A method for generating access control policies for distribution network data assets

Abstract

The present invention relates to the field of access control strategy technology, and specifically to a method for generating access control strategies for distribution network data assets, comprising the following steps: S1: analyzing the access control attributes of distribution network data assets, and formulating access control rules according to the logical relationship between the access control attributes; S2: establishing an access control strategy generation model based on the access control rules; S3: training the access control strategy generation model so that any new user can generate corresponding access control rules when accessing data assets. The present invention, based on the characteristics and applications of distribution network data assets, analyzes the specific contents of the subject attributes, object attributes and operation attributes of distribution network data asset access control, explains the access control rules for distribution network data assets, and uses a BiLSTM neural network combined with a conditional random field and an improved BERT model to implement distribution network data asset object attribute mining and access requester subject attribute mining.

Description

Technical Field

[0001] The present invention relates to the technical field of access control strategies, and in particular to a method for generating access control strategies for distribution network data assets. Background Art

[0002] The distribution network system under the new power system has a big problem of data circulation security risks due to the many interactive subjects, terminal equipment, and complex interactive environment. However, if the data is not circulated and is only stored in the data pool, it cannot meet the requirements of modern society and realize the intelligent transformation of the distribution system. The data in the distribution system mainly includes remote control, remote communication, telemetry and remote adjustment data. These data have rich application value. Other departments of the power system can adjust their own operation mode according to the data shared within the distribution system. For example, the marketing department can customize the electricity consumption plan and electricity price for different users according to the user data shared by the distribution system. However, there will be many security issues in the process of data sharing. For example, malicious users access to steal data and steal user privacy, and malicious attackers tamper with command information to affect the normal operation of the power system and cause the power system to be paralyzed. To solve these problems, it is necessary to control the user's access to the distribution network data assets and formulate a multi-dimensional and multi-granular access control strategy for data assets.

[0003] Attribute-Based Access Control (ABAC) is a flexible access control model that can determine whether to allow access to a resource based on the attributes of the user, the attributes of the resource, and the attributes of the environment. This makes access control more fine-grained and flexible, has strong semantic expression capabilities, and is compatible with mechanisms such as autonomous access control, mandatory access control, and role-based access control. It is suitable for solving fine-grained access control and large-scale dynamic authorization problems in open computing environments. Many scholars and researchers have conducted in-depth research on the design of the ABAC model, the definition of policy language, and the implementation of access control mechanisms. After comparing machine learning and rule-based attribute extraction methods, Manar et al. used convolutional neural networks in deep learning as access control attribute extraction tools. Convolutional neural networks can well identify attribute information in data, but due to the window size limitation of convolutional neural networks, this method has long-distance dependency problems. Liu Aodi et al. used CNN and BiLSTM neural networks to complete access control policy statement recognition and access control attribute mining in natural language texts to provide support for the generation of readable and executable access control policies.

[0004] At present, deep learning algorithms are widely used in access control, but there are few studies on access control generation methods for distribution network systems. Based on the above background analysis, this patent discloses an access control policy generation method for distribution network data assets, which is used for the formulation and generation of access control policies for distribution network data assets. The main problems to be solved are:

[0005] The distribution network under the new power system faces the problem of weak security protection due to the large number of terminal devices, multiple data types, multiple interactive subjects, and complex interaction methods. For the data assets of the distribution network, multi-dimensional and multi-granular access control is an important means to cope with the diversified development of external services of the power grid under the new power system, the explosive growth of data interaction inside and outside the power grid, at all levels, and among various professions, and the risk of disorderly internal circulation and uncontrolled leakage of data.

[0006] Traditional access control methods are not flexible and cannot meet the access control needs of distribution networks with multiple interactive subjects and complex and changeable structure. Distribution network data assets require a new access control method that can dynamically adjust access control policies. The attribute-based access control mechanism uses attributes as the basic elements for formulating access control rules. It can flexibly use the attribute characteristics of access control requesters and data assets to decide whether to grant access rights. It is suitable for solving fine-grained access control and large-scale dynamic authorization problems in open computing environments.

[0007] The use of a dynamic access control system model can monitor users in real time and dynamically adjust access control policies. Currently, most dynamic access controls use fixed access control policies. After configuration, the access control system will execute this fixed access control policy for a long time. When an abnormality occurs on the user side, it cannot be discovered and adjusted in time, resulting in problems with the user's access behavior and inability to continue access. Summary of the invention

[0008] Based on the above objectives, the present invention provides a method for generating access control policies for distribution network data assets.

[0009] A method for generating access control policies for distribution network data assets comprises the following steps:

[0010] S1: Analyze the access control attributes of distribution network data assets and formulate access control rules based on the logical relationship between access control attributes;

[0011] S2: Establish access control policy generation model based on access control rules;

[0012] S3: Train the access control policy generation model so that corresponding access control rules can be generated when any new user accesses data assets.

[0013] Furthermore, the access control attributes in S1 include subject attributes, object attributes and operation attributes, wherein:

[0014] The subject attributes include access subject level, access subject role and access subject location, specifically including: access subject level is high, medium and low, access subject role is operation and maintenance department, monitoring system, power distribution system and marketing system, access subject location is inside and outside the distribution network;

[0015] The object attributes include data type, data level and data security level, specifically including: data type is instruction data, status data, fault data, power data, electricity consumption data, location information, data level is high, medium and low, data security level is level I, level II, level III and level IV;

[0016] The operation attributes include reading data assets and writing own data into data assets.

[0017] Furthermore, the object attributes are used to determine whether the access requester can access the relevant data, including:

[0018] S11: Based on the data security level, the access level of the access requester outside the distribution network is level I data, and the access level of the access requester inside the distribution network is level II, level III and level IV;

[0019] S12: Based on the data level, the level of the access requester is not lower than the data level of the data asset. For example, a medium-level access requester can only access medium-level and low-level data, and cannot access data above the medium level.

[0020] S13: Based on the data type, each attribute of the data asset's data type corresponds to each attribute of the access requester's role. For example, the monitoring system corresponds to fault information and status information, the operation and maintenance department corresponds to fault information, and the marketing system corresponds to power information, electricity information, and location information. In addition to the restrictions between subject and object attributes, operation attributes will also control access. For example, if the access control requester wants to write instruction information, he must have the power to change the instruction.

[0021] S14: Access control rules are constructed based on the logical relationship between subject attributes, object attributes and operation attributes, as well as the mutual influence relationship. According to the constructed access control rules, access control policies are automatically generated using a deep learning model.

[0022] Furthermore, the access control policy generation model in S2 includes access control entity attribute mining, attribute-authority mining and access control policy description.

[0023] Furthermore, the access control policy generation model is specifically generated as follows:

[0024] S21: The access control attribute mining is performed through a word embedding module, a context encoding module and an inference module, wherein:

[0025] The word embedding module uses the RoBERTa model to preprocess access control text data;

[0026] The context encoding module uses the BiLSTM model for deep semantic analysis;

[0027] The reasoning module consists of Softmax and CRF to complete label generation;

[0028] S22: The attribute clustering uses a K-means algorithm to cluster the generated tag sequence to form an attribute set;

[0029] S23: The attribute-authority relationship mining uses a minimum disturbance authority allocation algorithm to dynamically allocate access rights based on the similarity between the attributes of the new user and the original user;

[0030] S24: The access control policy is described using the XACML description language, and the generated access control policy is described using XACML.

[0031] Furthermore, the S23 specifically includes:

[0032] Determine the access control authority allocation of the original distribution network data assets based on the existing internal data management information of the power grid, and form the original authority allocation;

[0033] When a new user joins, the similarity of the attributes of the new user and the original user is determined to determine the permissions of the new user;

[0034] When the new user is highly similar to the original user, the user is added to the attribute set of the original user that is similar to the new user, and the permissions of the old user are authorized to the new user.

[0035] Furthermore, the training of the access control policy generation model in S3 specifically includes:

[0036] S31: Data annotation, using the OBM tagging scheme to tag the subject (sub), object (obj), and action (act) attributes of access control;

[0037] S32: Model training, inputting the labeled data into the access control attribute mining model for training;

[0038] S33: Generating the original attribute-permission set, inputting the internal data management information of the power grid and the formulated access control rules into the trained model, and using the minimum disturbance permission allocation algorithm to determine the original attribute-permission set;

[0039] S34: Policy description, using XACML language to describe the original permission set determined by the model.

[0040] Furthermore, when the access control strategy generation model is trained, the object attribute set of the distribution network data asset is first mined, and the model further determines the attributes of the original access requester and clarifies the authority allocation;

[0041] When a new access requester joins, the model will automatically mine its subject attributes and compare the similarity with the original attributes, thereby dynamically allocating permissions.

[0042] Beneficial effects of the present invention:

[0043] Based on the characteristics and applications of distribution network data assets, the present invention analyzes the specific contents of subject attributes, object attributes and operation attributes of distribution network data asset access control, and explains the distribution network data asset access control rules.

[0044] The present invention uses a BiLSTM neural network combined with a conditional random field and an improved BERT model to realize the object attribute mining of distribution network data assets and the subject attribute mining of access requesters.

[0045] The present invention uses the minimum disturbance authority allocation algorithm and combines it with the internal data management scheme of the power grid to realize the access control attribute of distribution network data assets - authority mining, ensuring that new access control requesters can obtain the allocation of corresponding authorities when issuing access requests.

[0046] The present invention uses XACML language to implement machine language description of access control strategy. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 A schematic diagram of a method for generating an access control policy according to an embodiment of the present invention;

[0049] Figure 2 A schematic diagram of the workflow of the access control policy generation model according to an embodiment of the present invention;

[0050] Figure 3 A schematic diagram of the basic structure of an access control attribute mining algorithm according to an embodiment of the present invention;

[0051] Figure 4Schematic diagram of the access control policy generation process according to an embodiment of the present invention. DETAILED DESCRIPTION

[0052] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with specific embodiments.

[0053] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the present invention should be understood by people with ordinary skills in the field to which the present invention belongs. The "first", "second" and similar words used in the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0054] like Figure 1-Figure 4 As shown, a method for generating access control policies for distribution network data assets includes the following steps:

[0055] Step 1: Analyze and clarify the access control attributes of distribution network data assets and formulate access control rules

[0056] The subject attributes, object attributes and operation attributes of the distribution network data asset access control are analyzed, and the analysis results are shown in Table 1.

[0057] Table 1. Distribution network data asset access control attributes

[0058]

[0059] For distribution network data assets, subject attributes are the attributes of the access requester, which are divided into three aspects: access subject level, access subject role and access subject location. Specifically, they include: high-level, medium-level and low-level attributes, role attributes such as operation and maintenance department, monitoring system, distribution system, marketing system, and two location attributes: inside and outside the distribution network;

[0060] Object attributes are the attributes of the distribution network data assets themselves, which are divided into three aspects: data type, data level and data security level. Specifically, they include: data type attributes such as instruction data, status data, fault data, power data, power consumption data, location information, three level attributes: high, medium and low, and four security level attributes: level I, level II, level III and level IV.

[0061] Operation attributes are the action attributes of the access requester on the distribution network data assets, including reading data assets and writing its own data into data assets.

[0062] There is a logical relationship between the three access control attributes of distribution network data assets. Different distribution network data assets can determine whether the access control requester can successfully access the relevant data based on their own object attributes.

[0063] From the perspective of data security level, Level I data can be accessed by access requesters outside the distribution network, while Level II, Level III and Level IV data can only be accessed by internal access requesters;

[0064] From the perspective of data level, the level of the access requester should not be lower than the data level of the data asset. For example, a mid-level access requester can only access mid-level and low-level data, and cannot access data above the mid-level level.

[0065] From the data type level, there is a corresponding relationship between the data type attributes of the data asset and the role attributes of the access requester. For example, the monitoring system corresponds to fault information and status information, the operation and maintenance department corresponds to fault information, and the marketing system corresponds to power information, electricity information and location information. In addition to the restrictions between subject and object attributes, operation attributes will also have access control. For example, if the access control requester wants to write instruction information, he must have the power to change the instruction.

[0066] The logical relationship and mutual influence relationship between the subject attributes, object attributes and operation attributes of distribution network data assets can constitute access control rules. Based on the constructed access control rules, deep learning models are used to automatically generate access control policies.

[0067] Step 2: Establish an access control policy generation model

[0068] The access control policy generation model should have three functions: access control entity attribute mining, attribute-authority mining, and access control policy description. There will be correlations between the various attributes of the access control rules, so the present invention selects LSTM neural network as an access control attribute mining clustering tool to generate attribute sets, and uses the generated attribute sets to perform attribute-authority mining and access control policy description.

[0069] The specific process of implementing the distribution network data asset access control strategy generation model is as follows:

[0070] (1) The access control attributes of distribution network data assets are mined. The algorithm consists of three parts: word embedding module, context encoding module and reasoning module to complete the access control rule attribute mining work.

[0071] The word embedding module converts text data containing access control relations into codes to obtain vectors that can describe the meaning of words, laying the foundation for the context encoding module and the reasoning module to function. The RoBERTa used is an improved model of the mainstream pre-trained representation model BERT, which is composed of a Transformer encoder. After the module pre-trains the access control text data, an additional output layer is added. The data processed by this module can have the ability to dynamically represent the deep semantics of the context.

[0072] The context encoding module adopts the most popular BiLSTM context encoding model, which can store historical information and is the most widely used context encoding model today. It comprehensively analyzes information from two time points in the past and the future to generate the hidden state of each word, and then combines them to represent the global information of the entire sequence. There are two LSTMs, forward and reverse. The LSTM in each direction will obtain a hidden state sequence of the data. By adding the hidden state sequences of the two directions, the hidden state information feature representation of the data at each position can be obtained.

[0073] The inference module consists of a Softmax normalization function and a random conditional field (CRF). Its function is to convert the output of the context encoding module into a label sequence, thereby completing the access control attribute mining work. The softmax function is a function that can correspond the hidden state of each time to a vector input. The data of the fully connected neural network is then converted by the softmax function to obtain the probability output of each label of the data. The existence of CRF fills the problem that the softmax function does not consider the dependency relationship between labels, and can achieve a better label sequence output relationship based on the dependency relationship.

[0074] (2) Before performing attribute-authority relationship mining, after the access control attribute mining model generates a label sequence, it is necessary to cluster the generated label sequence into an attribute set to facilitate the subsequent mining of access control attributes based on the attribute set. The present invention uses the K-means clustering method to cluster the label sequence to obtain the access control attribute set.

[0075] (3) After obtaining the access control attribute set, the present invention adopts the minimum disturbance permission allocation algorithm to implement attribute-permission mining. When a new user applies to access the distribution network data assets, the user's access rights can be dynamically allocated. The specific steps are as follows:

[0076] The system determines the access control authority allocation of the original distribution network data assets based on the existing internal data management information of the power grid, and forms the original authority allocation. When a new user joins, the similarity of the attributes of the new user and the original user is judged to determine the authority of the new user. When the new user is highly similar to the original user, the user is added to the attribute set of the original user that is similar to it, and the authority of the old user is authorized to the new user.

[0077] (4) When the attribute-permission allocation is completed, the access control policy can be generated according to the permissions corresponding to different attributes. After the access control policy is generated, the access control policy must be described using a computer language. The present invention uses XACML (Extensible Access Control Markup Language) as the description language. The language is versatile and can adapt to the access control requirements of distribution network data assets.

[0078] Step 3: Train the access control policy generation model

[0079] The access control policy generation model training process is as follows:

[0080] (1) The input data is annotated using the OBM attribute marking scheme. The basis for the annotation is the various attribute types involved in the formulation of access control rules, where B represents the beginning of the access control attribute, M represents the middle part of the access control attribute, and O represents other parts that are not related to the access control attribute. sub represents the subject attribute, obj represents the object attribute, and act represents the operation attribute. For example, "distribution network external access control requesters can only read level I data" becomes " / B-sub: distribution / M-sub: power / M-sub: network / M-sub: external / M-sub: access / M-sub: question / M-sub: control / M-sub: request / M-sub: requester / O: can only / O: B-act: read / M-act: retrieve / B-obj:Ⅰ / M-obj: level / M-obj: data" after annotation;

[0081] (2) After the labeling is completed, the labeled data is sent to the access control attribute mining algorithm for training to realize the automatic labeling function of the input data;

[0082] (3) Input the existing internal data management information of the power grid and the access control rules formulated in step 1 into the trained attribute mining algorithm, determine the access control attributes of the original distribution network data assets, and use the minimum disturbance permission allocation algorithm to determine its permissions, forming an original attribute-permission set;

[0083] (4) The original permission set determined by the model is described using the XACML language to facilitate computer recognition. At this point, the model training is complete and can automatically generate the corresponding access control policy when any new access requester sends a request to the distribution network data asset.

[0084] The above method can not only convert the existing regulations related to access control into machine language described in XACML language, but also automatically identify the attribute characteristics of the access control requester, assign corresponding permissions, and complete the access control function;

[0085] First, the distribution network data assets are taken as input, and after the access control attribute mining model is trained, the object attribute set Object{o1,o2,o3…} carried by the distribution network data assets themselves is obtained;

[0086] Input the existing internal data management information of the power grid and the access control rules formulated in step 1 into the model, determine the subject attribute set of the access requester of the original distribution network data asset, subject{s1,s2,s3…}, and clarify the original control authority allocation, that is, the authority correspondence between the subject attribute and the object attribute: subject→Object. This correspondence is used to describe the access control rules using the XACML language.

[0087] When an access requester A wants to perform access control on the distribution network data assets, the access control attribute mining model established in step 2 will automatically mine A's subject attributes, compare the similarity with the original subject attributes, find the similar original attributes, and grant the permissions of the original attributes to the access control requester, thus completing the entire access control process.

[0088] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present invention is limited to these examples. Under the concept of the present invention, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the present invention as described above, which are not provided in detail for the sake of simplicity.

[0089] The present invention is intended to cover all such substitutions, modifications and variations that fall within the broad scope of the claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for generating access control policies for distribution network data assets, characterized in that: The following steps are involved: S1: Analyze the access control attributes of distribution network data assets and formulate access control rules based on the logical relationship between access control attributes; S2: establishing an access control policy generation model based on access control rules, wherein the access control policy generation model in S2 includes access control attribute mining, attribute-authority mining, and access control policy description; The specific generation is as follows: S21: The access control attribute mining is performed through a word embedding module, a context encoding module and an inference module, wherein: The word embedding module uses the RoBERTa model to preprocess access control text data; The context encoding module uses the BiLSTM model for deep semantic analysis; The reasoning module consists of Softmax and CRF to complete label generation; S22: Use K-means algorithm to cluster the generated tags to form an attribute set; S23: The attribute-authority mining uses a minimum disturbance authority allocation algorithm to dynamically allocate access rights based on the similarity between the attributes of the new user and the original user; S24: The access control policy is described using the XACML description language, and the generated access control policy is described using XACML; S3: Train the access control policy generation model so that corresponding access control rules can be generated when any new user accesses data assets.

2. A method for generating access control policies for distribution network data assets according to claim 1, characterized in that: The access control attributes in S1 include subject attributes, object attributes and operation attributes, where: The subject attributes include access subject level, access subject role and access subject location, specifically including: access subject level is high, medium and low, access subject role is operation and maintenance department, monitoring system, power distribution system and marketing system, access subject location is inside and outside the distribution network; The object attributes include data type, data level and data security level, specifically including: data type is instruction data, status data, fault data, power data, electricity consumption data, location information, data level is high, medium and low, data security level is level I, level II, level III and level IV; The operation attributes include reading data assets and writing own data into data assets.

3. The method for generating access control policies for distribution network data assets according to claim 2, characterized in that: The object attributes are used to determine whether the access requester can access the relevant data, including: S11: Based on the data security level, the access level of the access requester outside the distribution network is level I data, and the access level of the access requester inside the distribution network is level II, level III and level IV; S12: Based on the data level, the level of the access requester is not lower than the data level of the data asset; S13: Based on the data type, each attribute of the data asset's data type corresponds to each attribute of the access requester's role; S14: Access control rules are constructed based on the logical relationship between subject attributes, object attributes and operation attributes, as well as the mutual influence relationship. According to the constructed access control rules, access control policies are automatically generated using a deep learning model.

4. The method for generating access control policies for distribution network data assets according to claim 1, characterized in that: The S23 specifically includes: Determine the access control authority allocation of the original distribution network data assets based on the existing internal data management information of the power grid, and form the original authority allocation; When a new user joins, the similarity of the attributes of the new user and the original user is determined to determine the permissions of the new user; When the new user is highly similar to the original user, the user is added to the attribute set of the original user that is similar to the new user, and the permissions of the old user are authorized to the new user.

5. The method for generating access control policies for distribution network data assets according to claim 4, characterized in that: The training of the access control policy generation model in S3 specifically includes: S31: Data labeling, using the OBM labeling scheme to label the subject, object, and action attributes of access control; S32: Model training: inputting the labeled data into the access control policy generation model for training; S33: Generating the original attribute-permission set, inputting the internal data management information of the power grid and the formulated access control rules into the trained model, and using the minimum disturbance permission allocation algorithm to determine the original attribute-permission set; S34: Policy description, using XACML language to describe the original permission set determined by the model.

6. A method for generating access control policies for distribution network data assets according to claim 5, characterized in that: When the access control strategy generation model is trained, the object attribute set of the distribution network data asset is first mined, and the model further determines the attributes of the original access requester and clarifies the authority allocation; When a new access requester joins, the model will automatically mine the subject attributes of the new access requester and compare the similarity with the original attributes to dynamically allocate permissions.

Images