a first preset threshold, the acquisition operation of the target power grid data corresponding to the next data caller is rejected; or,

[0115] If the number of valid remaining data transmission times is less than a second preset threshold, the acquisition operation of the target power grid data by the next data caller is rejected.

[0116] Further, such as Figure 4 As shown, during the process of the target power grid data being transmitted across geographical regions and / or across business domains, the monitoring unit 36 ​​is further specifically configured to:

[0117] When the previous data caller establishes a target contract authorization with the next data caller, obtain the identification information corresponding to the next data caller;

[0118] The identification information carries a corresponding timestamp and is added to a dynamic tag corresponding to the target power grid data.

[0119] In summary, the power grid data extension access control system includes a processor and a memory. The above-mentioned determination unit, verification unit, authorization unit, establishment unit, filling unit and monitoring unit are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0120] The processor includes a kernel, which retrieves the corresponding program unit from memory. One or more kernels can be configured. By adjusting kernel parameters, static tags are used to provide constrained access control for data callers, and dynamic tags are used to provide propagation access control for the next data caller. When there are multiple iterative data callers, the static tags associated with the target power grid data and the continuously updated dynamic tags are used to monitor the propagation of the target power grid data across geographical regions and / or business domains, providing an effective solution for extended access control of power grid data.

[0121] An embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for controlling access to extended power grid data as described above is implemented.

[0122] An embodiment of the present application provides an electronic device, comprising at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other via the bus; and the processor is configured to share program instructions in the memory to execute the power grid data extension access control method as described above.

[0123] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing the program steps of the method for initializing extended access control of power grid data.

[0124] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0125] In a typical configuration, the device includes one or more processors (CPUs), memory, and a bus. The device may also include input / output interfaces, network interfaces, and the like.

[0126] Memory may include non-permanent memory in a computer-readable medium, random access memory (RAM), and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory includes at least one memory chip. Memory is an example of a computer-readable medium.

[0127] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0128] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0129] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0130] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A method for controlling access to extended power grid data, characterized in that: The method comprises: Determining target power grid data to be called, wherein the target power grid data is associated with a static tag and a dynamic tag, wherein the static tag is used to provide security rule information for accessing the target power grid data, and the dynamic tag is used to provide propagation rule information corresponding to propagating the target power grid data across geographical regions and / or across business domains; Upon receiving a first data call request for the target power grid data from a first data caller, verifying whether the first data caller satisfies the security rule information in the static tag; If satisfied, the verification is passed and the first data caller is authorized to obtain the target power grid data; When the first data caller obtains the target power grid data, a first contract authorization is established with the first data caller, wherein the dimensions of the propagation constraint conditions provided in the first contract authorization include at least: attribute information of the next data caller, effective duration of data propagation, and effective number of data propagation; Filling the first contract authorization into the dynamic tag of the target power grid data to obtain an updated dynamic tag; According to the static tag and the updated dynamic tag corresponding to the target power grid data, the target power grid data is monitored to be acquired by the second data caller across geographical regions and / or across business fields.

2. The method according to claim 1, characterized in that The step of monitoring, based on the static tag and the updated dynamic tag corresponding to the target power grid data, whether the target power grid data is acquired by a second data caller across geographical regions and / or across business domains includes: When the first data caller receives a second data call request for the target power grid data from a second data caller, verifying whether the second data caller satisfies the security rule information in the static tag; If the security rule information is not satisfied, rejecting the second data call request; If the security rule information is satisfied, verify whether the second data caller satisfies the constraint conditions in the first contract authorization; If the constraints in the first contract authorization are not met, rejecting the second data call request; If the constraints in the first contract authorization are met, authorizing the second data caller to obtain the target power grid data from the first data caller; When the second data caller obtains the target power grid data, a second contract authorization is established with the second data caller, wherein the dimension of the propagation constraint condition of the second contract authorization is the same as that of the first contract authorization; Filling the second contract authorization into the dynamic tag of the target power grid data in a manner of overwriting the first contract authorization to obtain a further updated dynamic tag; According to the static tag corresponding to the target power grid data and the re-updated dynamic tag, the target power grid data is monitored to be acquired by a third data caller across geographical regions and / or across business fields.

3. The method according to claim 2, characterized in that For the target contract authorization established between the previous data caller and the next data caller, the method further includes: Add a timestamp to each target contract authorization; According to the timestamp corresponding to each target contract authorization, the newly added target contract authorization is controlled to overwrite the previous target contract authorization adjacent in time in the dynamic tag.

4. The method according to any one of claims 1 to 3, wherein during the process of disseminating the target power grid data across geographical regions and / or across business domains, the method further comprises: Determining the remaining data transmission validity period and the remaining data transmission validity times according to the current target contract authorization stored in the dynamic tag of the target power grid data; If the remaining data propagation effective time is less than a first preset threshold, the acquisition operation of the target power grid data corresponding to the next data caller is rejected; or, If the number of valid remaining data transmission times is less than a second preset threshold, the acquisition operation of the target power grid data by the next data caller is rejected.

5. The method according to claims 1 to 3, characterized in that During the process of disseminating the target power grid data across geographical regions and / or across business areas, the method further includes: When the previous data caller establishes a target contract authorization with the next data caller, obtain the identification information corresponding to the next data caller; The identification information carries a corresponding timestamp and is added to a dynamic tag corresponding to the target power grid data.

6. A power grid data extension access control system, characterized in that: The system comprises: a determining unit, configured to determine target power grid data to be called, wherein the target power grid data is associated with a static tag and a dynamic tag, wherein the static tag is used to provide security rule information for accessing the target power grid data, and the dynamic tag is used to provide propagation rule information corresponding to propagating the target power grid data across geographical regions and / or across business domains; a verification unit, configured to verify, upon receiving a first data call request from a first data caller for the target power grid data, whether the first data caller satisfies the security rule information in the static tag; an authorization unit, configured to, if the conditions are met, authorize the first data caller to obtain the target power grid data if the verification passes; an establishing unit, configured to establish a first contract authorization with the first data caller while the first data caller obtains the target power grid data, wherein the dimensions of the propagation constraint conditions provided in the first contract authorization include at least: attribute information of the next data caller, effective duration of data propagation, and effective number of data propagation; a filling unit, configured to fill the first contract authorization into the dynamic tag of the target power grid data to obtain an updated dynamic tag; A monitoring unit is configured to monitor whether the target power grid data is acquired by a second data caller across geographical regions and / or business domains according to the static tag and the updated dynamic tag corresponding to the target power grid data.

7. The system according to claim 6, characterized in that The monitoring unit includes: a first verification module, configured to verify, when the first data caller receives a second data call request for the target power grid data from a second data caller, whether the second data caller satisfies the security rule information in the static tag; a rejection module, configured to reject the second data call request if the security rule information is not satisfied; A second verification module is configured to verify whether the second data caller satisfies the constraint conditions in the first contract authorization if the security rule information is satisfied; The rejection module is further configured to reject the second data call request if the constraint conditions in the first contract authorization are not met; an authorization module, configured to authorize the second data caller to obtain the target power grid data from the first data caller if the constraint conditions in the first contract authorization are met; an establishing module, configured to establish a second contract authorization with the second data caller while the second data caller obtains the target power grid data, wherein the dimension of the propagation constraint condition of the second contract authorization is the same as that of the first contract authorization; a filling module, configured to fill the second contract authorization into the dynamic tag of the target power grid data in a manner of overwriting the first contract authorization, thereby obtaining a further updated dynamic tag; A monitoring module is used to monitor whether the target power grid data is acquired by a third data caller across geographical regions and / or across business fields according to the static tag corresponding to the target power grid data and the re-updated dynamic tag.

8. The system according to claim 7, characterized in that The system further comprises an adding unit for: For the target contract authorization established between the previous data caller and the next data caller, add a timestamp to each target contract authorization; According to the timestamp corresponding to each target contract authorization, the newly added target contract authorization is controlled to overwrite the previous target contract authorization adjacent in time in the dynamic tag.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for controlling extended access to power grid data according to any one of claims 1 to 5 is implemented.

10. An electronic device, characterized in that: The device includes at least one processor, and at least one memory and a bus connected to the processor; The processor and the memory communicate with each other via the bus. The processor is configured to call program instructions in the memory to execute the method for controlling extended access to power grid data as claimed in any one of claims 1 to 5.

Images