Data security protection method, device and industrial system based on 1+N architecture

Abstract

The present invention relates to the field of intelligent manufacturing technology, and specifically discloses a data security protection method, device, and industrial system based on a 1+N architecture, including: obtaining user login information after being processed by an infrastructure security protection layer, and performing user login authentication processing and first interface request authentication processing on the user login information, wherein the user login authentication processing at least includes the first basic service security protection layer processing and the first platform application security protection layer processing performed on the user login information in sequence, and the first interface request authentication processing at least includes the second basic service security protection layer processing performed on the user login information; when the user logs in successfully, obtaining user data access request information, and performing second interface request authentication processing on the user data access request information. The data security protection method provided by the present invention can realize data security protection under a 1+N architecture.

Description

Technical Field

[0001] The present invention relates to the field of intelligent manufacturing technology, and in particular to a data security protection method, a data security protection device, and an industrial system based on a 1+N architecture. Background Art

[0002] The manufacturing industry is undergoing unprecedented changes, with increasingly obvious trends towards automation, networking and intelligence. Against this backdrop, industrial systems based on the 1+N architecture have gradually become mainstream, where "1" represents the core industrial base (industrial APP low-code development platform) and "N" represents a variety of industrial applications and services. However, this highly integrated and interconnected system also brings severe security challenges. In addition, core industrial applications for some special scenarios with strict confidentiality requirements need to strictly follow the principles of national information system security classification protection to ensure the confidentiality, integrity and availability of data. Therefore, the security and data protection issues of the industrial base have become key factors restricting the development of industrial intelligence.

[0003] There are many industrial base security reinforcement technologies on the market, such as hardware encryption, software firewalls, intrusion detection systems, etc. to enhance the system's defense capabilities. However, most of these technologies are aimed at a single system or component, and focus on the hardware control level, lacking a comprehensive consideration of overall security under the 1+N architecture. In the process of data transmission and storage, encryption technology is widely used to ensure data confidentiality. However, with the explosive growth of industrial data and the complexity of transmission paths, how to ensure data security while ensuring efficiency has become a technical problem. In addition, data backup, disaster recovery and other technologies are also important components of data security protection.

[0004] Therefore, how to achieve data security protection under the 1+N architecture has become a technical problem that needs to be urgently solved by technical personnel in this field. Summary of the invention

[0005] The present invention provides a data security protection method, a data security protection device and an industrial system based on a 1+N architecture, which solve the problem of data security risks in industrial systems existing in related technologies.

[0006] As a first aspect of the present invention, a data security protection method is provided, which includes:

[0007] Obtain user login information after being processed by the infrastructure security protection layer, and perform user login authentication processing and first interface request authentication processing on the user login information, wherein the user login authentication processing at least includes the first basic service security protection layer processing and the first platform application security protection layer processing performed on the user login information in sequence, the first interface request authentication processing at least includes the second basic service security protection layer processing performed on the user login information, the infrastructure security protection layer includes at least user authority protection and user login information complexity protection, the first basic service security protection layer includes at least confidentiality authentication protection, the first platform application security protection layer includes at least identity authentication protection, the second basic service security protection layer includes at least login interface authentication, service interface authority authentication and identity validity authentication; the user login information includes at least a login interface, a login account and a login password;

[0008] When the user logs in successfully, the user data access request information is obtained, and the second interface request authentication processing is performed on the user data access request information, wherein the second interface request authentication processing at least includes the second platform application security protection layer processing of the user data access request information, and the second platform application security protection layer at least includes data access control protection, data confidentiality level control protection and data output control protection.

[0009] Furthermore, the user login authentication processing of the user login information includes:

[0010] When the login interface authentication is passed, the first basic service security protection layer and the first platform application security protection layer verify the validity of the login account and the correctness of the login password according to the preset account policy, and verify the confidentiality compliance of the login account and the login password according to the preset login information authentication rules;

[0011] If the validity of the login account, the correctness of the login password and the confidentiality compliance of the two are verified, a prompt message indicating successful authentication is returned, otherwise a prompt message indicating failed authentication is returned.

[0012] Further, when the login interface authentication is passed, the first basic service security protection layer and the first platform application security protection layer verify the validity of the login account and the correctness of the login password according to the preset account policy, and verify the confidentiality compliance of the login account and the login password according to the preset login information authentication rules, including:

[0013] Determine whether the login account is a Xiaosanyuan application account, where the Xiaosanyuan application includes at least production management, equipment management, process management, and energy management;

[0014] If the login account is a junior member application account, the correctness of the login password is verified according to the preset junior member account password information;

[0015] If the login password of the Xiaosanyuan application account is successfully verified, the Dasanyuan platform account mapped to the Xiaosanyuan application account is obtained, wherein the Dasanyuan platform at least includes an industrial system based on a 1+N architecture;

[0016] Verify the validity of the login information of the Dasanyuan platform account, wherein the validity of the login information of the Dasanyuan platform account includes at least user management authentication, account policy authentication and confidentiality parameter authentication;

[0017] If the correctness verification of the login password of the Xiaosanyuan application account fails, the validity of the login information of the login account is verified, and the correctness of the login password corresponding to the login account is verified;

[0018] If the login information validity verification of the Dasanyuan platform account passes, or the validity verification of the login account and the correctness verification of the login password corresponding to the login account pass, then the encrypted token information with the user information is returned, otherwise the prompt information of authentication failure is returned;

[0019] Among them, the small three-member application and the big three-member platform both include their own independent three-member account information and corresponding password information. The three-member account information includes system administrator account information, security designer account information and security and confidentiality officer account information. The three-member account information in the small three-member application all corresponds to virtual users, and the three-member account information in the small three-member application can be mapped to the three-member account information of the big three-member platform.

[0020] Further, performing a first interface request authentication process on the user login information includes:

[0021] Acquire user interface request information, where the user interface request information includes at least an internal portal request and a heterogeneous system external call interface request;

[0022] Determining whether the user interface request information is an internal portal request;

[0023] If the user interface request information is an internal portal request, performing interface authentication on the login interface at the second basic service security protection layer;

[0024] If the interface request information is a request for an external interface call of a heterogeneous system, the login interface is called, and the account information preset by the heterogeneous system is obtained to perform login interface authentication at the second basic service security protection layer;

[0025] When the login interface authentication is passed, the encrypted token information is decrypted and the validity of the decrypted token information is authenticated;

[0026] If the validity authentication of the decrypted token information is passed, it is determined that the user has logged in successfully;

[0027] If the validity authentication of the decrypted token information fails, a prompt message indicating that the user login was unsuccessful is returned.

[0028] Further, performing interface authentication on the login interface at the second basic service security protection layer, and obtaining account information preset by the heterogeneous system to perform login interface authentication at the second basic service security protection layer, both include:

[0029] Compare the interface access path in the login interface with the preset access path in the interface whitelist;

[0030] If the interface access path in the login interface is in the interface whitelist, further verification prompt information is returned, and the further verification prompt information carries application number information;

[0031] If the interface access path in the login interface is not in the interface whitelist, a prompt message indicating that the interface authentication failed is returned, and the prompt message indicating that the interface authentication failed carries token information and application number information.

[0032] Further, performing a second interface request authentication process on the user data access request information includes:

[0033] Determine whether the user data access request information is for internal application access, wherein the user data access request information includes internal application access and heterogeneous system application access;

[0034] If the user data access request information is for internal application access, data access control is performed on the user data access request information according to data access authorization rules, wherein the data access authorization rules at least include form authorization, process authorization and user organization role authorization;

[0035] Performing data output control on user data access request information according to data confidentiality control rules and interface authorization rules, wherein the data confidentiality control rules at least include user confidentiality, data confidentiality and file confidentiality;

[0036] Returns the visible data information under the user's permission.

[0037] Furthermore, if the user data access request information is for heterogeneous system application access, single sign-on authentication is performed on the user according to the user data access request information, and then second interface request authentication is performed in the manner of internal application access.

[0038] Further, after performing single sign-on authentication processing on the user according to the user data access request information, performing second interface request authentication processing in the manner of internal application access includes:

[0039] Determining whether the current user has access rights to the current heterogeneous system according to the user data access request information;

[0040] If the current user has access rights to the current heterogeneous system, the single-point preset information including the entry information is returned to the portal;

[0041] Receiving single sign-on path acquisition interface request information from the portal end, wherein the single sign-on path acquisition interface request information at least includes the single sign-on preset information;

[0042] The login interface is called according to the interface request information obtained by the single sign-on path, and the account information preset by the heterogeneous system is obtained to perform login interface authentication in the second basic service security protection layer;

[0043] If the login interface authentication is passed, it is determined that the single sign-on path acquisition interface request is successful, and the request success result information is returned to the portal. The request success result information includes at least temporary verification information of timeliness and the heterogeneous system access path carrying entry information. The portal can access the heterogeneous system based on the heterogeneous system access path and the temporary verification information of timeliness.

[0044] As another aspect of the present invention, a data security protection device is provided, which is used to implement the data security protection method described above, and includes:

[0045] A login protection module, used to obtain user login information after being processed by the infrastructure security protection layer, and perform user login authentication processing and first interface request authentication processing on the user login information, wherein the user login authentication processing at least includes the first basic service security protection layer processing and the first platform application security protection layer processing performed on the user login information in sequence, the first interface request authentication processing at least includes the second basic service security protection layer processing performed on the user login information, the infrastructure security protection layer includes at least user authority protection and user login information complexity protection, the first basic service security protection layer includes at least confidentiality authentication protection, the first platform application security protection layer includes at least identity authentication protection, the second basic service security protection layer includes at least login interface authentication, service interface authority authentication and identity validity authentication; the user login information includes at least a login interface, a login account and a login password;

[0046] A data access protection module is used to obtain user data access request information after the user logs in successfully, and perform a second interface request authentication process on the user data access request information, wherein the second interface request authentication process at least includes a second platform application security protection layer processing on the user data access request information, and the second platform application security protection layer includes at least data access control protection, data confidentiality level control protection and data output control protection.

[0047] As another aspect of the present invention, an industrial system based on a 1+N architecture is provided, which includes: a portal end, a server end and multiple application ends, the server end includes the data security protection device mentioned above, and the portal end and the multiple application ends are all communicatively connected to the server end.

[0048] The data security protection method provided by the present invention implements layered protection of user login information through protection processing based on the infrastructure security protection layer, the first basic service security protection layer, the second basic service security protection layer and the first platform application security protection layer when the user logs in, thereby ensuring the security of the industrial system during the user login process; in addition, data protection processing is performed on the second platform application security protection layer for the data access process after the user login is successful, which can also ensure the security of the industrial system during the data access process. Therefore, the data security protection method provided by the present invention can ensure data security protection under the 1+N architecture and improve the data security of the industrial system. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the present invention, but do not constitute a limitation of the present invention.

[0050] Figure 1A flow chart of the data security protection method provided by the present invention.

[0051] Figure 2 A schematic diagram of the overall architecture of an industrial system based on a 1+N architecture provided by the present invention.

[0052] Figure 3 A schematic diagram of security and confidentiality protection and data security control of an industrial system based on a 1+N architecture provided by the present invention.

[0053] Figure 4 This is a flow chart of the user login authentication process provided by the present invention.

[0054] Figure 5 This is a flow chart for verifying a login account and a login password after the login interface provided by the present invention has passed authentication.

[0055] Figure 6 This is a schematic diagram of the three-member management model provided by the present invention.

[0056] Figure 7 A flow chart of a method for processing a first interface request authentication provided by the present invention.

[0057] Figure 8 A flow chart of a method for second interface request authentication processing provided by the present invention.

[0058] Fig. 9 A schematic diagram of the registration process of the heterogeneous system access platform interface provided by the present invention.

[0059] Fig.10 A flowchart of a specific method for single sign-on authentication during heterogeneous system application access provided by the present invention.

[0060] Fig.11 This is a timing diagram of the single sign-on authentication process provided by the present invention.

[0061] Fig.12 This is a structural block diagram of the data protection device provided by the present invention.

[0062] Fig.13 This is a structural block diagram of an industrial system based on a 1+N architecture provided by the present invention.

[0063] Fig.14 This is an application architecture diagram of an industrial system based on a 1+N architecture provided by the present invention.

[0064] Fig.15 A schematic diagram of a user login authentication process in an industrial system based on a 1+N architecture provided by the present invention.

[0065] Fig.16 A schematic diagram of an interface request authentication process in an industrial system based on a 1+N architecture provided by the present invention. DETAILED DESCRIPTION

[0066] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0067] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is only a part of the embodiment of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work should fall within the scope of protection of the present invention.

[0068] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so as to describe the embodiments of the present invention described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0069] In this embodiment, a data security protection method is provided. Figure 1 is a flow chart of a data security protection method provided according to an embodiment of the present invention. Figure 1 As shown, including:

[0070] S100. Obtain user login information after being processed by the infrastructure security protection layer, and perform user login authentication processing and first interface request authentication processing on the user login information, wherein the user login authentication processing at least includes the first basic service security protection layer processing and the first platform application security protection layer processing performed on the user login information in sequence, the first interface request authentication processing at least includes the second basic service security protection layer processing performed on the user login information, the infrastructure security protection layer includes at least user authority protection and user login information complexity protection, the first basic service security protection layer includes at least confidentiality authentication protection, the first platform application security protection layer includes at least identity authentication protection, the second basic service security protection layer includes at least login interface authentication, service interface authority authentication and identity validity authentication; the user login information includes at least a login interface, a login account and a login password;

[0071] In the embodiment of the present invention, Figure 2 and Figure 3 As shown, the industrial system based on the 1+N architecture may specifically include a portal end, a server end, and multiple application ends. Three layers of security protection are set on the server end to implement encryption protection processing of data to improve data security. Among them, the first layer of security protection is specifically the infrastructure security protection layer, the second layer of security protection specifically includes the first basic service security protection layer and the second basic service security protection layer, and the third layer of security protection specifically includes the first platform application security protection layer and the second platform application security protection layer.

[0072] Specifically, the user can fill in the user login information through the portal, and then the portal sends the user login information to the server. The user login information is processed by the infrastructure security protection layer before entering the server. The specific infrastructure security protection layer can set corresponding security protection measures, such as user authority restrictions and account password complexity restrictions, etc. After passing through the infrastructure security protection layer, the specific access URL can be obtained.

[0073] Access the login page of the industrial system according to the access URL, that is, enter the login account and password through the portal.

[0074] Visit the login page of the industrial application according to the access URL, and select the login method on the login page. The current login supports user password authentication, CA authentication, and USB key authentication. After filling in the login information and submitting it, the server will automatically perform Base64 encoding and encryption on the key information in the first basic service security protection layer, and call the login authentication interface to perform the first interface request authentication processing, and transmit the information to the authentication center service on the server through the http protocol.

[0075] After receiving the account and password information, the authentication center service on the server side will verify the validity of the account and the correctness of the password in combination with the settings in the account policy. At the same time, it will verify whether the IP address is bound, the correctness of the IP address, and the compliance of the confidentiality level in combination with the setting rules in the confidentiality parameter configuration.

[0076] After the above verification is passed, the login is determined to be successful, and the encrypted token information carrying the user information is returned to the login page.

[0077] It should be understood that after a successful login, the login interface needs to be authenticated, specifically for requests from the internal portal or external heterogeneous systems, to ensure the security of subsequent data access. Specifically, the validity and timeliness of the token information can be verified. After the verification is passed, it can be determined that the interface authentication is successful.

[0078] It should be noted that when the interface request is successful, information with an application number will be returned. The application number is the unique identifier of each application in the industrial system. Before the interface request, both the internal application end and the application end of the heterogeneous system need to register with the authentication center of the server to generate the key of each application service for the authentication of the interface usage rights between services.

[0079] S200. When the user logs in successfully, obtain user data access request information, and perform a second interface request authentication process on the user data access request information, wherein the second interface request authentication process at least includes a second platform application security protection layer processing on the user data access request information, and the second platform application security protection layer at least includes data access control protection, data confidentiality level control protection and data output control protection.

[0080] In the embodiment of the present invention, when the user logs in successfully, the user can access the data through the portal. At this time, the server needs to request authentication processing through the second interface for the obtained user data access request information to ensure the security of access.

[0081] Specifically, when the user accesses the interface after successful login, it is necessary to apply a security protection layer on the second platform to control data access. Specifically, data access control can be performed based on various authorization rules such as form authorization, process authorization, user organization role authorization, etc. At the same time, data confidentiality level control can be performed in combination with user confidentiality level, data confidentiality level, and file confidentiality level. In addition, data output control can be performed on the output data in combination with interface authorization rules, and finally the visible data information under the user's authority is returned.

[0082] In summary, the data security protection method provided by the present invention implements layered protection of user login information through protection processing based on the infrastructure security protection layer, the first basic service security protection layer, the second basic service security protection layer and the first platform application security protection layer when the user logs in, thereby ensuring the security of the industrial system during the user login process; in addition, data protection processing is performed on the second platform application security protection layer for the data access process after the user login is successful, which can also ensure the security of the industrial system during the data access process. Therefore, the data security protection method provided by the present invention can ensure data security protection under the 1+N architecture and improve the data security of the industrial system.

[0083] In an embodiment of the present invention, after the authentication center service on the server side receives the login account and login password information, it will verify the validity of the login account and the correctness of the login password in combination with the settings in the account policy; at the same time, it will verify whether the IP address is bound, the correctness of the IP address, and the compliance of the confidentiality level in combination with the setting rules in the confidentiality parameter configuration.

[0084] Specifically, the user login information is processed for user login authentication, such as Figure 4 As shown, including:

[0085] S110. When the login interface authentication is passed, the first basic service security protection layer and the first platform application security protection layer verify the validity of the login account and the correctness of the login password according to the preset account policy, and verify the confidentiality compliance of the login account and the login password according to the preset login information authentication rules;

[0086] It should be noted that when authenticating the login interface, the authentication center first determines whether the login interface is in the whitelist based on the interface and parameter information transmitted by the http protocol, and compares the received interface access path with the preset access path in the whitelist. If it is not in the whitelist, the request result will be returned, indicating that the login failed; if it is in the whitelist, the next step of verification will be carried out.

[0087] Specifically, after the login interface authentication is passed, the first basic service security protection layer and the first platform application security protection layer verify the validity of the login account and the correctness of the login password according to the preset account policy, and verify the confidentiality compliance of the login account and login password according to the preset login information authentication rules, such as Figure 5 As shown, including:

[0088] S111, determining whether the login account is a Xiaosanyuan application account, where the Xiaosanyuan application at least includes production management, equipment management, process management, and energy management;

[0089] It should be understood that after the above whitelist verification is passed, the account information in the parameter will be judged whether it is a Xiaosanyuan application account login. If it is a Xiaosanyuan application account, it is necessary to match the information according to the preset three-member account password information in the application management. It should be noted here that all password information in the industrial system is MD5 encrypted with certain rules. For the verification of the validity of user account information, it can only be verified by mixing the parameter information according to the rules to generate an MD5-related encrypted string and matching it with the preset information.

[0090] S112. If the login account is a junior member application account, verify the correctness of the login password according to the preset junior member account password information;

[0091] In an embodiment of the present invention, after the Xiaosanyuan application account and password information are successfully matched, the mapped Dasanyuan platform account information will be obtained, and the next step of login information validity verification will be performed. During the login information validity verification, the password correctness will no longer be checked.

[0092] S113. If the correctness of the login password of the Xiaosanyuan application account is successfully verified, then the Dasanyuan platform account mapped to the Xiaosanyuan application account is obtained, wherein the Dasanyuan platform at least includes an industrial system based on a 1+N architecture;

[0093] S114, verifying the validity of the login information of the Dasanyuan platform account, wherein the login information validity verification of the Dasanyuan platform account at least includes user management authentication, account policy authentication and confidentiality parameter authentication;

[0094] S115. If the correctness verification of the login password of the junior member application account fails, the validity of the login information of the login account is verified, and the correctness of the login password corresponding to the login account is verified;

[0095] It should be noted that if the account information is judged not to be a login account of a junior member application, the validity of the login information is directly verified. Here, the correctness of the login password needs to be verified. The verification method of the login password is the same as the password verification method in step S111, both of which are through information database matching.

[0096] S116. If the login information validity verification of the Dasanyuan platform account passes, or the validity verification of the login account and the correctness verification of the login password corresponding to the login account pass, then the encrypted token information with the user information is returned, otherwise the prompt information of authentication failure is returned;

[0097] Among them, the small three-member application and the big three-member platform both include their own independent three-member account information and corresponding password information. The three-member account information includes system administrator account information, security designer account information and security and confidentiality officer account information. The three-member account information in the small three-member application all corresponds to virtual users, and the three-member account information in the small three-member application can be mapped to the three-member account information of the big three-member platform.

[0098] It should be noted that, in the embodiment of the present invention, the three-member management can play a vital role in the security and confidentiality protection and data security control of the industrial system based on the 1+N architecture of the embodiment of the present invention. Figure 6 The figure shows a schematic diagram of the three-member management mode of an industrial system based on the 1+N architecture.

[0099] according to Figure 6 As shown in the figure, in the current industrial system, each application end can set up independent three-member accounts and password information, including system administrator, security designer, and security officer. The three-member accounts set up on each application end are virtual users, which are ultimately mapped to the three-member users corresponding to the industrial system.

[0100] It should be understood that the three-member management login authentication process in the embodiment of the present invention is the same as step S110 and step S120, and the interface request authentication process after login can be the same as the process of performing the first interface request authentication processing on the user login information in the embodiment of the present invention.

[0101] During login verification, login authentication is performed through the independent three-member account and password set up on each application end. During the login verification process, when verifying the validity of the login information, the preset authentication rules are actually the settings for the three members of the platform. The verification during the subsequent interface call process is also the final platform three-member permission settings. In this way, the three-member accounts of each application end have unified security and confidentiality protection, that is, data security control setting rules, which ensures the independence of each application evaluation management, and also ensures the security and compliance of the data.

[0102] S120. If the validity of the login account, the correctness of the login password, and the confidentiality compliance of both are verified, a prompt message indicating successful authentication is returned; otherwise, a prompt message indicating failed authentication is returned.

[0103] In the embodiment of the present invention, when verifying the validity of the login information, the authentication rules preset in the user management, account policy, and confidentiality parameters will be authenticated in sequence. The user management authentication rules include whether the account is enabled, whether the account is locked, whether the password is correct, whether the IP is correct, and whether the confidentiality level is unauthorized; the account policy authentication rules include whether the password is expired, the number of account locks, and the account lock duration; the confidentiality parameter authentication rules include whether the system is confidential, whether the IP is bound, whether the confidentiality level is verified, and whether the account policy is enabled. It should be specially noted here that if the password authentication fails, the number of password locks and the lock time will be recorded, so as to serve as a basis for verifying the number of account locks and the account lock duration during the next login authentication.

[0104] It should be noted that after the authentication is completed, the request result will be returned regardless of whether the authentication is successful or not. The request result refers to the RESTful interface specification, returns prompt information, and uses the HTTP status code to indicate the request result.

[0105] In addition, in the embodiment of the present invention, the entire process of login authentication will record the operation log through the log service, and can be queried and viewed in the log management module. All operation processes and calls between interfaces will be logged, and the logs will be collected, stored, queried and analyzed through the ELK log solution. The log record includes the following attribute information: user name, IP address, operation object, operation time, operation content, operation result (success or failure), event level, etc. The system function log is a log that records the behavior of ordinary users, and is audited by the security officer; the system management log is a log that records the behavior of the system administrator, and is audited by the security auditor; the security management log is a log that records the behavior of the security officer, and is audited by the security auditor; the security audit log is a log that records the behavior of the security auditor, and is audited by the security officer.

[0106] In the embodiment of the present invention, when the user login information is authenticated, the user will enter the corresponding workbench and need to initialize the data display information related to the logged-in user. The portal carries the token information, interface information, and interface parameter information after the successful login authentication to access the backend service. Therefore, the user login information is authenticated by the first interface request, such as Figure 7 As shown, specifically including:

[0107] S130, obtaining user interface request information, where the user interface request information at least includes an internal portal request and a heterogeneous system external call interface request;

[0108] It should be noted that the interface request in the embodiment of the present invention can have two sources, one is the request from the internal portal, and the other is the external call from the heterogeneous system. Regardless of the source of the interface, it will follow the RESTful interface specification and be transmitted to the backend service through the http protocol.

[0109] For internal portal requests, they will first be intercepted by the portal interceptor, and the portal whitelist will be judged, and the received interface access path will be compared with the preset access path in the whitelist. If it is not in the whitelist, the token information and application number information will be carried in the request; if it is in the whitelist, only the application number information will be carried in the request.

[0110] For external call interface requests of heterogeneous systems, you need to call the login interface to obtain the account information preset for the heterogeneous system for login interface authentication, which can be implemented by referring to the above login interface authentication method. After obtaining the corresponding token information, carry the preset application number of the heterogeneous system in the request.

[0111] S140, determining whether the user interface request information is an internal portal request;

[0112] S150: If the user interface request information is an internal portal request, perform interface authentication on the login interface at the second basic service security protection layer;

[0113] S160: If the interface request information is a heterogeneous system external call interface request, call the login interface, and obtain the account information preset by the heterogeneous system to perform login interface authentication in the second basic service security protection layer;

[0114] S170, when the login interface authentication is passed, decrypt the encrypted token information and authenticate the validity of the decrypted token information;

[0115] S180. If the validity authentication of the decrypted token information is passed, it is determined that the user login is successful;

[0116] S190. If the validity authentication of the decrypted token information fails, a prompt message indicating that the user login was unsuccessful is returned.

[0117] In an embodiment of the present invention, performing interface authentication on the login interface at the second basic service security protection layer, and obtaining account information preset by the heterogeneous system to perform login interface authentication at the second basic service security protection layer, both include:

[0118] Compare the interface access path in the login interface with the preset access path in the interface whitelist;

[0119] If the interface access path in the login interface is in the interface whitelist, further verification prompt information is returned, and the further verification prompt information carries application number information;

[0120] If the interface access path in the login interface is not in the interface whitelist, a prompt message indicating that the interface authentication failed is returned, and the prompt message indicating that the interface authentication failed carries token information and application number information.

[0121] In the embodiment of the present invention, the validity and timeliness of the token will first be verified by the authentication center service in the platform service. Only after the verification is passed can the formal interface access be entered. Specifically, the server first determines whether the login interface is in the whitelist according to the interface and parameter information transmitted by the http protocol, and compares the received interface access path with the preset access path in the whitelist. If it is not in the whitelist, the request result will be returned, prompting that the login failed; if it is in the whitelist, the next step of verification will be performed. After the whitelist verification is passed, the token information will be decrypted. After the token decryption is completed, the login account information will be obtained, and the validity of the token will be authenticated. It should be noted that the token validity authentication here includes whether the login has timed out, whether the account is valid, whether the unique number of the application and the key information match, etc. After the authentication is passed, the interface in the corresponding platform service will be entered to perform related operations such as data acquisition. If the authentication fails, the interface request result is directly returned. The request result refers to the Restful interface specification, and the prompt information is returned, and the HTTP status code is used to indicate the result of the request.

[0122] It should be noted that once the interface authentication is passed, the interface can be accessed. During the interface access process, the acquisition of data requires user information, and data access control is performed according to various authorization rules such as form authorization, process authorization, user organization role authorization, etc. At the same time, data confidentiality control is performed in combination with user confidentiality, data confidentiality, and file confidentiality, and data output control is performed on the output data in combination with the interface authorization rules, and finally the visible data information under the user's authority is returned.

[0123] In the embodiment of the present invention, the second interface request authentication process is performed on the user data access request information, such as Figure 8 As shown, it may specifically include:

[0124] S210, determining whether the user data access request information is for internal application access, the user data access request information including internal application access and heterogeneous system application access;

[0125] S220: If the user data access request information is for internal application access, data access control is performed on the user data access request information according to data access authorization rules, wherein the data access authorization rules at least include form authorization, process authorization, and user organization role authorization;

[0126] S230, performing data output control on the user data access request information according to the data confidentiality control rules and the interface authorization rules, wherein the data confidentiality control rules at least include user confidentiality, data confidentiality and file confidentiality;

[0127] S240: Return the visible data information under the permission to the user.

[0128] Specifically, after the interface is authenticated by the authentication center, the corresponding data can be obtained according to the preset rules. The rules here are mainly divided into application security rules and data security rules. Application security rules can include form authorization, process authorization, user organization role management, and data integration security; data security includes confidentiality control, data access control, data storage control, data modification control, data output control, data flow control, and data destruction control.

[0129] Specifically, the application security rule setting process, that is, the configuration and implementation process of the industrial system, combines the data modeling, form modeling, and process modeling in the platform to form the business function points under the application. During the configuration process, the data can be divided into horizontal and vertical permissions, including field permissions, viewable data permissions, attachment upload and download permissions, data editing and modification permissions, etc., to support viewing different forms at different process nodes, displaying different information, and different operation permissions for different node data.

[0130] In the application security rule settings, the priority of form design permissions is: form design attribute permissions > form design field permissions > process node form permissions > form confidentiality control permissions, that is, the highest priority is the form confidentiality control permissions.

[0131] In the application security rule settings, the priority of form list permissions is: form list permissions > menu permissions > form confidentiality control permissions, that is, the highest priority is the form confidentiality control permission. The permissions of the form list here include list display fields, query fields, sort fields, buttons and other permission controls.

[0132] When the application security rules are set, they will be stored in the database in Json format. When the server interface obtains relevant data, it will parse and form the permission matrix data according to the above preset application security rules, and combine the confidentiality parameter settings and user management related settings in the authentication rules to control the confidentiality level, data access control, data storage control, data modification control, data output control, data flow control, data destruction control, etc. of the data. Finally, the data information under the user's authority will be output.

[0133] It should be noted that the confidentiality level control in the embodiment of the present invention mainly includes three confidentiality levels, namely user confidentiality level, file confidentiality level, and data confidentiality level. User confidentiality levels generally include: non-confidential, general, important, and core; file confidentiality levels generally include: non-confidential, internal, ordinary commercial secrets, core commercial secrets, secret, and confidential; data confidentiality levels generally include: non-confidential, internal, ordinary commercial secrets, core commercial secrets, secret, and confidential. The division of the three confidentiality levels will be slightly different depending on the high-end equipment manufacturing unit.

[0134] In the present invention, different values ​​are assigned to each level of confidentiality. The larger the value, the higher the confidentiality level. This makes it easy to control the confidentiality level by the value. After the interface data is acquired, the requested data information will be returned according to the Restful interface specification.

[0135] In the above interface request of the embodiment of the present invention, the application number is the unique identifier of each application end in the industrial system of the embodiment of the present invention. That is, before the interface request, whether it is an internal application or an external heterogeneous system, it needs to be registered in the service registration function and application registration function under the authentication center service, and the key of each application service is generated for the authentication of the interface usage authority between services.

[0136] If the internal interface is accessed directly from outside, the user login authentication process described above needs to be combined with the interface request authentication process described above to obtain data. The above interface request authentication process describes the access security control process for all data, which belongs to the second-layer data security protection and the third-layer application security protection security management and control.

[0137] Heterogeneous systems have complete data integration security control for accessing internal interfaces. Fig. 9 The schematic diagram of the registration process of heterogeneous systems accessing the industrial system interface in the industrial system shown is as follows:

[0138] 1) Register heterogeneous system services through the platform's service registration function. The registration information includes application name, application number, key, and token validity period. The application number and key are mainly used to obtain token information through the interface and are also used to authenticate the validity of the interface.

[0139] 2) After the service registration is completed, if the heterogeneous system needs to perform single sign-on, it is necessary to register the application for the homepage of the industrial system single sign-on, that is, the homepage entered after the subsystem single sign-on. The content of the application registration includes: application name, application number, PC access path, mobile access path, icon, parameters, etc. Here is the rule preset for the single sign-on of the heterogeneous system homepage, and the specific single sign-on process will be described in detail later.

[0140] 3) For heterogeneous systems, if some functional points need to be made into quick entries on the workbench, quick entry registration is required. Quick entry registration information includes: application information, quick entry name, quick entry number, PC access path, mobile access path, icon, parameters, etc. Here are the rules for single sign-on of internal functions of heterogeneous systems. The specific single sign-on process will be described in detail later.

[0141] 4) After the heterogeneous system registration is completed, you can create the account information of the heterogeneous system.

[0142] 5) Assign relevant data permissions to account information of heterogeneous systems.

[0143] 6) The heterogeneous system obtains token information based on the encrypted string of the service number and key, and makes an interface request.

[0144] The entire process of the interface call will record the operation log through the log service, and can be queried and viewed in the log management module.

[0145] In the embodiment of the present invention, if the user data access request information is for heterogeneous system application access, single sign-on authentication is performed on the user according to the user data access request information, and then second interface request authentication is performed in the manner of internal application access.

[0146] More specifically, after performing single sign-on authentication processing on the user according to the user data access request information, performing second interface request authentication processing in the manner of internal application access, such as Fig.10 As shown, including:

[0147] S251, judging whether the current user has access rights to the current heterogeneous system according to the user data access request information;

[0148] S252: If the current user has access rights to the current heterogeneous system, the single-point preset information including the entry information is returned to the portal end;

[0149] S253, receiving single sign-on path acquisition interface request information from the portal end, wherein the single sign-on path acquisition interface request information at least includes the single sign-on preset information;

[0150] S254, calling the login interface according to the single sign-on path acquisition interface request information, and obtaining the account information preset by the heterogeneous system to perform login interface authentication in the second basic service security protection layer;

[0151] S255. If the login interface authentication is passed, it is determined that the single sign-on path acquisition interface request is successful, and the request success result information is returned to the portal end. The request success result information at least includes temporary verification information of timeliness and the heterogeneous system access path carrying entry information. The portal end can access the heterogeneous system according to the heterogeneous system access path and the temporary verification information of timeliness.

[0152] Combine the following Fig.11 , the specific implementation process of single sign-on authentication in the embodiment of the present invention is described in detail.

[0153] When entering the various application terminals of the industrial system on the same portal, for the internal application terminal, the data of the corresponding application terminal can be obtained and displayed directly through the interface request authentication process described in the previous article; for the external heterogeneous system registered in the application terminal of the current industrial system, it is necessary to pass the single sign-on authentication process to authenticate and log in before entering the display page of the heterogeneous system application terminal.

[0154] It should be noted here that heterogeneous systems need to be registered before single sign-on operation. Fig. 9 The schematic diagram of the registration process of the heterogeneous system access platform interface of the industrial system is shown. The specific registration content description can refer to the above. In the embodiment of the present invention, the single sign-on of the application entrance and the quick entrance adopts the same set of principles.

[0155] Click the application entry or quick entry in the portal to perform single sign-on. The front end will carry the application number (clientID) and quick entry number (funId) corresponding to the application entry or quick entry, and combine them into the application / quick entry information acquisition interface request of the Restful rule, which is transmitted to the background service through the http protocol.

[0156] In an embodiment of the present invention, the execution process of the interface request for obtaining application entry or quick entry information is the same as the interface request authentication process described above. After the interface successfully obtains data, the return result is transmitted to the front-end service via the http protocol. The return result includes whether the current user has the authority to access the third-party system. If there is no authority, the operation is automatically terminated, and a prompt is prompted that there is no operation authority. If there is authority, the return information includes the single-point preset information of the application entry or quick entry, and the single-point sign-on path acquisition interface request is automatically carried out with this information. The single-point sign-on path acquisition interface request carries the single-point preset information of the application entry or quick entry to combine into a Restful rule, which is transmitted to the background service via the http protocol. The execution process of the interface request is the same as the interface request authentication process described above.

[0157] When the single sign-on path acquisition interface request is successful, the return result is transmitted to the front-end service via the http protocol. The return result includes temporarily generated time validity temporary verification information, such as ticket information. The default validity period of the ticket information is 10 minutes, which is the encrypted information of the current user. The return result also includes the access path of the application entry or quick entry, which is the access path in the heterogeneous system corresponding to the application entry or quick entry.

[0158] Through the HTTP protocol transmission, the front end obtains the heterogeneous system access path and carries the ticket information to automatically access the heterogeneous application system. The heterogeneous system will carry the encrypted ticket and application number information to call the platform's built-in ticket decryption authentication interface to obtain the login user information. The execution process of the interface request is the same as the interface request authentication process mentioned above. The ticket decryption authentication interface here is a whitelist interface, but it requires authentication of the relevant integrated security control of the application number.

[0159] During the process of obtaining user information through ticket decryption, if the account system of the heterogeneous system is inconsistent with the unified user account system in the industrial system, it is necessary to first use the user mapping function of the industrial system to map and match the accounts of the heterogeneous system. During the ticket decryption process, the actual login user information of the heterogeneous system is obtained based on the application number and user mapping relationship.

[0160] After the ticket decryption authentication interface passes the authentication, the result is returned to the heterogeneous system, and the third-party heterogeneous system enters the corresponding function page for display. If the ticket decryption authentication interface fails, the third-party heterogeneous system will give a prompt on the web page.

[0161] In summary, the data security protection method provided by the present invention, through a unified industrial system and security and confidentiality protection and data security control technology, not only realizes the unification of technology stack and technology architecture, but also fundamentally solves the various problems brought about by heterogeneous systems, and has comprehensive security protection, fine-grained authority control, and an independent three-member management mechanism, which provides a strong guarantee for the safe and efficient operation of industrial applications.

[0162] As another embodiment of the present invention, a data security protection device 100 is provided for implementing the data security protection method described above, wherein: Fig.12 As shown, including:

[0163] The login protection module 110 is used to obtain the user login information after being processed by the infrastructure security protection layer, and perform user login authentication processing and first interface request authentication processing on the user login information, wherein the user login authentication processing at least includes the first basic service security protection layer processing and the first platform application security protection layer processing performed on the user login information in sequence, the first interface request authentication processing at least includes the second basic service security protection layer processing performed on the user login information, the infrastructure security protection layer includes at least user authority protection and user login information complexity protection, the first basic service security protection layer includes at least confidentiality authentication protection, the first platform application security protection layer includes at least identity authentication protection, the second basic service security protection layer includes at least login interface authentication, service interface authority authentication and identity validity authentication; the user login information includes at least a login interface, a login account and a login password;

[0164] The data access protection module 120 is used to obtain user data access request information when the user logs in successfully, and perform a second interface request authentication process on the user data access request information, wherein the second interface request authentication process at least includes a second platform application security protection layer processing on the user data access request information, and the second platform application security protection layer includes at least data access control protection, data confidentiality level control protection and data output control protection.

[0165] The data security protection device provided by the present invention implements layered protection of user login information through protection processing based on the infrastructure security protection layer, the first basic service security protection layer, the second basic service security protection layer and the first platform application security protection layer when the user logs in, thereby ensuring the security of the industrial system during the user login process; in addition, data protection processing is performed on the second platform application security protection layer for the data access process after the user login is successful, which can also ensure the security of the industrial system during the data access process. Therefore, the data security protection device provided by the present invention can ensure data security protection under the 1+N architecture and improve the data security of the industrial system.

[0166] The description of the specific working principle of the data security protection device of the present invention can refer to the description of the data security protection method in the previous text, and will not be repeated here.

[0167] As another embodiment of the present invention, an industrial system 10 based on a 1+N architecture is provided, wherein: Fig.13 As shown, it includes: a portal end 11, a server end 12 and multiple application ends 13, the server end 12 includes the data security protection device 100 mentioned above, and the portal end 11 and the multiple application ends 13 are all connected to the server end 12 for communication.

[0168] In the embodiment of the present invention, the industrial system based on the 1+N architecture, as the cornerstone of the high-end equipment manufacturing industry, presents an efficient, flexible and secure solution framework. The industrial system adopts a multi-layer architecture to realize the modularization of functions and the decoupling of services. Each layer has specific responsibilities, such as the data layer is responsible for data storage, the business logic layer processes business rules, and the presentation layer is responsible for user interaction. The layers communicate through interfaces, reducing the direct dependence between layers, making the system more flexible and easy to maintain and expand. Through microservice governance, the registration, discovery, monitoring and scheduling of services are realized, ensuring the normal operation and efficient collaboration of microservices. Each microservice is an independent and deployable unit, which helps to realize the modularization and scalability of the system. At the same time, the independence of microservices also ensures the irrelevance and relative independence of each industrial APP. The separation of the development platform and the industrial APP allows developers to focus more on the implementation of business logic without having to worry about the underlying technical details. This separation design also enhances the independence and portability of industrial APPs, making them easier to deploy and run in different environments. Based on this architecture, security and confidentiality protection and data security control are implemented throughout all levels of the architecture, and comprehensive security design has been carried out from the physical layer, network layer, system layer to the application layer.

[0169] Through multi-layer architecture design, microservice system, separation of development platform and industrial APP, as well as comprehensive security and confidentiality protection and data security control, this architecture can meet the needs of high-end equipment manufacturing industry for integrated industrial applications and services.

[0170] Reference Fig.14 The industrial low-code platform 1+N application architecture diagram shown in the figure shows that the overall architecture is divided into six parts: infrastructure layer, information resource layer, platform service layer, application service layer, standard and specification system, and security assurance system.

[0171] 1) Infrastructure layer. The infrastructure layer mainly includes the network environment, servers, storage and other equipment, middleware, and database required for platform construction. Providing a stable and reliable hardware environment for the platform is an important facility necessary to support the normal operation of the platform. At the same time, on this infrastructure layer, various means such as network isolation, firewalls, and software authentication are used to form the first layer of protection for the physical security, network security, and system software security of the entire system.

[0172] 2) Basic service layer. The basic service layer is the core technology module in the 1+N architecture, providing basic operation support and operation monitoring for platform and industrial application management. The microservice governance module is the management center of the entire platform service operation. It implements calls between internal services through service registration, service discovery, load balancing, etc. At the same time, it combines the external output interface of the API gateway to realize external business integration. It unifies the system integration technology, reduces the complexity of system integration, and solves the difficulties of heterogeneous system integration. And through automated operation and maintenance and continuous integration tools, it realizes the automated execution of tasks such as building, testing, deployment and monitoring, and improves the efficiency and quality of software development. The API gateway and certification center services here are the second layer of protection for the entire industrial base. The certification center service provides access, storage, modification, output, circulation and other aspects of overall data security, including data confidentiality control, personnel confidentiality control, file confidentiality control, etc. in confidentiality requirements, as well as fine-grained permission control of scope permissions, functional permissions and object permissions; the API gateway is mainly responsible for load balancing, caching, routing, access control, service proxy, monitoring and logging. User organization services, form content services, process center services, security and confidentiality services, data integration services, scheduling services, search services, file services, etc. provide protection means and paths for this layer of protection.

[0173] 3) Platform application layer. The platform application layer consists of data modeling, form modeling, process modeling, application management, developer center, organization management, user management and other functions. The entire modeling process follows a unified standard specification system to provide each industrial APP with the required unified basic data, unified workbench, unified process task processing center, unified operation monitoring and other functions to solve the problems of inconsistent data, data disconnection and data islands in heterogeneous systems. At the same time, this layer is also the third layer of security protection for the entire industrial base, namely application security protection, which provides application access security protection through preset protection rules such as form authorization, process authorization, and account policy.

[0174] 4) Industrial application layer. The industrial application layer is the N industrial application presentation layer under the 1+N architecture. Each industrial APP can be independently evaluated for confidentiality, with independent three-person management, and filtered through the service layer data, which is not noticeable to the evaluators. This layer unifies the security protocol, authentication mechanism and access control strategy, solves security and compliance issues, and reduces operation and maintenance costs. This layer also belongs to the third layer of security protection for the entire industrial system.

[0175] 5) Standard specification system. The construction based on the 1+N architecture and the implementation process of the industrial low-code development platform follow a unified standard specification system, covering data specifications, implementation specifications, development specifications, UI specifications, management specifications, etc., to ensure the efficient construction and long-term operation of various industrial application apps from multiple dimensions.

[0176] 6) Security assurance system. From the perspective of application security and data security, the system meets the requirements of the security assessment and ensures the safe operation of the base. Information security runs through all levels of the base. The construction of each industrial APP must have corresponding security measures to ensure the security of information resources, application systems, and user permissions.

[0177] In addition, the industrial system of the embodiment of the present invention will integrate the system security hierarchical protection evaluation requirements based on the national confidentiality standard BMB17-2006 into the industrial system of the embodiment of the present invention, and establish a security and confidentiality protection system from seven aspects: physical security, network security, system software security, data security, application security, user security, and security management. In the above 1+N application architecture, the application of this technology at various levels is explained. In addition, refer to Figure 3 The schematic diagram of security and confidentiality protection and data security control of industrial systems based on the 1+N architecture is shown, and the content covered by this technology is specifically explained:

[0178] Step 1, based on the infrastructure of high-end equipment manufacturing industry, build physical security, network security, and system software security. That is, the first layer of security protection under the 1+N architecture. Physical security and network security are mainly hardware security construction, which will not be described in detail here. System software security, in addition to the confidentiality-related software of security control, mainly refers to the middleware, database and other related software related to the industrial base. According to the characteristics of each software, set corresponding security protection measures, such as user authority restrictions, account password complexity restrictions, etc. The final output of this layer is the access URL of the specific system.

[0179] Step 2, visit the login page of the industrial APP according to the access URL, and start from entering the account password, combining security and confidentiality protection and data security control technology to control data security and application security. When the password is entered to complete the login transmission, the password will be encrypted for transmission.

[0180] Step 3: After receiving the account and password information, the authentication center service in the platform service will verify the validity of the account and the correctness of the password in accordance with the requirements in the "Account Policy Settings". At the same time, it will verify whether the IP address is bound, the correctness of the IP address, and the compliance of the confidentiality level in accordance with the setting rules in the confidentiality parameter configuration. The specific user login authentication process is as follows: Fig.15 shown.

[0181] Step 4: After the above verification is passed, the login is successful, and the encrypted token information carrying the user information is returned to enter the corresponding workbench. Here, the authentication process of Step 2 and Step 3 is applied to the confidentiality control in the second layer of data security protection, and the identity authentication and authentication, account policy management, and user role organization management in the third layer of application security protection. It also involves the account security protection set by the user himself. The specific interface request authentication process is as follows: Fig.16 shown.

[0182] Step 5: The entire login authentication process will be recorded in the operation log through the log service, and can be queried and viewed in the log management module.

[0183] Step 6, after successful login authentication, you will enter the corresponding industrial APP workbench, and you need to initialize the data display information related to the logged-in user. The front end carries the token information, interface information, and interface parameter information after successful login authentication to access the backend service.

[0184] Step 7: First, the validity and timeliness of the token will be verified by the authentication center service in the platform service. Only after the verification is passed can the formal interface be accessed.

[0185] Step 8. During the interface access process, user information is required to obtain data. Data access control is performed based on various authorization rules such as form authorization, process authorization, user organization role authorization, etc. At the same time, data confidentiality control is performed in combination with user confidentiality, data confidentiality, and file confidentiality. In addition, data output control is performed on the output data in combination with the interface authorization rules, and finally the visible data information under the user's authority is returned.

[0186] Step 9, if the external party directly accesses the internal interface, it is necessary to combine the login authentication of Step 2 and Step 3, and then obtain data according to the process of Step 6, Step 7, and Step 8. The above Step 6, Step 7, Step 8, and Step 9 are descriptions of the access security control process for all data, which belong to the second-level data security protection and the third-level application security protection security management and control.

[0187] Step 10: The entire process of the interface call will record the operation log through the log service, and can be queried and viewed in the log management module.

[0188] Step 11, the three-member management login authentication process is the same as Step 2 and Step 3, and the data acquisition process after login is the same as Step 6 and Step 7.

[0189] Step 12, when entering various industrial applications through the unified workbench, for internal applications, the data of the corresponding application is directly obtained and displayed through Step 6 and Step 7; for external applications, after the single sign-on authentication process is passed, the display page of the external application is entered.

[0190] In summary, the industrial system based on the 1+N architecture provided by the embodiment of the present invention, with the industrial base as the cornerstone of the entire system, not only realizes the unified integration of the technology stack and the architecture, but also pays special attention to and ensures strict control of security and confidentiality protection and data security. With the help of a unified low-code development platform, this architecture eliminates multiple challenges such as technical barriers, data fragmentation, business incoordination, complex management, and security risks caused by heterogeneous systems from the source, and demonstrates a series of significant advantages. In particular, the deep integration of the industrial base with security and confidentiality and data security control is particularly effective:

[0191] (1) Deep integration of industrial base and unified security and confidentiality protection. Specifically, 1) Unified technical architecture: The industrial base under the 1+N architecture adopts a multi-layer architecture and microservice governance to ensure the advancement, flexibility and scalability of the system. This unified technical architecture provides a solid foundation for security and confidentiality protection; 2) Security policy integration: A comprehensive security and confidentiality protection strategy is embedded in the industrial base, covering identity authentication, account strategy, user management, organization management, role management, permission management and other aspects to ensure application security; 3) Data security assurance: At the industrial base level, data security measures such as confidentiality control, access control, information storage / modification / output / circulation control are implemented, and data information is managed in a hierarchical and classified manner based on risk assessment results to ensure data security and compliance.

[0192] (2) Close integration of industrial base and data security control. Specifically, 1) Fine-grained permission management: The industrial base provides fine-grained control of scope permissions, functional permissions, and object permissions, ensuring that different users can only access data and functions within their permissions; 2) Three-member management mechanism: The three-member management functions of each industrial application (i.e., system administrator, security administrator, and audit administrator) are all provided uniformly based on the industrial base, but the data is logically managed independently, which not only ensures the uniformity of management, but also realizes the independence of data. 3) Data auditing and monitoring: The industrial base has detailed auditing functions, recording log information such as operators, operation time, and operation content, which is convenient for analysis and supervision. At the same time, recording and tracking all data access and operation behaviors helps to detect and handle abnormal behaviors in a timely manner.

[0193] (3) Advantages in solving heterogeneous system problems. Specifically, 1) Technical compatibility: Through a unified industrial base, the problem of inconsistent technology stacks between heterogeneous systems is solved, and the overall compatibility and stability of the system are improved; 2) Data consistency: The data specifications and management specifications implemented at the industrial base level ensure the consistency and interchangeability of data between different industrial applications; 3) Security uniformity: A unified security and confidentiality protection and data security control system solves the differences in security protocols, authentication mechanisms, and access control strategies between heterogeneous systems, and improves the overall security of the system.

[0194] In summary, the industrial system based on the 1+N architecture in the embodiment of the present invention not only realizes the unification of the technology stack and technology architecture through a unified low-code development platform and security and confidentiality protection and data security control technology, but also fundamentally solves the various problems brought about by heterogeneous systems. The industrial system under this architecture has comprehensive security protection, fine-grained authority control, an independent three-member management mechanism, and detailed audit functions, providing a strong guarantee for the safe and efficient operation of industrial applications.

[0195] The description of the specific working principle of the industrial system based on the 1+N architecture of the present invention can also refer to the description of the data security protection method in the previous text, which will not be repeated here.

[0196] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present invention, but the present invention is not limited thereto. For those of ordinary skill in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A data security protection method, characterized in that: include: Obtain user login information after being processed by the infrastructure security protection layer, and perform user login authentication processing and first interface request authentication processing on the user login information, wherein the user login authentication processing at least includes the first basic service security protection layer processing and the first platform application security protection layer processing performed on the user login information in sequence, the first interface request authentication processing at least includes the second basic service security protection layer processing performed on the user login information, the infrastructure security protection layer includes at least user authority protection and user login information complexity protection, the first basic service security protection layer includes at least confidentiality authentication protection, the first platform application security protection layer includes at least identity authentication protection, the second basic service security protection layer includes at least login interface authentication, service interface authority authentication and identity validity authentication; the user login information includes at least a login interface, a login account and a login password; When the user logs in successfully, the user data access request information is obtained, and the second interface request authentication processing is performed on the user data access request information, wherein the second interface request authentication processing at least includes the second platform application security protection layer processing on the user data access request information, and the second platform application security protection layer at least includes data access control protection, data confidentiality level control protection and data output control protection; The user login authentication process of the user login information includes: When the login interface authentication is passed, the first basic service security protection layer and the first platform application security protection layer verify the validity of the login account and the correctness of the login password according to the preset account policy, and verify the confidentiality compliance of the login account and the login password according to the preset login information authentication rules; If the validity of the login account, the correctness of the login password, and the confidentiality compliance of both are verified, a prompt message indicating successful authentication is returned; otherwise, a prompt message indicating failed authentication is returned; Among them, when the login interface authentication is passed, the first basic service security protection layer and the first platform application security protection layer verify the validity of the login account and the correctness of the login password according to the preset account policy, and verify the confidentiality compliance of the login account and the login password according to the preset login information authentication rules, including: Determine whether the login account is a Xiaosanyuan application account, where the Xiaosanyuan application includes at least production management, equipment management, process management, and energy management; If the login account is a junior member application account, the correctness of the login password is verified according to the preset junior member account password information; If the login password of the Xiaosanyuan application account is successfully verified, the Dasanyuan platform account mapped to the Xiaosanyuan application account is obtained, wherein the Dasanyuan platform at least includes an industrial system based on a 1+N architecture; Verify the validity of the login information of the Dasanyuan platform account, wherein the validity of the login information of the Dasanyuan platform account includes at least user management authentication, account policy authentication and confidentiality parameter authentication; If the correctness verification of the login password of the Xiaosanyuan application account fails, the validity of the login information of the login account is verified, and the correctness of the login password corresponding to the login account is verified; If the login information validity verification of the Dasanyuan platform account passes, or the validity verification of the login account and the correctness verification of the login password corresponding to the login account pass, then the encrypted token information with the user information is returned, otherwise the prompt information of authentication failure is returned; The Xiaosanyuan application and Dasanyuan platform both include independent three-member account information and corresponding password information. The three-member account information includes system administrator account information, security designer account information and security officer account information. The three-member account information in the Xiaosanyuan application all corresponds to virtual users, and the three-member account information in the Xiaosanyuan application can be mapped to the three-member account information of the Dasanyuan platform. The first interface request authentication process is performed on the user login information, including: Acquire user interface request information, where the user interface request information includes at least an internal portal request and a heterogeneous system external call interface request; Determining whether the user interface request information is an internal portal request; If the user interface request information is an internal portal request, performing interface authentication on the login interface at the second basic service security protection layer; If the interface request information is a request for an external interface call of a heterogeneous system, the login interface is called, and the account information preset by the heterogeneous system is obtained to perform login interface authentication at the second basic service security protection layer; When the login interface authentication is passed, the encrypted token information is decrypted and the validity of the decrypted token information is authenticated; If the validity authentication of the decrypted token information is passed, it is determined that the user has logged in successfully; If the validity authentication of the decrypted token information fails, a prompt message indicating that the user login was unsuccessful is returned; Among them, performing interface authentication on the login interface at the second basic service security protection layer, and obtaining account information preset by the heterogeneous system to perform login interface authentication at the second basic service security protection layer, both include: Compare the interface access path in the login interface with the preset access path in the interface whitelist; If the interface access path in the login interface is in the interface whitelist, further verification prompt information is returned, and the further verification prompt information carries application number information; If the interface access path in the login interface is not in the interface whitelist, a prompt message indicating that the interface authentication failed is returned, and the prompt message indicating that the interface authentication failed carries token information and application number information; The second interface request authentication process is performed on the user data access request information, including: Determine whether the user data access request information is for internal application access, wherein the user data access request information includes internal application access and heterogeneous system application access; If the user data access request information is for internal application access, data access control is performed on the user data access request information according to data access authorization rules, wherein the data access authorization rules at least include form authorization, process authorization and user organization role authorization; Performing data output control on user data access request information according to data confidentiality control rules and interface authorization rules, wherein the data confidentiality control rules at least include user confidentiality, data confidentiality and file confidentiality; Returns the visible data information under the user's permission.

2. The data security protection method according to claim 1, characterized in that: If the user data access request information is for heterogeneous system application access, single sign-on authentication is performed on the user according to the user data access request information, and then second interface request authentication is performed in the manner of internal application access.

3. The data security protection method according to claim 2, characterized in that: After performing single sign-on authentication processing on the user according to the user data access request information, performing second interface request authentication processing in the manner of internal application access, including: Determining whether the current user has access rights to the current heterogeneous system according to the user data access request information; If the current user has access rights to the current heterogeneous system, the single-point preset information including the entry information is returned to the portal; Receiving single sign-on path acquisition interface request information from the portal end, wherein the single sign-on path acquisition interface request information at least includes the single sign-on preset information; The login interface is called according to the interface request information obtained by the single sign-on path, and the account information preset by the heterogeneous system is obtained to perform login interface authentication in the second basic service security protection layer; If the login interface authentication is passed, it is determined that the single sign-on path acquisition interface request is successful, and the request success result information is returned to the portal. The request success result information includes at least temporary verification information of timeliness and the heterogeneous system access path carrying entry information. The portal can access the heterogeneous system based on the heterogeneous system access path and the temporary verification information of timeliness.

4. A data security protection device, used to implement the data security protection method according to any one of claims 1 to 3, characterized in that: include: A login protection module, used to obtain user login information after being processed by the infrastructure security protection layer, and perform user login authentication processing and first interface request authentication processing on the user login information, wherein the user login authentication processing at least includes the first basic service security protection layer processing and the first platform application security protection layer processing performed on the user login information in sequence, the first interface request authentication processing at least includes the second basic service security protection layer processing performed on the user login information, the infrastructure security protection layer includes at least user authority protection and user login information complexity protection, the first basic service security protection layer includes at least confidentiality authentication protection, the first platform application security protection layer includes at least identity authentication protection, the second basic service security protection layer includes at least login interface authentication, service interface authority authentication and identity validity authentication; the user login information includes at least a login interface, a login account and a login password; A data access protection module is used to obtain user data access request information after the user logs in successfully, and perform a second interface request authentication process on the user data access request information, wherein the second interface request authentication process at least includes a second platform application security protection layer processing on the user data access request information, and the second platform application security protection layer includes at least data access control protection, data confidentiality level control protection and data output control protection.

5. An industrial system based on 1+N architecture, characterized in that: include: A portal end, a server end and multiple application ends, the server end includes the data security protection device described in claim 4, and the portal end and multiple application ends are all communicatively connected to the server end.

Images