Virtual power plant data security protection method, platform, equipment and system based on cloud computing platform

Abstract

The present application relates to a virtual power plant data security protection method, platform, device and system based on a cloud computing platform, applied to the field of data security protection, the method comprising: receiving a data acquisition request of a target device, the data acquisition request comprising to-be-acquired data information and a data security level; reading target data corresponding to the to-be-acquired data information from a database; performing data segmentation on the target data according to the data volume to obtain a plurality of segmented data; determining an encryption key according to the data security level, the IP of the target device, the data value and the data type; encrypting the plurality of segmented data through the encryption key, and sending the encrypted data to the target equipment; the information of the target device side and the information of the target data in the platform can be combined to jointly determine the encryption key, so that the security of the key is better, and the data transmission is safer.

Description

Technical Field

[0001] The present application relates to the field of data security protection, and in particular to a data security protection method, platform, device and system for a virtual power plant based on a cloud computing platform. Background Art

[0002] With the rapid development of smart grid and distributed energy technology, virtual power plants, as an important platform for integrating distributed resources and optimizing energy allocation, have become particularly important for data security protection. Virtual power plants involve a large amount of sensitive data, including but not limited to the status of power generation equipment, power trading information, user privacy data, etc. The security of this data is directly related to the stable operation of the power grid, the fairness of market transactions, and the protection of user privacy.

[0003] When a virtual power plant and a distributed energy management device or an energy consumption user device transmit data, a unique key is generally set for the distributed energy management device or the energy consumption user device to encrypt the data during data transmission to ensure data transmission security. However, when the fixed key is leaked, data leakage is likely to occur. Summary of the invention

[0004] The purpose of this application is to provide a virtual power plant data security protection method, platform, equipment and system based on a cloud computing platform, which can reduce the occurrence of data leakage.

[0005] In a first aspect, a virtual power plant data security protection method based on a cloud computing platform is provided, comprising: Receiving a data acquisition request from a target device, wherein the data acquisition request includes information about data to be acquired and a data security level; Reading target data corresponding to the data information to be acquired from a database, wherein the database stores information related to power generation equipment and information related to electricity consumption of virtual power plant data, wherein the target data includes data to be processed, data volume, data value, and data type; Performing data segmentation on the target data according to the data volume to obtain a number of segmented data; Determine the encryption key based on the data security level, the IP address of the target device, the data value and the data type; The plurality of segmented data are encrypted using an encryption key, and the encrypted data are sent to a target device.

[0006] By adopting the above technical solution, after receiving the data acquisition request from the target device, the target data can be read and the data can be segmented and processed based on the data volume of the target data, which not only improves the efficiency of data transmission, but also further enhances the security of the data; combining the data security level in the data acquisition request, the IP of the target device and other information on the target device side, as well as the data value and data type of the target data in the platform, the data information from two different sources jointly determine the encryption key, so that the key is determined according to the actual situation, with better security, so that data transmission is more secure.

[0007] In a preferred example, the present application may be further configured as follows: the target data is segmented according to the data volume to obtain a number of segmented data, including: Predict the device performance information within the data transmission period based on the current device performance information and historical device performance information; Determine the data volume and device performance information during the data transmission period, and determine whether data segmentation is required; If data segmentation is required, the initial horizontal segmentation information is determined according to the data type of the target data; the initial vertical segmentation information is determined according to the data value corresponding to each data of the target data; According to the device performance information in the data sending period, the initial horizontal segmentation information and the initial vertical segmentation information are modified to obtain horizontal segmentation information and vertical segmentation information; The target data is segmented according to the horizontal segmentation information and the vertical segmentation information to obtain a plurality of segmentation data.

[0008] By adopting the above technical solution, the device performance within the data transmission period is accurately predicted based on the current device performance information and the historical device performance information. Based on the predicted device performance and data volume, it is intelligently determined whether data segmentation is required. If the data volume exceeds the processing capacity of the device within the transmission cycle, the segmentation strategy is further refined. By considering the data type of the target data, the initial horizontal segmentation strategy is determined to ensure that different types of data can be processed in the most appropriate manner. At the same time, the initial vertical segmentation strategy is formulated based on the specific value of each data item. The initial segmentation strategy is dynamically adjusted based on the real-time predicted device performance information to ensure that the segmented data not only meets the transmission requirements, but also optimizes the transmission efficiency, thereby improving the reliability and efficiency of data transmission.

[0009] In a preferred example, the present application may be further configured as follows: predicting the device performance information within the data transmission period according to the current device performance information and the historical device performance information includes: Acquire a device performance prediction model, wherein the device performance prediction model is obtained by training the prediction model based on a plurality of historical device information, wherein the historical device information includes: historical device performance information corresponding to a current period in a plurality of adjacent historical dates and historical device performance information corresponding to a period after the current period, According to the current device performance information, a device performance prediction model is used to perform prediction to obtain device performance information within the data transmission period; Determine whether the current moment is an abnormal moment. If so, adjust the device performance information within the data sending period according to the current moment to obtain the device performance information within the adjusted data sending period.

[0010] By adopting the above technical solution, a device performance prediction model based on a large amount of historical data is obtained. This model not only learns the performance change rules of the equipment in different time periods to achieve accurate prediction of future equipment performance and obtain device performance prediction information within the data sending period; it also has the ability to detect abnormal moments. Once it is found that the current moment is an abnormal moment (such as holidays, etc.), it can quickly adjust the prediction results to ensure that the prediction information remains highly accurate in complex and changeable actual environments.

[0011] In a preferred example, the present application may be further configured as follows: determining the encryption key according to the data security level, the IP address of the target device, the data value and the data type includes: Integrate each set of data and the data security level in the IP of the target device to obtain a first value; When the data security level is greater than a preset data security level threshold, executing a first determination step; When the data security level is not greater than a preset data security level threshold, executing a second determination step; The first determination step includes: obtaining a second value by dividing the first value by a value corresponding to the data value, wherein the second value includes an integer divisor and a remainder value; if there is no remainder value, dividing the integer value by a value corresponding to the data type to obtain a third value, and determining a row value and a column value according to the third value; if there is a remainder value, using the remainder value as a column value and determining a row value corresponding to the column value; determining an encryption key from a list relationship of a preset key and an encryption key length according to the row value and the column value; The second determination step includes: determining the encryption key length according to the data value and data type, and determining the encryption key based on the encryption key length and the data security level.

[0012] By adopting the above technical solution, when the data security level is high, a more complex determination step is used to generate the encryption key; and when the data security level is low, a relatively simplified step is used; the hierarchical processing method not only improves the processing efficiency of the system, but also ensures the data protection effect under different security requirements. Moreover, in the first determination step, the encryption key determination process fully considers multiple factors such as the target device's IP, data security level, data value, and data type. The dynamically generated encryption key not only improves the security of data transmission, but also enhances the flexibility and adaptability of the system. In addition, the row and column position of the encryption key is determined by integer division and remainder operations, which further increases the difficulty of cracking.

[0013] In a preferred example, the present application may be further configured as follows: determining the encryption key according to the data security level, the IP address of the target device, the data value and the data type includes: Determine a first security level corresponding to the IP address of the target device according to the IP address of the target device and preset network risk area distribution information; According to the data value, the corresponding relationship between the preset value and the safety factor is used to obtain the second safety level corresponding to the data value; According to the data type, using the correspondence between the preset type and the safety factor, a third safety level corresponding to the data type is obtained; According to the data security level, the first security level, the second security level and the third security level, the comprehensive security level is determined, and the encryption algorithm is selected and the encryption key is generated according to the comprehensive security level.

[0014] By adopting the above technical solution, by matching the IP address of the target device with the preset network risk area distribution information, the risk level of the network environment in which the target device is located, that is, the first security level, can be quickly identified; according to the value of the data, using the preset correspondence between the value and the security factor, the system automatically evaluates the importance of the data itself and converts it into the second security level; according to the data type, through the preset correspondence between the type and the security factor, the third security level corresponding to the data type is determined; the information of the four dimensions of data security level, first security level, second security level and third security level is combined to determine the comprehensive security level, and the most appropriate encryption algorithm is selected and the corresponding encryption key is generated accordingly.

[0015] In a preferred example, the present application may be further configured as follows: after reading the target data corresponding to the data information to be acquired from the database, the following further includes: Obtaining the permission level of the user corresponding to the target device for the data type; When the authority level does not reach the preset level, a single sensitive word in the data to be processed and a first position corresponding to the single sensitive word are identified; and pairs of sensitive words in the data to be processed and second positions corresponding to the pairs of sensitive words are identified; Desensitizing the sensitive words corresponding to the first position and the second position to obtain desensitized data to be processed; Accordingly, the target data is segmented according to the data volume to obtain a number of segmented data, including: The target data after the desensitization process is segmented according to the data volume to obtain a number of segmented data.

[0016] By adopting the above technical solution, the leakage of sensitive information is effectively prevented by checking the permission level of the user of the target device and desensitizing sensitive words before data transmission.

[0017] In a preferred example, the present application can be further configured to: identify a single sensitive word in the data to be processed and a first position corresponding to the single sensitive word; and identify pairs of sensitive words in the data to be processed and second positions corresponding to the pairs of sensitive words, including: Segmenting the data to be processed to obtain a plurality of sub-data, and determining the correlation between adjacent sub-data; Grouping the plurality of sub-data so that the number of data groups is at least greater than 2, and the correlation between the sub-data at the boundary of two adjacent data groups is not greater than a preset degree threshold; For each data group, a single sensitive word in the data group and a first position corresponding to the single sensitive word are identified; and pairs of sensitive words in the data group and second positions corresponding to the pairs of sensitive words are identified.

[0018] By adopting the above technical solution, when identifying sensitive words, the method adopts steps such as data segmentation, relevance determination and data grouping. This refined processing method can more accurately identify sensitive information in the data to be processed and effectively desensitize it.

[0019] In a second aspect, a cloud computing platform is provided, including: A receiving module, used for receiving a data acquisition request from a target device, wherein the data acquisition request includes information about the data to be acquired and a data security level; A reading module, used to read target data corresponding to the data information to be acquired from a database, wherein the database stores information related to power generation equipment and information related to electricity consumption of virtual power plant data, and the target data includes data to be processed, data volume, data value, and data type; A segmentation module, used for segmenting the target data according to the data volume to obtain a number of segmented data; An encryption key determination module, used to determine an encryption key according to the data security level, the IP address of the target device, the data value and the data type; The encryption and sending module is used to encrypt the plurality of segmented data using an encryption key and send the encrypted data to a target device.

[0020] In a third aspect, an electronic device is provided, comprising: one or more processors; Memory; One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more applications are configured to: execute the steps of the method described in any one of the first aspects.

[0021] According to a fourth aspect, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the method is implemented as shown in any possible implementation manner of the first aspect.

[0022] In the fifth aspect, a virtual power plant data security protection system based on a cloud computing platform is provided, including: The electronic device according to the third aspect; as well as, The target device is used to send a data acquisition request and, after receiving the encrypted data, perform data decryption and aggregation.

[0023] In summary, the present application includes at least one of the following beneficial technical effects: after receiving a data acquisition request from a target device, the target data can be read and the data can be segmented and processed based on the data volume of the target data, which not only improves the efficiency of data transmission, but also further enhances the security of the data; combining the data security level in the data acquisition request, the IP of the target device and other information on the target device side, as well as the data value and data type of the target data in the platform, the data information from two different sources jointly determines the encryption key, so that the key is determined according to the actual situation, with better security, so that data transmission is more secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A schematic diagram of the structure of a virtual power plant data security protection system based on a cloud computing platform provided in an embodiment of the present application; Figure 2 It is a flow chart of a virtual power plant data security protection method based on a cloud computing platform provided in an embodiment of the present application; Figure 3This is a schematic diagram of a key determination process provided by an embodiment of the present application; Figure 4 It is a structural diagram of a cloud computing platform provided in an embodiment of the present application; Figure 5 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] This specific embodiment is merely an explanation of the present application and is not a limitation of the present application. After reading this specification, those skilled in the art may make modifications to the present embodiment without any creative contribution as needed, but such modifications are protected by the patent law as long as they are within the scope of the claims of the present application.

[0026] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0027] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally means that the associated objects before and after are in an "or" relationship.

[0028] When a virtual power plant and a distributed energy management device or an energy consumption user device transmit data, a unique key is generally set for the distributed energy management device or the energy consumption user device to encrypt the data during data transmission to ensure data transmission security. However, when the fixed key is leaked, data leakage is likely to occur.

[0029] Therefore, in response to the above-mentioned technical problems, the embodiments of the present application provide a data security protection method for a virtual power plant based on a cloud computing platform. After reading the corresponding target data based on a data acquisition request, the target data is segmented and processed. Small data helps to improve transmission efficiency, and the segmented data are all encrypted for transmission, reducing data leakage. In addition, when encrypting, the data security level in the data acquisition request, the IP address of the target device and other information on the target device side, as well as the data value and data type of the target data in the platform are combined. The data information from two different sources jointly determines the encryption key, so that the key is determined according to the actual situation, with better security, so that data transmission is more secure.

[0030] For ease of understanding, refer to Figure 1 , Figure 1 A virtual power plant data security protection system based on a cloud computing platform provided in an embodiment of the present application includes: an electronic device for implementing a virtual power plant data security protection method based on a cloud computing platform; and a target device; The electronic device may be a server deployed with a virtual power plant data security protection platform based on a cloud computing platform. The server may be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services.

[0031] Wherein, the target device sends a data acquisition request; The electronic device receives a data acquisition request from a target device, the data acquisition request includes the data information to be acquired and the data security level; reads the target data corresponding to the data information to be acquired from a database, the database stores information related to power generation equipment and electricity consumption of virtual power plant data, the target data includes data to be processed, data volume, data value, data type; divides the target data according to the data volume to obtain a number of divided data; determines the encryption key according to the IP, data value and data type of the target device; encrypts a number of divided data by the encryption key, and sends the encrypted data to the target device. After receiving the encrypted data, the target device decrypts and aggregates the data. Specifically, the electronic device will send the decryption key to the target device, or send the key information to the blockchain, so that after the target device reads the key information from the blockchain, it can automatically generate a key pair to decrypt according to the decryption key. The key information is the necessary data for generating the key.

[0032] Furthermore, the target device may be a device corresponding to the distributed power grid corresponding to the virtual power plant, or a user client device corresponding to the consumer power grid.

[0033] The database in the electronic device stores a plurality of data, which may include: Distributed energy resource data corresponding to distributed power grids, specifically, distributed power generation data: including operating data of renewable energy power generation devices such as solar photovoltaic and wind power, such as power generation, power generation power, power generation efficiency, etc.; energy storage system data: status data of energy storage equipment such as energy storage batteries, compressed air energy storage, and water pump energy storage, such as energy storage capacity, charging and discharging status, charging and discharging power, etc.

[0034] The controllable load data of multiple areas corresponding to the virtual power plant, such as: industrial adjustable load data, the operating status and energy consumption data of adjustable loads such as industrial production lines and refrigeration equipment; building air-conditioning load data, the temperature of public areas of large buildings, the operating status and energy consumption data of air-conditioning equipment, etc. These data are of great significance for achieving demand response and participating in peak regulation of the electricity market; electric vehicle data, including the charging status, charging power, charging time and other data of electric vehicles.

[0035] Grid status data, transmission network and distribution network data: including network architecture, voltage, current, frequency and other grid operation monitoring data.

[0036] Market transaction data, including real-time electricity prices, transaction volume, transaction contracts and other information in the power market, play a key role in enabling virtual power plants to participate in power market transactions and optimize economic benefits.

[0037] Environmental and forecasting data, meteorological data: such as temperature, humidity, wind speed, light intensity, etc. These data are of great significance for predicting the power generation of distributed power generation units and optimizing the charging and discharging strategies of energy storage systems; load forecasting data: based on historical data and real-time data, predict the power load in the future period to provide support for the scheduling decisions of virtual power plants.

[0038] User behavior data: data such as user electricity usage habits and electricity demand. These data help the virtual power plant better understand user needs and provide more personalized services.

[0039] Equipment status monitoring data: Real-time monitoring of the operating status of various equipment in the virtual power plant, timely detection and handling of potential faults, and ensuring the stable operation of the virtual power plant.

[0040] The devices corresponding to the distributed power grid can exchange information with the electronic devices, and the interactive content includes but is not limited to: distributed energy resource data corresponding to the distributed power grid, equipment status monitoring data, etc.

[0041] The interactive content of information exchange between user client devices and electronic devices includes but is not limited to: distributed energy resource data corresponding to the distributed power grid, controllable load data of multiple areas corresponding to the virtual power plant, power grid status data, market transaction data, environmental and forecasting data, user behavior data, and equipment status monitoring data.

[0042] Specifically, the present application embodiment provides a virtual power plant data security protection method based on a cloud computing platform, such as Figure 2 As shown, the method includes: S101, receiving a data acquisition request from a target device, where the data acquisition request includes information about data to be acquired and a data security level; The target device refers to the device that issues the data acquisition request, which can be any device with communication permissions that needs to access or process specific data, such as servers, personal computers, smartphones, etc. These devices are connected to the data processing system through the network or other communication means to request the necessary data information.

[0043] The data information to be obtained represents identification information of specific data content that the target device wishes to retrieve or access from the data processing system. The data security level refers to the security level requirement specified in the data acquisition request.

[0044] S102, reading target data corresponding to the data information to be obtained from a database, wherein the database stores information related to power generation equipment and information related to electricity consumption of virtual power plant data, and the target data includes data to be processed, data volume, data value, and data type; Among them, target data refers to the data actually read from the database based on the data information to be obtained, including but not limited to the data to be processed (demand data of the target device), data volume (indicating the total amount or size of the data), data value (data usefulness), and data type (text, number, image, etc.).

[0045] The power generation equipment related information of the virtual power plant data refers to the detailed information about each power generation equipment in the virtual power plant stored in the database, such as equipment type, capacity, power generation efficiency, operating status, etc. The power consumption related information refers to the data related to power consumption stored in the database, including but not limited to the user's power consumption, power consumption time, power load, etc. Optionally, one implementation method is to use the query interface of the database management system. Construct a corresponding query statement according to the description of the data information to be obtained; send the query statement to the database through a database connection pool or a direct connection to the database; receive the query results returned by the database, and parse the results to obtain the target data. It is understandable that other methods can also be used to implement this step, such as using the ORM (object-relational mapping) framework to simplify database operations and using cache technology to improve data reading efficiency. This is not limited here, and the specific implementation method can be selected and optimized according to factors such as system requirements, database scale, and performance requirements.

[0046] S103, dividing the target data according to the data volume to obtain a number of divided data; The purpose of data segmentation is usually to improve the efficiency of data processing. Each data set after segmentation is called segmented data.

[0047] For example, suppose the target data is a user electricity consumption data table containing 1 million records. The data volume is huge and difficult to process at one time. At this time, you can split it according to the size of the data, for example, every 100,000 records as a split data, so that 10 smaller data sets are obtained, each of which contains a part of the original data, which is convenient for subsequent processing and analysis.

[0048] The specific segmentation rules can segment the target data according to a fixed preset data volume, or can dynamically adjust the data volume of each segmented data. Users can set it according to actual conditions as long as the purpose of the embodiment of the present application can be achieved.

[0049] S104, determining an encryption key according to the data security level, the IP address of the target device, the data value and the data type; The IP (Internet Protocol) address of the target device is the unique address of each device on the Internet and is used to achieve communication between devices.

[0050] In this step, the encryption key is determined based on the data security level, the IP of the target device, the data value and the data type, so that the generation of the encryption key is dynamic and personalized, aiming to improve the security and protection efficiency of the data.

[0051] Optionally, one implementation method is to use a hash function combined with data characteristics to generate an encryption key. Specifically, the data security level, the IP address of the target device, the quantitative value of the data value (the weight set according to the sensitivity of the data), and the identifier of the data type are used as input parameters; one or more hash functions are used to hash the parameters to generate a hash value of a fixed length; the hash value is used as an encryption key or part of the encryption key, and is combined with a preset key to sort in a set order to obtain an encryption key, where the preset key can be customized. This method is simple and easy, and the one-way nature of the hash function ensures the unpredictability of the encryption key.

[0052] Optionally, another implementation method is to use a key derivation function (KDF) to generate encryption keys. KDF is an algorithm that derives one or more keys from initial key materials (such as passwords, random numbers, etc.). Specifically, the data security level, the IP address of the target device, the quantitative value of the data value, and the identifier of the data type are used as input parameters of the KDF; according to the selected KDF algorithm (such as PBKDF2, Argon2, etc.), an encryption key is generated through multiple rounds of iterations and hash operations. This method has higher security and flexibility and is suitable for scenarios with high data security requirements.

[0053] Optionally, another implementation includes: integrating each set of data and the data security level in the IP of the target device to obtain a first value; When the encryption requirement is greater than a preset encryption requirement threshold, a second value is obtained by dividing the first value by a value corresponding to the data value, wherein the second value includes an integer divisor and a remainder value; if there is no remainder value, the integer value is divided by a value corresponding to the data type to obtain a third value, and a row value and a column value are determined according to the third value; if there is a remainder value, the remainder value is used as the column value, and the row value corresponding to the column value is determined; according to the row value and the column value, the encryption key is determined from a list relationship of preset keys and encryption key lengths; When the encryption requirement is not greater than a preset encryption requirement threshold, each group of data in the IP of the target device and the data security level are integrated to obtain a first value; the encryption key length is determined according to the data value and data type, and the encryption key is determined based on the encryption key length and the data security level.

[0054] It is understandable that other methods may be used to determine the encryption key, which are not limited here. The specific implementation method should be selected based on actual needs, security standards, technical feasibility and other factors.

[0055] S105: Encrypt the plurality of segmented data using an encryption key, and send the encrypted data to a target device.

[0056] It can be seen that in the embodiment of the present application, after receiving the data acquisition request of the target device, the target data can be read and the data can be segmented and processed based on the data volume of the target data, which not only improves the efficiency of data transmission, but also further enhances the security of the data; combined with the data security level in the data acquisition request, the IP of the target device and other information on the target device side, and the data value and data type of the target data in the platform, the data information from two different sources jointly determine the encryption key, so that the key is determined according to the actual situation, with better security, so that data transmission is more secure.

[0057] Furthermore, in order to improve reading efficiency, the database includes sub-databases corresponding to multiple data types; Read the target data corresponding to the data information to be obtained from the database, including: Determine from the database several sub-databases corresponding to the data information to be acquired, and read the sub-target data corresponding to the data information to be acquired from the several sub-databases; When the number of the sub-databases is 1, the sub-target data is determined to be the target data; When the number of sub-databases is greater than 1, all sub-target data are integrated to obtain the target data.

[0058] In the embodiment of the present application, a database maintains sub-databases corresponding to multiple data types, each of which is used to store a certain type or several categories of specific data.

[0059] The data corresponding to the data information to be obtained may be included in one or more sub-databases.

[0060] In some embodiments, this process can be achieved in a variety of ways: Optionally, the electronic device traverses and matches all sub-databases related to the data information to be acquired in the database according to a preset mapping relationship; performs parallel or sequential query operations on these sub-databases to quickly locate and extract sub-target data; and integrates the collected sub-target data to obtain target data.

[0061] Optionally, in order to improve query efficiency, the system can pre-establish an indexing mechanism for each sub-database in the database; use the indexing mechanism to quickly locate sub-databases that may contain target data and reduce unnecessary query overhead; perform specific query operations in these sub-databases to obtain sub-target data; and integrate the collected sub-target data to obtain the target data.

[0062] It is understandable that this process can also be implemented in other ways, which are not specifically limited here. As long as the goal of determining and reading the sub-target data corresponding to the data information to be obtained from the database can be achieved, it is a feasible implementation method of this step.

[0063] It can be seen that in the embodiment of the present application, the multi-type sub-database design of the database can accurately extract the required data from the corresponding sub-database when reading the target data, thereby reducing unnecessary data retrieval time.

[0064] Furthermore, when the number of sub-databases is greater than 1, the target data is segmented according to the data volume to obtain a number of segmented data, including: Determine whether the data volume is greater than a preset data volume threshold; If the data volume is greater than the preset data volume threshold, then for each sub-target data, determine whether the sub-target data is greater than the preset volume threshold, and if the sub-target data is greater than the preset volume threshold, split the sub-target data so that the data volume of each split sub-target data is less than the preset data volume threshold; All sub-target data not greater than a preset number threshold and segmentation sub-target data are used as a number of segmentation data; If the data volume is not greater than the preset data volume threshold, the number of data splits is determined to be 1, that is, no data split is performed.

[0065] In the embodiment of the present application, the preset data volume threshold is a custom setting, or is set according to the current bandwidth (the better the network condition, the larger the preset data volume threshold), and the splitting operation helps to reduce the burden of a single processing task and improve the overall processing efficiency. When the data volume is greater than the preset data volume threshold, if there is a situation where the sub-target data is greater than the preset quantity threshold, the sub-target data is split so that the final split data is less than the preset data volume threshold.

[0066] Optionally, one implementation method is: determine whether the data volume of the data to be processed is greater than a preset data volume threshold; if greater, enter the sub-target data processing loop to check the quantity of each sub-target data; for sub-target data whose quantity exceeds the preset quantity threshold, use equal division, hashing or other segmentation algorithms to split them to ensure that the data volume of each segmented sub-target data meets the requirements; merge all unsegmented sub-target data and segmented sub-target data to form a number of segmented data.

[0067] It can be seen that in the embodiment of the present application, when the data volume is large, the target data is intelligently segmented through the preset data volume threshold and quantity threshold, which not only avoids transmission delay or failure caused by excessive data volume, but also further improves the security of data transmission by refining the encryption granularity. At the same time, reasonable processing is also carried out for the sub-target data with a smaller data volume to ensure the balanced transmission of all data.

[0068] Furthermore, the target data is segmented according to the data volume to obtain a number of segmented data, including: SP1-SP5 (not shown in the figure), where: SP1. Predict the device performance information within the data transmission period based on the current device performance information and historical device performance information; The data transmission period is the period corresponding to the time when the data is transmitted. The device performance information includes multiple device performance characteristics, including but not limited to network bandwidth and CPU processing capacity.

[0069] In an achievable manner, the historical device performance information is the historical device performance information of a first preset time period before the current moment and the historical device performance information of a second preset time period before the current moment, the first preset time period is the time period from the current moment to the first moment, the second preset time period is the time period from the current moment to the second moment, the first moment and the second moment are both earlier than the current moment, and the second moment is earlier than the first moment; the performance change rate of the first preset time period and the performance change rate of the second preset time period are calculated; a weighted calculation is performed based on the two change rates to obtain a comprehensive change rate, wherein the weight of the first preset time period is greater than the weight of the second preset time period, and according to the current device performance information and the comprehensive change rate, the device performance information within the data sending period is predicted, In another achievable manner, based on the current device performance information and the historical device performance information, the device performance information within the data transmission period is predicted, including: SP11-SP13 (not shown in the drawings), wherein: SP11. Obtaining a device performance prediction model. The device performance prediction model is obtained by training the prediction model based on multiple historical device information. The historical device information includes: historical device performance information corresponding to the current period in multiple adjacent historical dates and historical device performance information corresponding to the period after the current period. Specifically, the model training method includes: obtaining historical equipment performance information corresponding to the current time period in multiple adjacent historical dates and historical equipment performance information corresponding to the time period after the current time period, such as 12:00-13:00 and 13:00-14:00 on May 15, 2024, and 12:00-13:00 and 13:00-14:00 on May 14, 2024; inputting multiple historical equipment performance information into the prediction model respectively to determine the predicted equipment performance information corresponding to the time period after the current time period of each historical date; iteratively training the prediction model based on the difference between the historical equipment performance information corresponding to the time period after the current time period in multiple historical dates and multiple predicted equipment performance information to obtain an equipment performance prediction model.

[0070] SP12. Based on the current device performance information, use the device performance prediction model to make predictions to obtain the device performance information within the data transmission period; SP13. Determine whether the current time is an abnormal time. If so, adjust the device performance information within the data sending period according to the current time to obtain the device performance information within the adjusted data sending period.

[0071] Among them, the current time is 12:00 on May 1, 2024, which is a holiday. It is a special date, and the equipment operation pressure may be greater, and the corresponding equipment performance will be reduced.

[0072] In an embodiment of the present application, a device performance prediction model based on a large amount of historical data is obtained. The model not only learns the performance change rules of the device in different time periods to achieve accurate prediction of future device performance and obtain device performance prediction information within the data sending period; it also has the ability to detect abnormal moments. Once it is found that the current moment is an abnormal moment (such as holidays, etc.), the prediction result can be adjusted quickly to ensure that the prediction information remains highly accurate in a complex and changeable actual environment.

[0073] SP2. Determine the data volume and device performance information during the data transmission period to determine whether data segmentation is required; Specifically, the maximum amount of data that can be processed or transmitted within a given time is estimated based on the device performance information; the maximum transmission capacity is compared with the data volume; if the actual data volume is less than or equal to the theoretical maximum transmission capacity, data segmentation is not required; conversely, if the actual data volume is greater than the theoretical maximum transmission capacity, data segmentation is required.

[0074] SP3. If data segmentation is required, determine the initial horizontal segmentation information based on the data type of the target data; determine the initial vertical segmentation information based on the data value corresponding to each data of the target data; When the target data includes only one type of data, the initial horizontal segmentation information is determined as a segmentation position, which is the position of the next row of the last row of data to be processed; when the target data includes multiple types of data, the position between different types of data is determined as the initial horizontal segmentation information; According to the mapping relationship between the data value of each data and the preset quantity and value range, the number of cuts is determined. The higher the value range, the more cuts there are. Then the vertical length is evenly divided to obtain multiple vertical cut positions, which are recorded as the initial vertical cut information.

[0075] SP4. According to the device performance information in the data sending period, the initial horizontal segmentation information and the initial vertical segmentation information are modified to obtain the horizontal segmentation information and the vertical segmentation information; In order to ensure the reliability of data transmission, it is also necessary to ensure that the segmented data can comply with the device performance information within the data transmission period. Therefore, it is also necessary to make corrections based on the device performance information within the data transmission period.

[0076] Specifically, according to the device performance information within the data sending period, the data target position where the sub-data that exceeds the device performance information within the data sending period is located is selected; and horizontal and / or vertical segmentation information is added to the data target position so that the final sub-data can all meet the device performance, thereby obtaining horizontal segmentation information and vertical segmentation information.

[0077] SP5. According to the horizontal segmentation information and the vertical segmentation information, the target data is segmented to obtain a number of segmentation data.

[0078] By adopting the above technical solution, the device performance within the data transmission period is accurately predicted based on the current device performance information and the historical device performance information. Based on the predicted device performance and data volume, it is intelligently determined whether data segmentation is required. If the data volume exceeds the processing capacity of the device within the transmission cycle, the segmentation strategy is further refined. By considering the data type of the target data, the initial horizontal segmentation strategy is determined to ensure that different types of data can be processed in the most appropriate manner. At the same time, the initial vertical segmentation strategy is formulated based on the specific value of each data item. The initial segmentation strategy is dynamically adjusted based on the real-time predicted device performance information to ensure that the segmented data not only meets the transmission requirements, but also optimizes the transmission efficiency, thereby improving the reliability and efficiency of data transmission.

[0079] Further, see Figure 3 , determine the encryption key based on the data security level, the IP of the target device, the data value and the data type, including: Integrate each set of data and the data security level in the IP of the target device to obtain a first value; When the data security level is greater than a preset data security level threshold, executing a first determination step; When the data security level is not greater than the preset data security level threshold, executing a second determination step; Specifically, the process of obtaining the first value includes: adding each group of data and the data security level in the IP of the target device to obtain the first value, such as, if the IP of the target device is 192.168.0.0 and the data security level is 2, then the first value is 192+168+0+0+2=362. Alternatively, adding each group of data in the IP of the target device and taking the data security level as the last digit to obtain the first value, such as (192+168+0+0)*10+2=3602. Of course, other methods are also possible, which are not limited in the embodiments of the present application, and users can set according to actual needs.

[0080] The preset data security level threshold can be customized by the user. When it is greater than the preset level threshold, the encryption key can be determined using the first determination step, otherwise the encryption key is determined using the second determination step.

[0081] In an embodiment of the present application, when the data security level is higher, more complex determination steps are used to generate encryption keys; when the data security level is lower, relatively simplified steps are used; the hierarchical processing method not only improves the processing efficiency of the system, but also ensures data protection effects under different security requirements.

[0082] Specifically, the first determination step includes: S1-S4 (not shown in the drawings), wherein: S1. Dividing the first value by the value corresponding to the data value to obtain a second value, wherein the second value includes an integer divisibility value and a remainder value; As for the data value, when the data is written into the database, the corresponding value value is automatically set according to the set rules.

[0083] S2. If there is no remainder value, divide the integer value by the value corresponding to the data type to obtain a third value, and determine the row value and the column value according to the third value; Different data types correspond to different values. When data is written into the database, the corresponding values ​​of the corresponding data types are automatically set according to the set rules.

[0084] Determining the row value and the column value according to the third value specifically includes: determining the number of keys of the list relationship of the preset key and the encryption key length; dividing the integer divisible value of the third value by the number of keys to obtain an integer a and a remainder b, and if the remainder b is 0, determining the row value to be the last row, and using the column number of the first key length corresponding to the last row as the column value; if the remainder b is not zero, determining the row value to be the remainder b, and using the column number of the first key length corresponding to row b as the column value; In this step, when the second value does not have a remainder, the row value is determined by the third value, and then the column value is determined.

[0085] S3. If there is a remainder value, determine the column value according to the remainder value, and determine the row value corresponding to the column value; In an embodiment of the present application, the number of key lengths of the list relationship between the preset key and the encryption key length is determined, and the remainder value is divided by the number of key lengths to obtain an integer c and a remainder d. If the remainder d is 0, the column value is determined to be the last column, and the row number of the first key corresponding to the last column is used as the row value; if the remainder d is not zero, the column value is determined to be the remainder d, and the row number of the first key corresponding to the d column is used as the row value.

[0086] In this step, when there is no remainder when the remainder value is divided by the key length, the column value is determined first, and then the row value is determined.

[0087] S4. Determine the encryption key from a list relationship of preset keys and encryption key lengths according to the row value and the column value.

[0088] A list relationship between a key and an encryption key length is preset, including a key type and an encryption key length, and the encryption key can be determined from the list according to a remainder and an integer, see Table 1.

[0089] Table 1 For example, the total number of rows is 4, and the total number of columns is 10; when the first value is 321, the value corresponding to the data value is 2, and the value corresponding to the data type is 3; 321 / 2=160 more than 1; 1 / 10=0 more than 1, at this time it is determined to be 112, 3DES, therefore, the key type is determined to be 3des, the length is 112, and then the encryption key is determined according to actual needs.

[0090] For example, the total number of rows is 4 and the total number of columns is 10; when the first value is 168, the value corresponding to the data value is 12. The value corresponding to the data type is 3; 168 / 12=14; 14 / 3=4 remainder 2, 2 / 4=0 remainder 2, which is determined to be RES and 12. Therefore, the key type is determined to be RES and the length is 128, and the encryption key is determined according to actual needs.

[0091] In the embodiment of the present application, the process of determining the encryption key fully considers multiple factors such as the IP of the target device, data security level, data value, and data type. The dynamically generated encryption key not only improves the security of data transmission, but also enhances the flexibility and adaptability of the system. In addition, the row and column position of the encryption key is determined by integer division and remainder operations, which further increases the difficulty of cracking.

[0092] The second determination step includes: SA1-SA2 (not shown in the drawings), wherein: SA1. Determine the encryption key length based on the data value and data type. In one achievable method, a data value and encryption key length mapping table is established to correspond different data value levels to recommended key lengths; the corresponding key length is searched according to the data value; the key length is adjusted according to the data type, for example, for data types that require higher security, the key length can be appropriately increased; In another achievable manner, a weighted calculation is performed based on data value and data type to obtain an evaluation value; the encryption key length is determined based on the evaluation value and a mapping table, wherein the mapping table is a correspondence between multiple evaluation values ​​and multiple encryption key lengths.

[0093] SA2. Determine the encryption key based on the encryption key length and data security level.

[0094] In some embodiments, optionally, an encryption policy library is first established, which contains recommended encryption key lengths and corresponding key generation rules corresponding to different security levels. When data needs to be encrypted, the corresponding key length and generation rules are searched from the policy library according to the security level of the data, and then the encryption key is generated according to the rules.

[0095] Furthermore, the encryption key is determined based on the data security level, the IP of the target device, the data value and the data type, including: According to the IP of the target device and the preset network risk area distribution information, the first security level corresponding to the IP of the target device is determined; according to the data value, the corresponding relationship between the preset value and the security factor is used to obtain the second security level corresponding to the data value; according to the data type, the corresponding relationship between the preset type and the security factor is used to obtain the third security level corresponding to the data type; according to the data security level, the first security level, the second security level and the third security level, the comprehensive security level is determined, and the encryption algorithm is selected and the encryption key is generated according to the comprehensive security level.

[0096] Specifically, the preset network risk regional distribution information refers to the network risk regional information and the security level of each region set based on historical data, geographical location, network environment and other factors, which is used to evaluate the network security risk level of different regions. The correspondence between the preset value and the security factor and the correspondence between the preset type and the security factor are set by the user based on actual experience. The comprehensive security level is a security level determined after comprehensively considering multiple factors such as the data security level, the first security level (network environment risk), the second security level (data value) and the third security level (data type), reflecting the protection intensity required for the data.

[0097] When any of the data security level, the first security level, the second security level and the third security level is greater than the preset level, the highest level will be used as the comprehensive security level; otherwise, a weighted calculation will be performed based on each security level combined with the corresponding weight to obtain the comprehensive security level.

[0098] By adopting the above technical solution, by matching the IP address of the target device with the preset network risk area distribution information, the risk level of the network environment in which the target device is located, that is, the first security level, can be quickly identified; according to the value of the data, using the preset correspondence between the value and the security factor, the system automatically evaluates the importance of the data itself and converts it into the second security level; according to the data type, through the preset correspondence between the type and the security factor, the third security level corresponding to the data type is determined; the information of the four dimensions of data security level, first security level, second security level and third security level is combined to determine the comprehensive security level, and the most appropriate encryption algorithm is selected and the corresponding encryption key is generated accordingly.

[0099] Furthermore, in an achievable embodiment, after the target data corresponding to the data information to be acquired is read from the database, the method further includes: SC1-SC3 (not shown in the drawings), wherein: SC1. Obtain the user's permission level for the data type corresponding to the target device; the permission level is used to measure the level of user access rights to a certain data type on the target device, usually divided according to the user's role, responsibilities or security policy. Different permission levels correspond to different data access and operation permissions.

[0100] The electronic device maintains a user permission database, which records each user's permission level information for different data types on different devices. When the permission level needs to be obtained, the system retrieves the corresponding permission level information from the database based on the user ID, device ID and data type as query conditions.

[0101] SC2. When the authority level does not reach the preset level, a single sensitive word in the data to be processed and a first position corresponding to the single sensitive word are identified; and pairs of sensitive words in the data to be processed and second positions corresponding to the pairs of sensitive words are identified; The preset level is a pre-set permission level threshold, which is used to determine whether the current user has sufficient permissions. A single sensitive word refers to a single word or phrase that is considered sensitive because its content may involve privacy, confidentiality and other information and requires special attention. The first position is used to indicate the specific location where a single sensitive word appears in the data to be processed, which is convenient for subsequent processing or marking. A paired sensitive word refers to a sensitive phrase composed of two or more words, which may have a specific sensitive meaning when they appear together.

[0102] Specifically, when the system detects that the user's authority level is lower than the preset level, the sensitive word recognition mechanism will be triggered. First, the data to be processed will be traversed, and a predefined sensitive word library or algorithm will be used to identify the single sensitive words in it, and the specific positions where these sensitive words appear will be recorded (i.e., the first position). At the same time, it will also check whether there are paired sensitive word combinations in the data. These combinations may be composed of specific vocabulary sequences or patterns, which have higher sensitivity and recognition difficulty. When paired sensitive words are identified, their position information in the data will also be recorded (i.e., the second position).

[0103] In some embodiments, the above steps can be implemented in a variety of ways: Optionally, a regular expression matching method is used. First, a regular expression library containing single sensitive words and paired sensitive word patterns is constructed. Then, the data to be processed is used as input and matched using a regular expression engine. The regular expression library can also be continuously updated and maintained to cope with new sensitive words and patterns.

[0104] Optionally, SC2 identifies a single sensitive word in the data to be processed and a first position corresponding to the single sensitive word; and identifies pairs of sensitive words in the data to be processed and second positions corresponding to the pairs of sensitive words, including: SC21-SC23 (not shown in the drawings), wherein: SC21. Perform data segmentation on the data to be processed to obtain several sub-data, and determine the correlation between adjacent sub-data; the data to be processed may be difficult to process directly due to its large scale, complex structure or noise. Therefore, through data segmentation, the data set can be divided into smaller units, which can simplify the data processing process, improve processing efficiency, and help discover hidden patterns or relationships in the data. In the process of data segmentation, an important consideration is the correlation between adjacent sub-data. Adjacent sub-data refers to adjacent sub-data sets when arranged in sequence after data segmentation. The degree of correlation is used to quantify the similarity, dependency or association between these adjacent sub-data. SC22. Group several sub-data so that the number of data groups is at least greater than 2, and the correlation between the sub-data at the junction of two adjacent data groups is not greater than the preset degree threshold; Optionally, a hierarchical clustering algorithm is used for grouping. First, each sub-data is regarded as an initial data group. Then, the distance or similarity between all data groups is calculated, and the two data groups with the closest distance are merged into a new data group. Repeat this process until all data groups are merged into a large data group or the preset number of groups is reached. During the merging process, it is necessary to monitor the correlation between the sub-data at the junction of adjacent data groups to ensure that they are not greater than the preset degree threshold. If the conditions are not met, it may be necessary to adjust the merging strategy or reset the threshold.

[0105] SC23. For each data group, identify a single sensitive word in the data group and a first position corresponding to the single sensitive word; and identify pairs of sensitive words in the data group and second positions corresponding to the pairs of sensitive words.

[0106] In some embodiments, regular expressions are used to match sensitive words. According to the characteristics and rules of sensitive words, corresponding regular expression patterns are constructed; each word or phrase in the data group is traversed and matched using regular expressions; if the match is successful, the sensitive word and its location information are determined according to the matching result.

[0107] In other embodiments, a machine learning model is used to identify sensitive words. A batch of data containing sensitive words is collected and labeled as a training set; a classification or sequence labeling model, such as naive Bayes, support vector machine, conditional random field, etc., is trained using the training data; after the training is completed, the model is used to classify or label each word or phrase in the data set to identify sensitive words and their location information.

[0108] In an embodiment of the present application, when identifying sensitive words, the method adopts steps such as data segmentation, relevance determination and data grouping. This refined processing method can more accurately identify sensitive information in the data to be processed and effectively desensitize it.

[0109] SC3, desensitizing the sensitive words corresponding to the first position and the second position to obtain desensitized data to be processed; Desensitization refers to a data transformation operation performed on identified sensitive words, which aims to eliminate or blur sensitive information to protect personal privacy or corporate secrets. This processing can be achieved in many ways, such as replacement, deletion, encryption, or obfuscation. For example, in text data, sensitive words can be replaced with asterisks (*) or specific placeholders to achieve desensitization.

[0110] Accordingly, the target data is segmented according to the data volume to obtain several segmented data, including: The target data after desensitization processing is segmented according to the data volume to obtain a number of segmented data.

[0111] It can be seen that in the embodiment of the present application, before data is transmitted, the permission level of the user of the target device is checked and sensitive words are desensitized, thereby effectively preventing the leakage of sensitive information.

[0112] The present application embodiment provides a cloud computing platform 200, such as Figure 4 As shown, including: A receiving module 210, configured to receive a data acquisition request from a target device, wherein the data acquisition request includes information about the data to be acquired and a data security level; A reading module 220 is used to read target data corresponding to the data information to be obtained from a database, wherein the database stores information related to power generation equipment and information related to electricity consumption of virtual power plant data, and the target data includes data to be processed, data volume, data value, and data type; A segmentation module 230 is used to segment the target data according to the data volume to obtain a number of segmented data; An encryption key determination module 240, for determining an encryption key based on the data security level, the IP of the target device, the data value and the data type; The encryption and sending module 250 is used to encrypt a number of segmented data using an encryption key and send the encrypted data to a target device.

[0113] In an achievable embodiment, the segmentation module 230 is further configured to: Predict the device performance information within the data transmission period based on the current device performance information and historical device performance information; Determine the data volume and device performance information during the data transmission period to determine whether data segmentation is required; If data segmentation is required, the initial horizontal segmentation information is determined according to the data type of the target data; the initial vertical segmentation information is determined according to the data value corresponding to each data of the target data; According to the device performance information in the data sending period, the initial horizontal segmentation information and the initial vertical segmentation information are modified to obtain the horizontal segmentation information and the vertical segmentation information; According to the horizontal segmentation information and the vertical segmentation information, the target data is segmented to obtain a number of segmentation data.

[0114] In an achievable embodiment, the segmentation module 230 is further used to: obtain a device performance prediction model, the device performance prediction model is obtained by training the prediction model based on multiple historical device information, the historical device information includes: historical device performance information corresponding to the current period in multiple adjacent historical dates and historical device performance information corresponding to the period after the current period, According to the current device performance information, the device performance prediction model is used to make predictions to obtain the device performance information within the data transmission period; Determine whether the current moment is an abnormal moment. If so, adjust the device performance information within the data sending period according to the current moment to obtain the adjusted device performance information within the data sending period.

[0115] In an achievable embodiment, the encryption key determination module 240 is further configured to: Integrate each set of data and the data security level in the IP of the target device to obtain a first value; When the data security level is greater than a preset data security level threshold, executing a first determination step; When the data security level is not greater than the preset data security level threshold, executing a second determination step; The first determination step includes: obtaining a second value by dividing the first value by a value corresponding to the data value, wherein the second value includes an integer divisor and a remainder value; if there is no remainder value, dividing the integer value by a value corresponding to the data type to obtain a third value, and determining a row value and a column value according to the third value; if there is a remainder value, using the remainder value as a column value and determining a row value corresponding to the column value; determining an encryption key from a list relationship of a preset key and an encryption key length according to the row value and the column value; The second determination step includes: determining the encryption key length according to the data value and data type, and determining the encryption key based on the encryption key length and the data security level.

[0116] In an achievable embodiment, the encryption key determination module 240 is further configured to: Determine the first security level corresponding to the IP address of the target device based on the IP address of the target device and the preset network risk area distribution information; According to the data value, the corresponding relationship between the preset value and the safety factor is used to obtain the second safety level corresponding to the data value; According to the data type, using the correspondence between the preset type and the safety factor, a third safety level corresponding to the data type is obtained; According to the data security level, the first security level, the second security level and the third security level, the comprehensive security level is determined, and the encryption algorithm is selected and the encryption key is generated according to the comprehensive security level.

[0117] In an achievable embodiment, it further includes: Desensitization module, used for: Get the user's permission level for the data type corresponding to the target device; When the authority level does not reach the preset level, a single sensitive word in the data to be processed and a first position corresponding to the single sensitive word are identified; and pairs of sensitive words in the data to be processed and second positions corresponding to the pairs of sensitive words are identified; Desensitizing the sensitive words corresponding to the first position and the second position to obtain desensitized data to be processed; Accordingly, the segmentation module 230 is further used for: The target data after desensitization processing is segmented according to the data volume to obtain a number of segmented data.

[0118] In an achievable embodiment, the desensitization module is used to: Segment the data to be processed to obtain several sub-data, and determine the correlation between adjacent sub-data; Grouping the plurality of sub-data so that the number of data groups is at least greater than 2 and the correlation between the sub-data at the junction of two adjacent data groups is not greater than a preset degree threshold; For each data group, a single sensitive word in the data group and a first position corresponding to the single sensitive word are identified; and pairs of sensitive words in the data group and second positions corresponding to the pairs of sensitive words are identified.

[0119] An electronic device is provided in an embodiment of the present application, such as Figure 5 As shown, Figure 5 The electronic device 300 shown includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, such as through a bus 302. Optionally, the electronic device 300 may also include a transceiver 304. It should be noted that in actual applications, the transceiver 304 is not limited to one, and the structure of the electronic device 300 does not constitute a limitation on the embodiments of the present application.

[0120] The processor 301 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. The processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0121] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0122] The memory 303 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.

[0123] The memory 303 is used to store the application code for executing the solution of the present application, and the execution is controlled by the processor 301. The processor 301 is used to execute the application code stored in the memory 303 to implement the contents shown in the above method embodiment.

[0124] Among them, electronic devices include but are not limited to: mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 5 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0125] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer-readable storage medium is run on a computer, the computer can execute the corresponding content in the aforementioned method embodiment.

[0126] An embodiment of the present application provides a computer program product, including a computer program, which implements the corresponding contents of the aforementioned method embodiment when the computer program is executed by a processor.

[0127] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0128] The above are only some implementation methods of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A virtual power plant data security protection method based on a cloud computing platform, characterized in that: include: Receiving a data acquisition request from a target device, wherein the data acquisition request includes information about data to be acquired and a data security level; Reading target data corresponding to the data information to be acquired from a database, wherein the database stores information related to power generation equipment and information related to electricity consumption of virtual power plant data, wherein the target data includes data to be processed, data volume, data value, and data type; Performing data segmentation on the target data according to the data volume to obtain a number of segmented data; Determine the encryption key based on the data security level, the IP address of the target device, the data value and the data type; The plurality of segmented data are encrypted using an encryption key, and the encrypted data are sent to a target device.

2. The method according to claim 1, characterized in that The target data is segmented according to the data volume to obtain a number of segmented data, including: Predict the device performance information within the data transmission period based on the current device performance information and historical device performance information; Determine the data volume and device performance information during the data transmission period, and determine whether data segmentation is required; If data segmentation is required, the initial horizontal segmentation information is determined according to the data type of the target data; the initial vertical segmentation information is determined according to the data value corresponding to each data of the target data; According to the device performance information in the data sending period, the initial horizontal segmentation information and the initial vertical segmentation information are modified to obtain horizontal segmentation information and vertical segmentation information; The target data is segmented according to the horizontal segmentation information and the vertical segmentation information to obtain a plurality of segmentation data.

3. The method according to claim 2, characterized in that The predicting of device performance information within the data transmission period based on current device performance information and historical device performance information includes: Acquire a device performance prediction model, wherein the device performance prediction model is obtained by training the prediction model based on a plurality of historical device information, wherein the historical device information includes: historical device performance information corresponding to a current period in a plurality of adjacent historical dates and historical device performance information corresponding to a period after the current period, According to the current device performance information, a device performance prediction model is used to perform prediction to obtain device performance information within the data transmission period; Determine whether the current moment is an abnormal moment. If so, adjust the device performance information within the data sending period according to the current moment to obtain the device performance information within the adjusted data sending period.

4. The method according to claim 1, characterized in that The step of determining the encryption key according to the data security level, the IP address of the target device, the data value and the data type includes: Integrate each set of data and the data security level in the IP of the target device to obtain a first value; When the data security level is greater than a preset data security level threshold, executing a first determination step; When the data security level is not greater than a preset data security level threshold, executing a second determination step; The first determination step includes: obtaining a second value by dividing the first value by a value corresponding to the data value, wherein the second value includes an integer divisor and a remainder value; if there is no remainder value, dividing the integer value by a value corresponding to the data type to obtain a third value, and determining a row value and a column value according to the third value; if there is a remainder value, using the remainder value as a column value and determining a row value corresponding to the column value; determining an encryption key from a list relationship of a preset key and an encryption key length according to the row value and the column value; The second determination step includes: determining the encryption key length according to the data value and data type, and determining the encryption key based on the encryption key length and the data security level.

5. The method according to claim 1, characterized in that: The step of determining the encryption key according to the data security level, the IP address of the target device, the data value and the data type includes: Determine a first security level corresponding to the IP address of the target device according to the IP address of the target device and preset network risk area distribution information; According to the data value, the corresponding relationship between the preset value and the safety factor is used to obtain the second safety level corresponding to the data value; According to the data type, using the correspondence between the preset type and the safety factor, a third safety level corresponding to the data type is obtained; According to the data security level, the first security level, the second security level and the third security level, the comprehensive security level is determined, and the encryption algorithm is selected and the encryption key is generated according to the comprehensive security level.

6. The method according to any one of claims 1 to 5, characterized in that: After reading the target data corresponding to the data information to be acquired from the database, the method further includes: Obtaining the permission level of the user corresponding to the target device for the data type; When the authority level does not reach the preset level, a single sensitive word in the data to be processed and a first position corresponding to the single sensitive word are identified; and pairs of sensitive words in the data to be processed and second positions corresponding to the pairs of sensitive words are identified; Desensitizing the sensitive words corresponding to the first position and the second position to obtain desensitized data to be processed; Accordingly, the target data is segmented according to the data volume to obtain a number of segmented data, including: The target data after the desensitization process is segmented according to the data volume to obtain a number of segmented data.

7. The method according to claim 6, characterized in that Identifying a single sensitive word in the data to be processed and a first position corresponding to the single sensitive word; And, identifying the pairs of sensitive words in the data to be processed and the second positions corresponding to the pairs of sensitive words, including: Segmenting the data to be processed to obtain a plurality of sub-data, and determining the correlation between adjacent sub-data; Grouping the plurality of sub-data so that the number of data groups is at least greater than 2, and the correlation between the sub-data at the boundary of two adjacent data groups is not greater than a preset degree threshold; For each data group, a single sensitive word in the data group and a first position corresponding to the single sensitive word are identified; and pairs of sensitive words in the data group and second positions corresponding to the pairs of sensitive words are identified.

8. A cloud computing platform, characterized in that: include: A receiving module, used for receiving a data acquisition request from a target device, wherein the data acquisition request includes information about the data to be acquired and a data security level; A reading module, used to read target data corresponding to the data information to be acquired from a database, wherein the database stores information related to power generation equipment and information related to electricity consumption of virtual power plant data, and the target data includes data to be processed, data volume, data value, and data type; A segmentation module, used for segmenting the target data according to the data volume to obtain a number of segmented data; An encryption key determination module, used to determine an encryption key according to the data security level, the IP address of the target device, the data value and the data type; The encryption and sending module is used to encrypt the plurality of segmented data using an encryption key and send the encrypted data to a target device.

9. An electronic device, characterized in that: include: one or more processors; Memory; One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more applications are configured to: perform the steps of the method according to any one of claims 1 to 7.

10. A virtual power plant data security protection system based on a cloud computing platform, characterized in that: include: The electronic device as claimed in claim 9; as well as, The target device is used to send a data acquisition request and, after receiving the encrypted data, decrypt and aggregate the data.

Images