Access identity authentication method, device, equipment and medium for power monitoring system

Abstract

The present application relates to the field of electric power technology, and provides an access identity authentication method, device, computer equipment, storage medium and computer program product for an electric power monitoring system. The present application can improve the security of the access object end of the electric power monitoring system through the access subject end of the electric power monitoring system, reduce risks, improve the accuracy of the identity authentication of the dynamic evaluation of the electric power monitoring system, and improve the accuracy of the identity evaluation of the access subject end. The method includes: receiving an access request sent by the access subject end of the electric power monitoring system, performing validity analysis on the access request, and obtaining a validity analysis result. If the validity analysis result is valid, authenticating the access request and obtaining a request authentication result. If the request authentication result is passed, authenticating the access request and obtaining an authentication result, and configuring the target access rights corresponding to the authentication result for the access subject end.

Description

Technical Field

[0001] The present application relates to the field of electric power technology, and in particular to an access identity authentication method, device, computer equipment, storage medium and computer program product for an electric power monitoring system. Background Art

[0002] With the development of power technology, power monitoring system has become an important system. Power monitoring system refers to the business system and intelligent equipment based on computer and network technology used to monitor and control the power production and supply process, as the basic support for communication and data networks. The power monitoring system is equivalent to the neural network and control center of the entire power system, which is of great significance to ensure the safe and stable operation of the power system and the reliable supply of electricity.

[0003] In traditional technology, when the access subject end of the power monitoring system accesses the access object end of the power monitoring system, the access subject end of the power monitoring system will directly have all the permissions to access the access object end of the power monitoring system. However, this technology is prone to cause information leakage of the power monitoring system. Therefore, the method of accessing the access object end of the power monitoring system through the access subject end of the power monitoring system has a technical problem of low security. Summary of the invention

[0004] Based on this, it is necessary to provide an access identity authentication method, device, computer equipment, computer-readable storage medium and computer program product for an electric power monitoring system in response to the above technical problems.

[0005] In a first aspect, the present application provides an access identity authentication method for a power monitoring system. The method comprises:

[0006] Receiving an access request sent by an access subject terminal of the power monitoring system;

[0007] Perform validity analysis on the access request to obtain validity analysis results;

[0008] If the validity analysis result is valid, the access request is authenticated to obtain a request authentication result;

[0009] When the authentication result of the request is passed, the access request is authenticated to obtain the authentication result;

[0010] Configure the target access permission corresponding to the authentication result on the access subject side.

[0011] In one embodiment, authenticating the access request and obtaining an authentication result includes:

[0012] The access request is input into the identity library, the permission library and the trust library for verification respectively, and the first identity authentication result, the second identity authentication result and the third identity authentication result of the access request are obtained; the first identity authentication result is used to indicate the access permission configuration result of the access subject end, the second identity authentication result is used to indicate the access permission scope of the access subject end, and the third identity authentication result is used to indicate the number of access trusts of the access subject end;

[0013] The first identity authentication result, the second identity authentication result and the third identity authentication result are combined to obtain an identity authentication result.

[0014] In one embodiment, configuring the target access rights corresponding to the identity authentication result on the access subject end includes:

[0015] Querying the correspondence between the preset identity authentication result and the access permission, and obtaining the target access permission corresponding to the identity authentication result;

[0016] The target access rights are configured for the access subject; the target access rights at least include the access rights scope and access trust times corresponding to the access subject.

[0017] In one embodiment, before receiving the access request sent by the access subject end of the power monitoring system, the method further includes:

[0018] In response to the power-on instruction, a power-on signal is sent to the access subject end, so that the access subject end enters the power-on state according to the power-on signal; the power-on instruction is used to instruct the access subject end to start;

[0019] The method also includes:

[0020] In response to the shutdown instruction, a shutdown signal is sent to the access subject end, so that the access subject end enters a shutdown state according to the shutdown signal; the shutdown instruction is used to instruct to shut down the access subject end.

[0021] In one embodiment, performing validity analysis on the access request to obtain validity analysis results includes:

[0022] Use the trusted proxy to perform validity analysis on the access request and obtain the validity analysis result;

[0023] After performing validity analysis on the access request and obtaining the validity analysis result, it also includes:

[0024] When the validity analysis result is invalid, the access request is intercepted and processed using a trusted proxy.

[0025] In one embodiment, authenticating the access request and obtaining the request authentication result includes:

[0026] Using at least two authentication methods in the dynamic access control engine, respectively authenticate the access request to obtain at least two request authentication sub-results;

[0027] A request authentication result is obtained according to at least two request authentication sub-results.

[0028] In a second aspect, the present application also provides an access identity authentication device for a power monitoring system. The device comprises:

[0029] An access request receiving module, used to receive an access request sent by an access subject end of the power monitoring system;

[0030] A validity analysis result obtaining module is used to perform validity analysis on the access request to obtain a validity analysis result;

[0031] A request authentication result obtaining module, used for authenticating the access request and obtaining a request authentication result if the validity analysis result is valid;

[0032] An identity authentication result obtaining module, used for, if the request authentication result is passed, performing identity authentication on the access request to obtain an identity authentication result;

[0033] The target access permission configuration module is used to configure the target access permission corresponding to the identity authentication result on the access subject end.

[0034] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0035] Receive an access request sent by an access subject of the power monitoring system; perform validity analysis on the access request to obtain a validity analysis result; if the validity analysis result is valid, authenticate the access request to obtain a request authentication result; if the request authentication result is passed, authenticate the access request to obtain an authentication result; configure the target access rights corresponding to the authentication result on the access subject.

[0036] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0037] Receive an access request sent by an access subject of the power monitoring system; perform validity analysis on the access request to obtain a validity analysis result; if the validity analysis result is valid, authenticate the access request to obtain a request authentication result; if the request authentication result is passed, authenticate the access request to obtain an authentication result; configure the target access rights corresponding to the authentication result on the access subject.

[0038] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0039] Receive an access request sent by an access subject of the power monitoring system; perform validity analysis on the access request to obtain a validity analysis result; if the validity analysis result is valid, authenticate the access request to obtain a request authentication result; if the request authentication result is passed, authenticate the access request to obtain an authentication result; configure the target access rights corresponding to the authentication result on the access subject.

[0040] The access identity authentication method, device, computer equipment, storage medium and computer program product of the above-mentioned power monitoring system receive an access request sent by the access subject end of the power monitoring system, perform validity analysis on the access request, and obtain a validity analysis result. When the validity analysis result is valid, the access request is authenticated to obtain a request authentication result. When the request authentication result is passed, the access request is authenticated to obtain an authentication result, and the target access rights corresponding to the authentication result are configured for the access subject end. The scheme comprises that an access object end of the power monitoring system receives an access request of the power monitoring system sent by an access subject end of the power monitoring system, performs validity analysis on the access request, determines whether the access subject end is a valid access subject end, obtains a validity analysis result for the access subject end, and when the validity analysis result is valid, performs multi-faceted authentication on the access request to obtain a request authentication result, and when the request authentication result is passed, performs identity authentication on the access request to verify whether the access subject end meets the access conditions to obtain an identity authentication result, and configures the access subject end with a target access right corresponding to the identity authentication result, thereby improving the security of the method of accessing the access object end of the power monitoring system through the access subject end of the power monitoring system, reducing risks, improving the accuracy of the identity authentication of the dynamic evaluation of the power monitoring system, and improving the accuracy of the identity evaluation of the access subject end. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1A schematic diagram of a flow chart of an access identity authentication method for a power monitoring system in one embodiment;

[0042] Figure 2 A flowchart of steps for obtaining identity authentication results in one embodiment;

[0043] Figure 3 A flowchart of steps for configuring target access rights on an access subject end in one embodiment;

[0044] Figure 4 A structural block diagram of an access identity authentication device of a power monitoring system in one embodiment;

[0045] Figure 5 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0046] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0047] In one embodiment, Figure 1 As shown, a method for access identity authentication of a power monitoring system is provided. This embodiment uses the method applied to an access client end (such as a terminal) of the power monitoring system as an example for illustration, and includes the following steps:

[0048] Step S101: receiving an access request sent by an access subject of a power monitoring system.

[0049] In this step, the access subject end may be a subject end for accessing the power monitoring system, and the power monitoring system may be accessed by accessing the access object end of the power monitoring system (the power monitoring system may be installed in the access object end), and the access subject end may be a terminal; the access request may be a request from the access subject end to access the power monitoring system through the access object end, for example, the access request may be a request from the access subject end to access the access object end, or it may be a request input by a user on the access subject end to access the access object end, and the access object end may allow the access subject end to access or allow the operating user (user information) corresponding to the access subject end to access after authenticating or verifying the access request.

[0050] Specifically, the access object end of the power monitoring system receives the access request sent by the access subject end of the power monitoring system.

[0051] Step S102: Perform validity analysis on the access request to obtain a validity analysis result.

[0052] In this step, the validity analysis can be an analysis used to determine whether the access subject end is a valid access subject end, such as whether it is a pre-set access subject end or an access subject end that meets pre-set conditions (can access the access object end or the power monitoring system).

[0053] Specifically, the access client of the power monitoring system performs validity analysis on the access request to obtain a validity analysis result.

[0054] Step S103: When the validity analysis result is valid, the access request is authenticated to obtain a request authentication result.

[0055] In this step, the validity analysis result may include valid or invalid, where valid means that the access subject end is a valid access subject end, and invalid means that the access subject end is an invalid access subject end; authentication may include multi-factor authentication, joint authentication, and secondary authentication.

[0056] Specifically, when the validity analysis result is valid, the access object of the power monitoring system authenticates the access request and obtains a request authentication result.

[0057] Step S104: When the request authentication result is passed, the access request is authenticated to obtain an authentication result.

[0058] In this step, identity authentication may include verifying the identity of the access subject according to the access request and determining the corresponding access rights.

[0059] Specifically, when the authentication result of the request is passed, the access object of the power monitoring system performs identity authentication on the access request to obtain an identity authentication result.

[0060] Step S105: configuring the target access permission corresponding to the identity authentication result on the access subject end.

[0061] In this step, the target access right may be the access right corresponding to the identity authentication result, for example, the access right of the access subject to access the power monitoring system through the access object.

[0062] Specifically, the access object end of the power monitoring system configures the target access permission corresponding to the identity authentication result to the access subject end.

[0063] In the access identity authentication method of the above-mentioned power monitoring system, an access request sent by the access subject end of the power monitoring system is received, a validity analysis is performed on the access request to obtain a validity analysis result, and when the validity analysis result is valid, the access request is authenticated to obtain a request authentication result, and when the request authentication result is passed, an identity is authenticated on the access request to obtain an identity authentication result, and the access subject end is configured with a target access right corresponding to the identity authentication result. The scheme comprises that the access object end of the power monitoring system receives the access request of the power monitoring system sent by the access subject end of the power monitoring system, performs validity analysis on the access request, determines whether the access subject end is a valid access subject end, obtains the validity analysis result for the access subject end, and when the validity analysis result is valid, performs multi-faceted authentication on the access request to obtain the request authentication result, and when the request authentication result is passed, performs identity authentication on the access request to verify whether the access subject end meets the access conditions to obtain the identity authentication result, and configures the target access rights corresponding to the identity authentication result for the access subject end, thereby improving the security of the access subject end of the power monitoring system to access the access object end of the power monitoring system, reducing risks, improving the accuracy of the dynamic evaluation of the power monitoring system, and improving the accuracy of the identity evaluation of the access subject end.

[0064] In one embodiment, Figure 2 As shown, the above step S104 authenticates the access request and obtains the authentication result specifically includes: step S201, inputting the access request into the identity library, the permission library and the trust library for verification respectively, and obtaining the first authentication result, the second authentication result and the third authentication result of the access request; step S202, combining the first authentication result, the second authentication result and the third authentication result to obtain the authentication result.

[0065] In this embodiment, the first identity authentication result is used to indicate the access permission configuration result of the access subject end; the second identity authentication result is used to indicate the access permission range of the access subject end; the third identity authentication result is used to indicate the number of access trusts of the access subject end; the identity library, the permission library and the trust library can be libraries pre-added in the access object end, among which the identity library can be used to perform identity management, identity authentication and / or identity query on the access subject end, the permission library can be used to perform permission control on the access subject end (determine whether it is necessary to grant permission to the access subject end, and grant permission within a certain range according to needs), and the trust library can be used to perform identity evaluation on the access subject end (determine whether to grant trust to the access subject end once or multiple times, or to trust the access subject end for a long time).

[0066] Specifically, the access client of the power monitoring system inputs the access request into the identity library, permission library and trust library for verification respectively, obtains the first identity authentication result, the second identity authentication result and the third identity authentication result of the access request, and combines the first identity authentication result, the second identity authentication result and the third identity authentication result to obtain the identity authentication result.

[0067] The technical solution of this embodiment verifies the access request (access subject end) by utilizing the identity library, permission library and trust library, thereby improving the security of the method of accessing the access object end of the power monitoring system through the access subject end of the power monitoring system, improving the accuracy of the dynamic evaluation identity authentication of the power monitoring system, and improving the accuracy of the identity evaluation of the access subject end.

[0068] In one embodiment, Figure 3 As shown, the above step S105 of configuring the target access rights corresponding to the identity authentication result on the access subject side specifically includes: step S301, querying the correspondence between the preset identity authentication result and the access rights to obtain the target access rights corresponding to the identity authentication result; step S302, configuring the target access rights on the access subject side.

[0069] In this embodiment, the target access right includes at least the access right range and the access trust number corresponding to the access subject end; the correspondence between the preset identity authentication result and the access right can be a preset correspondence between the identity authentication result and the access right, for example, different identity authentication results have different corresponding access rights; the access right range can be the rights within a certain range given according to demand; the access trust number can be configured (given) for the access subject end as one-time trust, multiple trusts or long-term trust.

[0070] Specifically, the access object end of the power monitoring system queries the correspondence between the preset identity authentication result and the access permission, obtains the target access permission corresponding to the identity authentication result, and configures the target access permission for the access subject end.

[0071] The technical solution of this embodiment is conducive to obtaining more specific and accurate target access rights by obtaining target access rights that at least include the access right range and access trust times corresponding to the access subject end, thereby facilitating improving the security of the method of accessing the access object end of the power monitoring system through the access subject end of the power monitoring system, improving the accuracy of the dynamic evaluation of the power monitoring system. The accuracy of the identity authentication and the accuracy of the access subject end identity evaluation are improved.

[0072] In one embodiment, the above method can also enable the access subject end to enter the power-on state through the following steps, specifically including: in response to a power-on instruction, sending a power-on signal to the access subject end, so that the access subject end enters the power-on state according to the power-on signal; the above method can also enable the access subject end to enter the power-off state through the following steps, specifically including: in response to a power-off instruction, sending a power-off signal to the access subject end, so that the access subject end enters the power-off state according to the power-off signal.

[0073] In this embodiment, the power-on instruction is used to instruct the startup of the access subject end, which can be the power-on instruction entered by the object (such as a user or staff) at the access object end; the power-off instruction is used to instruct the shutdown of the access subject end, which can be the power-off instruction entered by the object at the access object end, so as to access the object end.

[0074] Specifically, before receiving the access request sent by the access subject end of the power monitoring system, if the access object end of the power monitoring system receives a power-on command, it will respond to the power-on command and send a power-on signal to the access subject end, so that the access subject end enters a power-on state according to the power-on signal; if it receives a power-off command, it will respond to the power-off command and send a power-off signal to the access subject end, so that the access subject end enters a power-off state according to the power-off signal.

[0075] The technical solution of this embodiment, by sending a power-on signal or a power-off signal to the access subject end, enables the access subject end to enter a power-on state according to the power-on signal, or enter a power-off state according to the power-off signal, thereby enabling the access object end to start or close the entrance of the access subject end, so that the access object end has sufficient control over the access subject end, which is beneficial to improving the security of the method of accessing the access subject end of the power monitoring system through the access subject end of the power monitoring system.

[0076] In one embodiment, the above step S102 performs validity analysis on the access request to obtain the validity analysis result, which specifically includes: using a trusted agent to perform validity analysis on the access request to obtain the validity analysis result; the above method can also intercept and process the access request through the following steps, which specifically includes: when the validity analysis result is invalid, using a trusted agent to intercept and process the access request.

[0077] In this embodiment, the trusted agent end can be an agent end connected between the access subject end and the access object end. For example, the access subject end communicates with the access object end through the trusted agent end. The trusted agent end can also be an agent end installed in the access object end, which is not limited here.

[0078] Specifically, the access client of the power monitoring system uses the trusted agent to perform validity analysis on the access request to obtain the validity analysis result. After performing validity analysis on the access request and obtaining the validity analysis result, if the validity analysis result is invalid, the trusted agent is used to intercept and process the access request.

[0079] The technical solution of this embodiment uses a trusted agent to perform validity analysis on access requests, and when the validity analysis result is invalid, the trusted agent is used to intercept and process the access request, which is beneficial to intercept invalid access requests from the access subject in advance, and no subsequent authentication or verification is required, which is beneficial to improve the security and efficiency of the method of accessing the access object of the power monitoring system through the access subject of the power monitoring system, improve the accuracy and efficiency of the identity authentication of the dynamic evaluation of the power monitoring system, and improve the accuracy and efficiency of the identity evaluation of the access subject.

[0080] In one embodiment, the above step S103 of authenticating the access request and obtaining the request authentication result specifically includes: using at least two authentication methods in the dynamic access control engine to authenticate the access request respectively to obtain at least two request authentication sub-results; and obtaining the request authentication result based on the at least two request authentication sub-results.

[0081] In this embodiment, the dynamic access control engine may include multiple authentication methods, for example, the dynamic access control engine includes multi-factor authentication, joint authentication and secondary authentication; at least two requested authentication sub-results may be different authentication results obtained by different authentication methods.

[0082] Specifically, the access client of the power monitoring system uses at least two authentication methods in the dynamic access control engine to authenticate the access request respectively, obtain at least two request authentication sub-results, and obtain the request authentication result according to the at least two request authentication sub-results.

[0083] The technical solution of this embodiment authenticates access requests through multiple authentication methods in the dynamic access control engine, which is beneficial to improving the security of the method of accessing the access object end of the power monitoring system through the access subject end of the power monitoring system, improving the accuracy of the dynamic evaluation identity authentication of the power monitoring system, and improving the accuracy of the identity evaluation of the access subject end.

[0084] The following is an example of an access identity authentication method for a power monitoring system provided by the present application. This embodiment uses the method applied to an access client (such as a terminal) of the power monitoring system as an example. The main steps include:

[0085] In the first step, the access object responds to the power-on command by sending a power-on signal to the access subject, so that the access subject enters the power-on state according to the power-on signal; or, the access object responds to the power-off command by sending a power-off signal to the access subject, so that the access subject enters the power-off state according to the power-off signal.

[0086] In the second step, in response to the power-on instruction, a power-on signal is sent to the access subject end, so that the access subject end enters the power-on state according to the power-on signal. The access object end uses the trusted agent end to perform validity analysis on the access request to obtain the validity analysis result.

[0087] In the third step, when the validity analysis result is invalid, the access client uses the trusted proxy to intercept and process the access request; or, when the validity analysis result is valid, the access client authenticates the access request and obtains the request authentication result.

[0088] In the fourth step, after authenticating the access request and obtaining the request authentication result, the access object uses at least two authentication methods in the dynamic access control engine to authenticate the access request respectively and obtain at least two request authentication sub-results.

[0089] In the fifth step, the access client obtains a request authentication result based on at least two request authentication sub-results.

[0090] In the sixth step, the access client inputs the access request into the identity library, the authority library and the trust library for verification, and obtains the first identity authentication result, the second identity authentication result and the third identity authentication result of the access request.

[0091] In the seventh step, the access client combines the first identity authentication result, the second identity authentication result and the third identity authentication result to obtain an identity authentication result.

[0092] In the eighth step, the access client queries the corresponding relationship between the preset identity authentication result and the access permission, and obtains the target access permission corresponding to the identity authentication result.

[0093] In the ninth step, the access object configures the target access rights corresponding to the identity authentication result on the access subject.

[0094] Among them, the power-on instruction is used to instruct the startup of the access subject end; the power-off instruction is used to instruct the shutdown of the access subject end; the first identity authentication result is used to indicate the access permission configuration result of the access subject end, the second identity authentication result is used to indicate the access permission range of the access subject end, and the third identity authentication result is used to indicate the access trust times of the access subject end; the target access permission includes at least the access permission range and access trust times corresponding to the access subject end.

[0095] The technical solution of this embodiment is that the access object end of the power monitoring system receives the access request of the power monitoring system sent by the access subject end of the power monitoring system, performs validity analysis on the access request, determines whether the access subject end is a valid access subject end, obtains the validity analysis result for the access subject end, and when the validity analysis result is valid, performs multi-faceted authentication on the access request to obtain a request authentication result, and when the request authentication result is passed, performs identity authentication on the access request to verify whether the access subject end meets the access conditions to obtain the identity authentication result, and configures the access subject end with the target access right corresponding to the identity authentication result, thereby improving the security of the method of accessing the access object end of the power monitoring system through the access subject end of the power monitoring system, reducing risks, improving the accuracy of the dynamic evaluation of the power monitoring system, and improving the accuracy of the identity evaluation of the access subject end.

[0096] The following is an application example to illustrate the access identity authentication method of the power monitoring system provided by this application. This application example uses the method applied to the access object end of the terminal or power monitoring system as an example, and the main steps include:

[0097] In the first step, the terminal (access client) establishes the access client and adds the startup and shutdown engine. Through the access client, the entrance of the access subject can be started or closed, so that the access client has sufficient control over the access subject.

[0098] In the second step, the terminal adds the identity library, permission library and trust library to the access object.

[0099] In the third step, the terminal uses the identity library to manage the identity of the access subject, uses the permission library to control the permission of the access subject, and uses the trust library to evaluate the identity of the access subject.

[0100] In the fourth step, the terminal determines the mandatory access control policy according to the needs and performs security marking on the access subject and object.

[0101] In the fifth step, the terminal connects the identity library, permission library and trust library to the dynamic access control engine. Through the access control engine, the data of the access subject end can be transmitted to the identity library, permission library and trust library in a timely and effective manner.

[0102] In the sixth step, the terminal adds multi-factor authentication, joint authentication, and secondary authentication applications to the access control engine, so that the access control engine has control functions. Through multiple different authentication methods, it strengthens the verification of the access subject end, that is, detects whether the access subject end can enter the access object end to avoid loopholes.

[0103] In the seventh step, the terminal introduces a trusted agent in front of the dynamic access control engine, which intercepts access requests, collects data, and transmits data. The trusted agent intercepts, processes, and collects data, avoiding the entry of invalid access subjects, which requires multiple inspections and authentications of the control engine and the access object, thereby wasting time.

[0104] In the eighth step, the terminal sets the access subject end, connects the access subject end with the trusted agent end, and connects the access subject end with the startup and shutdown engine of the access object end.

[0105] In the ninth step, the terminal adds an access information receiving execution program to the access subject end and adds a system security mechanism.

[0106] In the tenth step, the terminal adds audit procedures to both the access subject and the access object.

[0107] Exemplarily, in the first step, after the system is started, the terminal initializes the loading of the access subject end, the access object end security mark and the access control rules, and determines whether to close or open the access subject end; in the third step, the terminal identifies the received access subject end through the identity library, and determines whether it is a trusted source by the trust library, and determines whether to grant (configure) the corresponding authority to the access subject end by the authority library; in the third step, the terminal provides access subject end and access object end management, and can open identity credentials, and at the same time build the power monitoring system for the security of the access object end. Full control; in the sixth step, the terminal uses multi-factor authentication, joint authentication and secondary authentication to identify and authenticate the access request. Only after authentication by the access control engine can the data be passed to the identity library, permission library and trust library; in the seventh step, the terminal encrypts the access traffic at the trusted agent, adds a firewall, and generates a protection password through the SM2 algorithm (asymmetric encryption algorithm) and adds it to the firewall, and connects the firewall to the alarm system; in the tenth step, the terminal supports log auditing of all security configuration modifications and adjustments and access information of the access subject to the access object through the audit program.

[0108] Specifically, the terminal receives access data through the access subject end, and then transmits the access data to the trusted agent end, which directly analyzes the data to determine whether it is a valid access subject end. If it is a valid access subject end, the trusted agent end transmits the data to the dynamic access control engine, and the access control engine verifies the access subject end. The access subject end is tested and verified through multi-factor authentication, joint authentication and secondary authentication of the dynamic access engine. The verified access subject data enters the identity library, permission library and trust library, and the identity library is used to perform the final identity authentication and query on the access subject end. The access object end determines whether it is necessary to grant permissions to the access subject end through the permission library, and grants permissions within a certain range according to the needs. At the same time, the access object end also needs to determine through the trust library whether to give the access subject end one-time trust or multiple trusts, or to trust the access subject end for a long time, so as to achieve the purpose of identity assessment of the access subject end, and through the audit procedures in the access object end and the access subject end, the access object end and the access subject end are audited to prevent failures and illegal operations.

[0109] The technical solution of this application example uses the access subject end as the only access entry point. After receiving the access identity through the access subject end, the access data is transmitted to the dynamic access control system using a trusted agent. Thereafter, the access subject end is identified and managed through the identity library, and the access subject end is evaluated by the trust library. Finally, the permission library determines whether to grant permission to the access subject end and controls the scope of the granted permission. The permission library, identity library and trust library are all controlled by the access object end. Under normal circumstances, the identity library, permission library and trust library automatically identify and control the access subject through the system, thereby improving the security and accuracy of the identity authentication of the dynamic evaluation of the power monitoring system.

[0110] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0111] Based on the same inventive concept, the embodiment of the present application also provides an access identity authentication device for an electric power monitoring system for implementing the access identity authentication method for an electric power monitoring system involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in the embodiments of the access identity authentication device for one or more electric power monitoring systems provided below can refer to the limitations of the access identity authentication method for an electric power monitoring system above, and will not be repeated here.

[0112] In one embodiment, Figure 4 As shown, an access identity authentication device for a power monitoring system is provided, and the device 400 may include:

[0113] The access request receiving module 401 is used to receive the access request sent by the access subject end of the power monitoring system;

[0114] A validity analysis result obtaining module 402 is used to perform validity analysis on the access request to obtain a validity analysis result;

[0115] A request authentication result obtaining module 403 is used to authenticate the access request and obtain a request authentication result if the validity analysis result is valid;

[0116] The identity authentication result obtaining module 404 is used to authenticate the access request and obtain the identity authentication result if the request authentication result is passed;

[0117] The target access permission configuration module 405 is used to configure the target access permission corresponding to the identity authentication result for the access subject.

[0118] In one embodiment, the identity authentication result obtaining module 404 is also used to input the access request into the identity library, the permission library and the trust library for verification respectively, to obtain the first identity authentication result, the second identity authentication result and the third identity authentication result of the access request; the first identity authentication result is used to represent the access permission configuration result of the access subject end, the second identity authentication result is used to represent the access permission scope of the access subject end, and the third identity authentication result is used to represent the number of access trusts of the access subject end; the first identity authentication result, the second identity authentication result and the third identity authentication result are combined to obtain the identity authentication result.

[0119] In one embodiment, the target access permission configuration module 405 is also used to query the correspondence between the preset identity authentication result and the access permission to obtain the target access permission corresponding to the identity authentication result; configure the target access permission for the access subject end; the target access permission includes at least the access permission range and access trust times corresponding to the access subject end.

[0120] In one embodiment, the device 400 also includes: a power-on signal sending module, which is used to send a power-on signal to the access subject end in response to a power-on instruction, so that the access subject end enters a power-on state according to the power-on signal; the power-on instruction is used to instruct the access subject end to start; the device 400 also includes: a power-off signal sending module, which is used to send a power-off signal to the access subject end in response to a power-off instruction, so that the access subject end enters a power-off state according to the power-off signal; the power-off instruction is used to instruct the access subject end to shut down.

[0121] In one embodiment, the validity analysis result obtaining module 402 is also used to use the trusted agent to perform validity analysis on the access request to obtain the validity analysis result; the device 400 also includes: an access request interception module, which is used to intercept and process the access request using the trusted agent when the validity analysis result is invalid.

[0122] In one embodiment, the request authentication result obtaining module 403 is also used to use at least two authentication methods in the dynamic access control engine to authenticate the access request respectively, and obtain at least two request authentication sub-results; and obtain the request authentication result according to the at least two request authentication sub-results.

[0123] Each module in the access identity authentication device of the above-mentioned power monitoring system can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0124] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 5As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, an access identity authentication method for a power monitoring system is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0125] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0126] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0127] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0128] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0129] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0130] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0131] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0132] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for access identity authentication of a power monitoring system, characterized in that: The method comprises: The access client terminal responds to the power-on instruction by sending a power-on signal to the access subject terminal of the power monitoring system, so that the access subject terminal enters the power-on state according to the power-on signal; the power-on instruction is used to instruct the access subject terminal to start; Receiving an access request sent by the access subject end; Performing validity analysis on the access request to obtain a validity analysis result; When the validity analysis result is valid, the access request is authenticated respectively by using multi-factor authentication, joint authentication and secondary authentication in the dynamic access control engine to obtain three request authentication sub-results; Obtaining a request authentication result according to the three request authentication sub-results; When the request authentication result is passed, the identity of the access request is authenticated using the identity library, the authority library and the trust library to obtain an identity authentication result; The target access right corresponding to the identity authentication result is configured for the access subject end; the target access right at least includes the access right range and the access trust times corresponding to the access subject end; The method further comprises: The access object end responds to the shutdown instruction and sends a shutdown signal to the access subject end, so that the access subject end enters a shutdown state according to the shutdown signal; the shutdown instruction is used to instruct the access subject end to shut down.

2. The method according to claim 1, characterized in that The authentication of the access request by using the identity library, the authority library and the trust library to obtain the authentication result includes: The access request is input into the identity library, the permission library and the trust library respectively for verification, and a first identity authentication result, a second identity authentication result and a third identity authentication result of the access request are obtained; the first identity authentication result is used to indicate the access permission configuration result of the access subject end, the second identity authentication result is used to indicate the access permission scope of the access subject end, and the third identity authentication result is used to indicate the number of access trusts of the access subject end; The first identity authentication result, the second identity authentication result and the third identity authentication result are combined to obtain the identity authentication result.

3. The method according to claim 1, characterized in that The configuring the target access right corresponding to the identity authentication result on the access subject end includes: Querying the correspondence between the preset identity authentication result and the access permission to obtain the target access permission corresponding to the identity authentication result; The target access permission is configured on the access subject end.

4. The method according to claim 1, characterized in that The performing validity analysis on the access request to obtain a validity analysis result includes: Using a trusted proxy terminal to perform validity analysis on the access request to obtain the validity analysis result; After performing validity analysis on the access request and obtaining the validity analysis result, the method further includes: When the validity analysis result is invalid, the access request is intercepted and processed by using the trusted agent.

5. The method according to claim 1, characterized in that The access subject end is a terminal used to access the power monitoring system.

6. An access identity authentication device for an electric power monitoring system, characterized in that: The device comprises: A power-on signal sending module, used for the access client to respond to the power-on instruction and send a power-on signal to the access subject of the power monitoring system, so that the access subject enters the power-on state according to the power-on signal; the power-on instruction is used to instruct the access subject to start; An access request receiving module, used for receiving an access request sent by the access subject end; A validity analysis result obtaining module is used to perform validity analysis on the access request to obtain a validity analysis result; A request authentication result obtaining module is used to, when the validity analysis result is valid, use the multi-factor authentication, joint authentication and secondary authentication in the dynamic access control engine to authenticate the access request respectively, and obtain three request authentication sub-results; and obtain the request authentication result according to the three request authentication sub-results; The identity authentication result obtaining module is used to authenticate the access request using the identity library, the authority library and the trust library to obtain the identity authentication result when the request authentication result is passed; A target access permission configuration module, used to configure the target access permission corresponding to the identity authentication result for the access subject end; the target access permission at least includes the access permission range and access trust times corresponding to the access subject end; A shutdown signal sending module is used for the access object end to respond to a shutdown instruction and send a shutdown signal to the access subject end, so that the access subject end enters a shutdown state according to the shutdown signal; the shutdown instruction is used to instruct the access subject end to shut down.

7. The device according to claim 6, characterized in that The target access permission configuration module is further used to query the correspondence between the preset identity authentication result and the access permission, and obtain the target access permission corresponding to the identity authentication result; The target access permission is configured on the access subject end.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images