Secure storage method and device of power grid privilege access credential and storage medium

Abstract

The invention discloses a secure storage method and device for power grid privileged access credentials and a storage medium. The method comprises the following steps: acquiring a privileged access credential, a target access resource and a target privileged access object of a power grid; performing hierarchical encryption processing to obtain a target encryption key of the target privileged access object; based on the target encryption key, performing hierarchical decryption processing on an initial password corresponding to the privileged access credential, an initial password corresponding to the target access resource and an initial password corresponding to the target privileged access object to obtain a target decryption key of the target privileged access object; and storing the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, the initial password corresponding to the target privileged access object, the target encryption key and the target decryption key in a data security access system of the power grid. The technical problem of low storage security of the power grid privilege access credential is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of power grid privileged access credentials, and in particular to a method, device and storage medium for securely storing power grid privileged access credentials. Background Art

[0002] At present, the distributed storage of multi-source power data in the power grid can be based on the "cloud", which is an architecture that integrates power data resources and storage resources. When data users access data resources in the power grid, due to improper management of privileged access credentials, some privileged personnel can directly modify disk files or steal data, causing unpredictable consequences, thus causing the technical problem of low storage security of privileged access credentials in the power grid.

[0003] Currently, no effective solution has been proposed to the technical problem of low storage security of the above-mentioned power grid privileged access credentials. Summary of the invention

[0004] Embodiments of the present invention provide a method, device and storage medium for securely storing power grid privileged access credentials, so as to at least solve the technical problem of low storage security of power grid privileged access credentials.

[0005] According to one aspect of an embodiment of the invention, a method for securely storing privileged access credentials of a power grid is provided. The method may include: obtaining privileged access credentials, target access resources, and target privileged access objects of the power grid, wherein the privileged access objects are used to access the target access resources through the privileged access credentials; performing hierarchical encryption processing on the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain the target encryption key of the target privileged access object; performing hierarchical decryption processing on the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object based on the target encryption key to obtain the target decryption key of the target privileged access object; storing the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, the initial password corresponding to the target privileged access object, the target encryption key, and the target decryption key in the data security access system of the power grid.

[0006] Optionally, hierarchical encryption processing is performed on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain a target encryption key of the target privileged access object, including: performing first-level encryption processing on the initial password corresponding to the privileged access credential to obtain a first encryption key; based on the first encryption key, performing second-level encryption processing on the initial password corresponding to the target access resource to obtain a second encryption key, wherein the complexity of the second encryption key is higher than the complexity of the first encryption key; based on the second encryption key, performing third-level encryption processing on the initial password corresponding to the target privileged access object to obtain a third encryption key, wherein the complexity of the third encryption key is higher than the second encryption key; and determining the third encryption key as the target encryption key.

[0007] Optionally, based on the target encryption key, a hierarchical decryption processing is performed on an initial password corresponding to the privileged access credential, an initial password corresponding to the target access resource, and an initial password corresponding to the target privileged access object to obtain a target decryption key for the target privileged access object, including: dividing the target encryption key to obtain multiple initial key blocks corresponding to multiple target privileged access objects; determining multiple target key blocks based on the multiple initial key blocks; and based on the multiple target key blocks, a hierarchical decryption processing is performed on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain a target decryption key for the target privileged access object.

[0008] Optionally, based on the multiple initial key blocks, determining the multiple target key blocks includes: selecting at least a target value number of initial key blocks from the multiple initial key blocks; and determining the target value number of initial key blocks as the multiple target key blocks.

[0009] Optionally, based on multiple target key blocks, a hierarchical decryption processing is performed on an initial password corresponding to the privileged access credential, an initial password corresponding to the target access resource, and an initial password corresponding to the target privileged access object to obtain a target decryption key for the target privileged access object, including: aggregating the multiple target key blocks to obtain a root key; using the root key, a hierarchical decryption processing is performed on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain a target decryption key for the target privileged access object.

[0010] Optionally, the data security access system includes: a privileged access credential management subsystem and a privileged behavior detection and control subsystem, wherein the privileged access credential management subsystem is used to manage data resources in the resource pool of the power grid, and the privileged behavior detection and control subsystem is used to detect and control access to data resources.

[0011] Optionally, the privileged access credential management subsystem includes: a secure storage module, a secure access gateway module and a middleware module, wherein the secure access gateway module is used to characterize that the target privileged access object successfully accesses the cloud platform resources of the power grid, the middleware module is used to characterize that the target application successfully accesses data resources, and the secure storage module includes: a secure storage and encryption submodule, and a management key distribution and aggregation submodule. The secure storage and encryption submodule is used to encrypt and store data, and the management key distribution and aggregation submodule is used to distribute the obtained multiple keys to different target privileged access objects, and aggregate the multiple keys.

[0012] According to one aspect of an embodiment of the present invention, a secure storage device for power grid privileged access credentials is provided, the device comprising: an acquisition unit, used to acquire the privileged access credentials, target access resources and target privileged access objects of the power grid, wherein the privileged access objects are used to access the target access resources through the privileged access credentials; an encryption processing unit, used to perform hierarchical encryption processing on an initial password corresponding to the privileged access credentials, an initial password corresponding to the target access resource, and an initial password corresponding to the target privileged access object to obtain a target encryption key of the target privileged access object; a decryption processing unit, used to perform hierarchical decryption processing on the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object based on the target encryption key to obtain a target decryption key of the target privileged access object; a storage unit, used to store the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, the initial password corresponding to the target privileged access object, the target encryption key and the target decryption key in a data security access system of the power grid.

[0013] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored program, wherein when the program is executed by a processor, the device where the storage medium is located is controlled to execute the method in the embodiment of the present invention.

[0014] According to another aspect of an embodiment of the present invention, a processor is provided. The processor is used to run a program, wherein the method in the embodiment of the present invention is executed when the program is run.

[0015] According to another aspect of the embodiments of the present invention, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the method in the embodiments of the present invention is implemented.

[0016] According to another aspect of an embodiment of the present invention, an electronic device is provided, the electronic device comprising a processor and a memory for storing instructions executable by the processor, wherein the processor is configured to execute the instructions to implement the method in the embodiment of the present invention.

[0017] In an embodiment of the present invention, privileged access credentials, target access resources and target privileged access objects of a power grid are obtained, wherein the privileged access objects are used to access the target access resources through the privileged access credentials; an initial password corresponding to the privileged access credentials, an initial password corresponding to the target access resource, and an initial password corresponding to the target privileged access object are hierarchically encrypted to obtain a target encryption key of the target privileged access object; based on the target encryption key, a hierarchical decryption process is performed on the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain a target decryption key of the target privileged access object; the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, the initial password corresponding to the target privileged access object, the target encryption key and the target decryption key are stored in a data security access system of the power grid. That is to say, the embodiments of the present invention can first obtain the privileged access credentials, target access resources and target privileged access objects of the power grid, and then perform hierarchical encryption processing on the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resources, and the initial password corresponding to the target privileged access object, so as to obtain the target encryption key of the target privileged access object, and then according to the target encryption key obtained above, the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object can be hierarchically decrypted to obtain the target decryption key of the target privileged access object, and finally the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, the initial password corresponding to the target privileged access object, the target encryption key and the target decryption key obtained in the above process are stored in the data security access system of the power grid. Considering that after obtaining the privileged access credentials, the target access resources and the target privileged access objects, the initial passwords corresponding to the obtained privileged access credentials, the initial passwords corresponding to the target access resources and the initial passwords corresponding to the target privileged access objects are hierarchically encrypted to obtain the target encryption keys. According to the target encryption keys, the initial passwords corresponding to the above data can be hierarchically decrypted to obtain the target decryption keys. The initial passwords, target decryption keys and target encryption keys corresponding to the different data obtained above are stored in the data security access system to achieve the purpose of securely storing the power grid privileged access credentials, thereby solving the technical problem of low storage security of the power grid privileged access credentials and achieving the technical effect of improving the storage security of the power grid privileged access credentials. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0019] Figure 1 is a flow chart of a method for securely storing power grid privileged access credentials according to an embodiment of the present invention;

[0020] Figure 2 is a schematic diagram of a data security access system according to an embodiment of the present invention;

[0021] Figure 3 is a schematic diagram of a secure storage module for privileged access credentials according to an embodiment of the present invention;

[0022] Figure 4 The invention relates to a secure storage device for privileged access credentials of a power grid according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] According to an embodiment of the present invention, a method for securely storing privileged access credentials for a power grid is provided. It should be noted that in the flowchart of the accompanying drawings, the steps shown therein can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in an order different from that shown here.

[0026] The following is an introduction to a method for securely storing privileged access credentials for a power grid according to an embodiment of the present invention.

[0027] Figure 1is a flow chart of a method for securely storing power grid privileged access credentials according to an embodiment of the present invention. Figure 1 As shown, the method for securely storing the power grid privileged access credentials may include the following steps:

[0028] Step S101 : obtaining a privileged access credential, a target access resource, and a target privileged access object of a power grid, wherein the privileged access object is used to access the target access resource through the privileged access credential.

[0029] In the technical solution provided in step S101 of the present invention, privileged access credentials, target access resources and target privileged access objects of the power grid can be obtained. Among them, the target access resources can be called computing resources. The privileged access credentials are used to authenticate and authorize users or entities to perform privileged operations. The power grid can be called a digital power grid.

[0030] Optionally, the target privileged access object may be called a privileged access personnel, such as an administrator. It should be noted that only an example of the object type of the target privileged access object is given here, and the object type of the target privileged access object is not specifically limited.

[0031] For example, the privileged access credentials, computing resources, and administrators of the power grid are obtained, and the administrators can access the computing resources through the privileged access credentials.

[0032] Step S102 , hierarchical encryption is performed on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain a target encryption key of the target privileged access object.

[0033] In the technical solution provided in the above step S102 of the present invention, after obtaining the privileged access credential, the target access resource and the target privileged access object, the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource and the initial password corresponding to the target privileged access object can be hierarchically encrypted using a standard symmetric encryption algorithm to obtain a target encryption key of the target privileged access object. The standard symmetric encryption algorithm can be an encryption algorithm using a 192-bit key length (AES-192) or an encryption algorithm using a 256-bit key length (AES-256).

[0034] Optionally, hierarchical encryption processing is used to characterize hierarchical management of data during the encryption process, improve data security, ensure that only authorized users or systems can access the data, and adjust the encryption strength according to the sensitivity of the data to achieve effective use of resources and reasonable control of risks.

[0035] It should be noted that this is only a preferred implementation method for obtaining the target encryption key of the target privileged access object, and does not specifically limit the process and method of obtaining the target encryption key of the target privileged access object. As long as the purpose of obtaining the target encryption key is achieved after the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object are hierarchically encrypted, it is within the protection scope of the present invention and will not be repeated here.

[0036] Step S103, based on the target encryption key, hierarchical decryption processing is performed on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain a target decryption key of the target privileged access object.

[0037] In the technical solution provided in the above step S103 of the present invention, based on the obtained target encryption key, the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object can be hierarchically decrypted using a secret sharing algorithm and a root key aggregation algorithm to achieve the purpose of obtaining the target decryption key of the privileged access object.

[0038] Optionally, a root key aggregation algorithm is used to merge multiple keys into a root key, and this root key can be used to encrypt and decrypt data without exposing or storing the original key, thereby improving the complexity and security of the key.

[0039] Optionally, the above process of obtaining the target encryption key and the target decryption key can be implemented by a management and storage algorithm based on a distributed secret sharing primitive. The implementation of the secret sharing primitive can be divided into three stages: an initialization stage, a management key dispersion stage, and a management key aggregation stage. Based on the above three stages, the storage and extraction of privileged access credentials can be realized.

[0040] It should be noted that this is only a preferred implementation method for obtaining the target decryption key of the target privileged access object, and the process and method for obtaining the target decryption key of the target privileged access object are not specifically limited. As long as the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object are hierarchically decrypted according to the obtained target encryption key, the process and method for obtaining the target decryption key of the target privileged access object are all within the scope of protection of the present invention and will not be listed here.

[0041] Step S104, storing the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, the initial password corresponding to the target privileged access object, the target encryption key and the target decryption key in the data security access system of the power grid.

[0042] In the technical solution provided in the above step S104 of the present invention, the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, the initial password corresponding to the target privileged access object, and the obtained target encryption key and target decryption key are stored in the data security access system.

[0043] Optionally, the data security access system can be called a multi-source power data security access system based on a high-availability secret sharing architecture, wherein the high-availability secret sharing architecture can be referred to as a high-availability architecture, and the high-availability architecture can be an architecture implemented by a high-availability protocol.

[0044] Furthermore, the high-availability architecture adopts a privileged access credential management model based on a secret sharing security gateway, which is more advantageous in dealing with technical challenges such as heterogeneous computing resources, a large number of permissions, and complex permission configuration. The security gateway adopts a non-intrusive architecture that is independent of the various "cloud", "edge", and "end" computing nodes of the digital power grid, which is more advantageous in reducing performance impact.

[0045] In the above steps S101 to S104 of the present invention, the privileged access credentials, target access resources and target privileged access objects of the power grid can be first obtained, and then the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resources, and the initial password corresponding to the target privileged access object can be hierarchically encrypted to obtain the target encryption key of the target privileged access object. Then, based on the target encryption key obtained above, the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object can be hierarchically decrypted to obtain the target decryption key of the target privileged access object. Finally, the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, the initial password corresponding to the target privileged access object, the target encryption key and the target decryption key obtained in the above process are stored in the data security access system of the power grid. Considering that after obtaining the privileged access credentials, the target access resources and the target privileged access objects, the initial passwords corresponding to the obtained privileged access credentials, the initial passwords corresponding to the target access resources and the initial passwords corresponding to the target privileged access objects are hierarchically encrypted to obtain the target encryption keys. According to the target encryption keys, the initial passwords corresponding to the above data can be hierarchically decrypted to obtain the target decryption keys. The initial passwords, target decryption keys and target encryption keys corresponding to the different data obtained above are stored in the data security access system to achieve the purpose of securely storing the power grid privileged access credentials, thereby solving the technical problem of low storage security of the power grid privileged access credentials and achieving the technical effect of improving the storage security of the power grid privileged access credentials.

[0046] The above method of this embodiment is further introduced below.

[0047] As an optional implementation method, hierarchical encryption processing is performed on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain a target encryption key of the target privileged access object, including: performing a first-level encryption processing on the initial password corresponding to the privileged access credential to obtain a first encryption key; based on the first encryption key, performing a second-level encryption processing on the initial password corresponding to the target access resource to obtain a second encryption key, wherein the complexity of the second encryption key is higher than the complexity of the first encryption key; based on the second encryption key, performing a third-level encryption processing on the initial password corresponding to the target privileged access object to obtain a third encryption key, wherein the complexity of the third encryption key is higher than the second encryption key; and determining the third encryption key as the target encryption key.

[0048] In this embodiment, according to the management and storage algorithm, the initial password corresponding to the privileged access credential is first encrypted to obtain the first encryption key, and then the initial password corresponding to the target access resource is encrypted at the second level according to the first encryption key obtained above to obtain the second encryption key, and then the initial password corresponding to the target privileged access object is encrypted at the third level according to the second encryption key to obtain the third encryption key, and finally the third encryption key obtained above can be determined as the target encryption key. Using the above process, the initial passwords of different data can be encrypted at different levels to achieve the purpose of determining the target encryption key, and the complexity of the keys obtained according to the different levels is gradually increased, which improves the security of the keys.

[0049] For example, in the management and storage algorithm, the password corresponding to each privileged access credential is encrypted with a primary key; for each computing resource, after encryption with the primary key, it is encrypted with a secondary key; for each privileged access personnel, after encryption with the secondary key, it is encrypted with the management key, so as to obtain the final encryption key, and the standard symmetric encryption algorithm is used to implement encryption in the above process (such as AES-192, AES-256, etc.).

[0050] As an optional implementation method, based on the target encryption key, the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object are hierarchically decrypted to obtain the target decryption key of the target privileged access object, including: dividing the target encryption key to obtain multiple initial key blocks corresponding to multiple target privileged access objects; determining multiple target key blocks based on the multiple initial key blocks; based on the multiple target key blocks, hierarchically decrypting the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain the target decryption key of the target privileged access object.

[0051] In this embodiment, after obtaining the target encryption key, the target encryption key is divided using a secret sharing algorithm to obtain multiple initial key blocks corresponding to multiple target privileged access objects, and then multiple target key blocks are determined based on the multiple initial key blocks obtained above. According to the multiple target key blocks, the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object can be hierarchically decrypted to achieve the purpose of obtaining the target decryption key of the target privileged access object. Among them, the multiple target privileged access objects can be represented as N privileged access credential administrators.

[0052] Optionally, the target encryption key is divided and processed using a secret sharing algorithm to obtain multiple initial key blocks, and the multiple initial key blocks are respectively sent to the corresponding multiple target privileged access objects, and multiple target key blocks are determined based on the multiple target privileged access objects, wherein the target privileged access object can be a privileged access credential administrator, or simply an administrator. For example, the secret sharing algorithm can be used to divide the management key finally obtained into N key blocks, and the N key blocks are secretly sent to N privileged access credential administrators, and the purpose of determining multiple target key blocks can be achieved based on the N privileged access credential administrators.

[0053] Optionally, according to the initialization phase and the key distribution management phase in the secret sharing primitive, multiple target key blocks can be determined. In the initialization phase: In the initialization phase, a finite field GF(p) is first defined, where p is a large prime number. Then, the secure storage module of the privileged access credential will randomly select N non-zero elements in GF(p) and record them as (x1, x2, ..., x N ), and publicly send N non-zero elements to the corresponding N administrators, denoted as (A1, A2, ..., A N ). N non-zero elements are used to represent the specific identity of the administrator, such as element x r Can represent administrator A r .

[0054] Specifically, the management key dispersion phase: In this phase, the secure storage module will select a random integer s less than a large prime number p as A K , and select any K-1 elements in GF(p), denoted as (a1, a2, ..., a K-1 ). Based on K-1 elements, perform the following polynomial function. Where a0=s:

[0055] f(x)=a0+…+a K-1 x K-1 (modp)

[0056] For N administrators (A1, A2, ..., A N Any administrator A in r The secure storage module for privileged access credentials will generate a unique key that matches the administrator A according to the following formula: r The corresponding s r :

[0057]

[0058] Based on the above formula, the obtained s r Sent secretly to Admin A r .

[0059] As an optional implementation manner, multiple target key blocks are determined based on multiple initial key blocks, including: selecting at least a target value of initial key blocks from the multiple initial key blocks; and determining the target value of initial key blocks as multiple target key blocks.

[0060] In this embodiment, after obtaining multiple initial key blocks, at least a target value of initial key blocks can be selected from the multiple initial key blocks, and then the target value of initial key blocks can be determined as multiple target key blocks. The target value can be a preset value and can be represented by K.

[0061] For example, when there are N administrators, at least K of them are selected to provide their key blocks at the same time, and then based on the K key blocks, the root key aggregation algorithm is used to realize the storage of the decrypted credential password.

[0062] It should be noted that this is only a preferred implementation method for determining multiple target key blocks, and does not specifically limit the process and method for determining multiple target key blocks.

[0063] As an optional implementation method, based on multiple target key blocks, a hierarchical decryption processing is performed on an initial password corresponding to a privileged access credential, an initial password corresponding to a target access resource, and an initial password corresponding to a target privileged access object to obtain a target decryption key of the target privileged access object, including: aggregating multiple target key blocks to obtain a root key; using the root key, a hierarchical decryption processing is performed on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain the target decryption key of the target privileged access object.

[0064] In this embodiment, a root key aggregation algorithm is used to aggregate the multiple target key blocks that have been obtained to obtain a root key. Based on the root key, a hierarchical decryption process is performed on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to achieve the purpose of obtaining the target decryption key of the target privileged access object.

[0065] Optionally, the process of determining the root key using the root key aggregation algorithm can be implemented through the management key aggregation phase in the secret sharing primitive, wherein the management key aggregation phase: Now assume that there are any K administrators (A1, A2, ..., A K ) wishes to submit (x1,x2,...,x K) to recover the final management key. The secure storage module will perform the final management key aggregation process, the implementation process of which is shown in the following formula, and the Lagrange interpolation formula is used:

[0066]

[0067] Furthermore, based on the three stages described above, the storage and retrieval of privileged access credentials can be realized. After the credential password management module is initialized, all passwords are encrypted and stored in a secure memory. When more than K administrators submit key blocks and recover the final management key, the module will decrypt the secondary key, primary key, and privileged access credentials in turn, and then start the verification of privileged access.

[0068] As an optional implementation method, the data security access system includes: a privileged access credential management subsystem and a privileged behavior detection and control subsystem, wherein the privileged access credential management subsystem is used to manage data resources in a resource pool of a power grid, and the privileged behavior detection and control subsystem is used to detect and control access to data resources.

[0069] In this embodiment, the data security access system includes: a privileged access credential management subsystem and a privileged behavior detection and control subsystem, wherein the privileged access credential management subsystem is used to allow privileged personnel and privileged applications to access data resources or power grid resources in the power grid resource pool, and the privileged behavior detection and control subsystem is closely integrated with the security access gateway module in the privileged access credential management subsystem, thereby realizing the detection and control of relevant data. It should be noted that only examples are given here to illustrate the contents included in the data security access system, and the contents included in the data security access system are not specifically limited.

[0070] Optionally, the privileged behavior detection and control subsystem may include: a privileged behavior information collection and extraction module, a privileged behavior analysis and control module and a privileged behavior database, wherein the privileged behavior information collection and extraction module may include: a privileged behavior information collection submodule and a privileged behavior information extraction submodule, and the privileged behavior analysis and control module may include: a privileged behavior analysis submodule and a privileged behavior control submodule.

[0071] Optionally, the privileged behavior information collection submodule is used to extract information during the privileged personnel access process, and the information content includes privileged behavior images and privileged behavior related metadata. The privileged behavior information extraction submodule includes privileged behavior information detection and privileged behavior information recognition, the purpose of which is to convert the pixel information in the privileged behavior image into machine-readable text information for analysis and control.

[0072] Optionally, the privileged behavior analysis submodule is used to comprehensively analyze the privileged behavior sequence metadata and text information, and correspond to the privileged behavior database of the power grid to determine the specific operation, and then determine whether the operation is sensitive and whether there is a security threat. The privileged behavior control submodule is used to release or intercept the operations of privileged power grid personnel based on the analysis results, and for privileged behaviors that are more sensitive in the gray area, this module has designed a secondary review and alarm process to notify the administrator for dynamic approval. It should be noted that Figure 2 is a schematic diagram of a data security access system according to an embodiment of the present invention. Figure 2 As shown, the data interaction method connected by the solid arrows can be used to represent the detection and control process of privileged behaviors based on the privileged behavior detection and control subsystem.

[0073] As an optional implementation method, the privileged access credential management subsystem includes: a secure storage module, a secure access gateway module and a middleware module, wherein the secure access gateway module is used to characterize that the target privileged access object successfully accesses the cloud platform resources of the power grid, the middleware module is used to characterize that the target application successfully accesses the data resources, and the secure storage module includes: a secure storage and encryption submodule, and a management key distribution and aggregation submodule. The secure storage and encryption submodule is used to encrypt and store data, and the management key distribution and aggregation submodule is used to distribute the obtained multiple keys to different target privileged access objects, and aggregate the multiple keys.

[0074] In this embodiment, the privileged access credential management subsystem may include: a secure storage module, a secure access gateway module, a middleware module and a high-availability architecture, wherein the secure storage module may be referred to as a secure storage module for privileged access credentials, and the middleware module may be referred to as a privileged management and control middleware module.

[0075] Optionally, the secure access gateway module is mainly for the access process of privileged personnel, while the privileged management and control middleware module is mainly for the access process of privileged applications. The secure access gateway module allows privileged personnel to access cloud platform resources using a browser. Before establishing a connection with resources on the power grid, the identity of the privileged personnel needs to be authenticated through access credentials and the password management module. If the authentication is successful, tokens are returned to the user to access resources. After the tokens are returned, the privileged personnel can use the tokens to apply to the secure access proxy gateway for access to resources. Once the connection is established, the secure access proxy gateway becomes responsible for communication between users and resources. During this process, the secure access gateway module can maintain the connection between privileged personnel and power grid resources, assist in extracting behavior detection information, and support real-time privileged behavior detection to control privileged behavior. It should be noted that, if Figure 2As shown, the data interaction method connected by the dotted arrows is used to represent the privileged personnel security access process implemented based on the security access gateway module.

[0076] Optionally, the privilege management middleware module can verify the application fingerprint and confirm the permission when the application is connected. When a privileged application accesses power grid resources, it needs to submit a request for access to the middleware module. The secure storage module of privileged access credentials can verify the fingerprint of the application and return Tokens if successful. The privilege management middleware module establishes a data link between the authenticated application and the power grid database and ensures the behavior security of the privileged application. It should be noted that if Figure 2 As shown, the data interaction method connected by the double solid arrows can be used to represent the privileged application security access process implemented based on the privilege management and control middleware module.

[0077] In this embodiment, the secure storage module may include: a secure storage and encryption submodule, and a management key distribution and aggregation submodule, wherein the secure storage and encryption submodule may be referred to as a secure storage and encryption submodule for privileged access credentials.

[0078] Optionally, the secure storage and encryption submodule is used to perform multi-level encryption on the privileged access credentials hosted in the privileged access credential management system, and store the encrypted secondary key, primary key and privileged access credentials. The multi-level encryption process is to achieve the correspondence between keys and attributes, wherein the final management key corresponds to the administrator of the power grid system, the secondary key corresponds to the privileged access right, and the primary key corresponds to the specific power grid resource. The secure storage and encryption submodule performs step-by-step encryption before distributing the final management key, and performs step-by-step decryption after the obtained multiple management keys are aggregated, and the decryption result will be used for the privileged access verification process.

[0079] Optionally, the management key distribution and aggregation submodule is used to perform management key distribution and management key aggregation. The results of management key distribution will be sent to the administrators of the selected N power grid systems, and management key aggregation can be implemented with the participation of only the administrators of any K power grid systems. The input of management key distribution and the output of management key aggregation are both connected to the secure storage and encryption submodule.

[0080] Further, the secure storage module of privileged access credentials can achieve the following five functions. Credential management function: Administrators can register resources in the power grid with the module, including administrator access credentials, database credentials or other credentials. Among them, the secure storage module of privileged access credentials will automatically manage all credential management; dynamic password management function: The secure storage module of privileged access credentials can connect to power grid resources and create dynamic credentials and passwords for these resources. Authentication function: Authenticate privileged personnel and applications, and allow authenticated privileged personnel or programs to obtain their credential passwords; Credential life cycle management function: If the power grid resource has exceeded the lease period, the secure storage module of privileged access credentials will automatically cancel its password. Password rotation function: If the password has not been changed for a long time or is in a leaked state (the password change cycle can be defined by the administrator of the power grid), the secure storage module of privileged access credentials will automatically change the password; in addition, if the storage is attacked or the storage device fails, the secure storage module of privileged access credentials will automatically freeze, and the encryption key (KEK), decryption key (DEK) and credential password need to be re-encrypted.

[0081] In this embodiment, the privileged access credentials, target access resources and target privileged access objects of the power grid can be obtained first, and then the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object can be hierarchically encrypted to obtain the target encryption key of the target privileged access object. Then, based on the target encryption key obtained above, the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object can be hierarchically decrypted to obtain the target decryption key of the target privileged access object. Finally, the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, the initial password corresponding to the target privileged access object, the target encryption key and the target decryption key obtained in the above process are stored in the data security access system of the power grid. Considering that after obtaining the privileged access credentials, the target access resources and the target privileged access objects, the initial passwords corresponding to the obtained privileged access credentials, the initial passwords corresponding to the target access resources and the initial passwords corresponding to the target privileged access objects are hierarchically encrypted to obtain the target encryption keys. According to the target encryption keys, the initial passwords corresponding to the above data can be hierarchically decrypted to obtain the target decryption keys. The initial passwords, target decryption keys and target encryption keys corresponding to the different data obtained above are stored in the data security access system to achieve the purpose of securely storing the power grid privileged access credentials, thereby solving the technical problem of low storage security of the power grid privileged access credentials and achieving the technical effect of improving the storage security of the power grid privileged access credentials.

[0082] The technical solution of the embodiment of the present invention is illustrated below in conjunction with preferred implementation modes.

[0083] The distributed storage of multi-source power data in the power grid can be an architecture that integrates power data resources and storage resources with the "cloud" as the core. Compared with the cloud platform for commercial use, the issue of secure access for data users becomes more important in the process of multi-source power data management, mainly manifested in the increased harm caused by improper management of privileged access credentials. The data center of the digital power grid provides its users with massive storage resources and data resources. Once a malicious attacker accesses the power grid database, he or she can use privileged operations to steal or tamper with data resources.

[0084] In the process of power data analysis and application development, the process of privileged personnel or programs accessing power grid resources can be divided into three categories: privileged personnel or programs themselves have access credentials to access power grid resources, so they can illegally bypass supervision and access resources; privileged personnel or programs access resources through the cloud platform at the bottom of the power grid; privileged personnel create work orders through the business management system of the power grid and submit them to the cloud platform, and then establish a secure access path. In a digital power grid with multi-source data fusion, if the above three access methods exist at the same time, it may cause confusion in the management of privileged access credentials, and then create security threats, and there will be technical problems such as low storage security of privileged access credentials for power grids.

[0085] Among them, privileged access credentials are improperly managed: some privileged personnel can directly modify disk files, bypass the detection of the supervision system, log in to the physical server or virtual machine in the power grid to steal data. For example, some privileged personnel log in to the underlying cloud platform, obtain the host identifier in a certain cloud, and then copy it to the cloud host and mount it to another operating system. Finally, edit the login credential file and delete the line of login username and password, thereby bypassing monitoring and directly stealing data from power grid resources.

[0086] Therefore, in order to solve the above problems, the present invention proposes a new multi-source power data security access system, which realizes the secure access of privileged personnel and privileged applications to multi-source power data based on a highly available security access agent and distributed secret sharing primitives. By combining this architecture with distributed secret sharing primitives, the privileged personnel and privileged applications can achieve secure access through power grid privileged access credentials, and can continuously implement management and tracking after personnel and applications access, so as to achieve the technical effect of improving the storage security of power grid privileged access credentials.

[0087] In this embodiment, a multi-source power data security access system based on a high-availability secret sharing architecture is proposed, wherein the high-availability secret sharing architecture can be referred to as a high-availability architecture, and the high-availability architecture can be an architecture implemented by a high-availability protocol.

[0088] Optionally, the high-availability architecture adopts a privileged access credential management model based on a secret sharing security gateway, which is more advantageous in dealing with technical challenges such as heterogeneous computing resources, a large number of permissions, and complex permission configuration. The security gateway adopts a non-intrusive architecture independent of the various "cloud", "edge", and "end" computing nodes of the digital power grid, which is more advantageous in reducing performance impact.

[0089] In this embodiment, if Figure 2 As shown, the data security access system may include: a privileged access credential management subsystem 201 , a privileged behavior detection and control subsystem 202 , a digital grid resource pool 203 , a digital grid privileged user 204 , and a digital grid privileged application 205 .

[0090] Optionally, the privileged access credential management subsystem 201 includes: a privileged access credential security storage module 2011, a secure access gateway module 2012, a privileged control middleware module 2013 and a high-availability architecture 2014. The privileged behavior detection and control subsystem 202 includes: a privileged behavior information collection and extraction module 2021, a privileged behavior analysis and control module 2022 and a privileged behavior database 2023.

[0091] The privileged access credential management subsystem 201 is used to allow privileged personnel and privileged applications to access data resources or power grid resources in the power grid resource pool.

[0092] The privileged access credential secure storage module 2011 is used to securely store the relevant data of the privileged access credential.

[0093] The secure access gateway module 2012 is used for the access process for privileged personnel.

[0094] The privilege management and control middleware module 2013 is used for the access process for privileged applications.

[0095] High Availability Architecture 2014, used to characterize a high availability protocol.

[0096] Optionally, the secure access gateway module allows privileged personnel to access cloud platform resources using a browser. Before establishing a connection with resources on the power grid, the identity of the privileged personnel needs to be authenticated through access credentials and the password management module. If the authentication is successful, tokens are returned to the user to access the resources. After the tokens are returned, the privileged personnel can use the tokens to apply to the secure access proxy gateway for access to resources. Once the connection is established, the secure access proxy gateway becomes responsible for communication between users and resources. During this process, the secure access gateway module can maintain the connection between privileged personnel and power grid resources, assist in extracting behavior detection information, and support real-time privileged behavior detection to control privileged behavior. It should be noted that, if Figure 2 As shown, the data interaction method connected by the dotted arrows is used to represent the privileged personnel security access process implemented based on the security access gateway module.

[0097] Optionally, the privilege management middleware module can verify the application fingerprint and confirm the permission when the application is connected. When a privileged application accesses power grid resources, it needs to submit a request for access to the middleware module. The secure storage module of privileged access credentials can verify the fingerprint of the application and return Tokens if successful. The privilege management middleware module establishes a data link between the authenticated application and the power grid database and ensures the behavior security of the privileged application. It should be noted that if Figure 2 As shown, the data interaction method connected by the double solid arrows can be used to represent the privileged application security access process implemented based on the privilege management and control middleware module.

[0098] The privileged behavior detection and control subsystem 202 is used to closely integrate with the secure access gateway module in the privileged access credential management subsystem, thereby realizing the detection and control of relevant data.

[0099] Optionally, the privileged behavior information collection and extraction module 2021 may include: a privileged behavior information collection submodule and a privileged behavior information extraction submodule, and the privileged behavior analysis and control module 2022 may include: a privileged behavior analysis submodule and a privileged behavior control submodule. The privileged behavior database 2023 is used to store relevant privileged behavior data.

[0100] Optionally, the privileged behavior information collection submodule is used to extract information during the privileged personnel access process, and the information content includes privileged behavior images and privileged behavior related metadata. The privileged behavior information extraction submodule includes privileged behavior information detection and privileged behavior information recognition, the purpose of which is to convert the pixel information in the privileged behavior image into machine-readable text information for analysis and control.

[0101] Optionally, the privileged behavior analysis submodule is used to comprehensively analyze the privileged behavior sequence metadata and text information, and correspond to the privileged behavior database of the power grid to determine the specific operation, and then determine whether the operation is sensitive and whether there is a security threat. The privileged behavior control submodule is used to release or intercept the operations of privileged power grid personnel based on the analysis results, and for privileged behaviors that are more sensitive in the gray area, this module has designed a secondary review and alarm process to notify the administrator for dynamic approval. It should be noted that if Figure 2 As shown, the data interaction method connected by the solid arrows can be used to represent the detection and control process of privileged behaviors based on the privileged behavior detection and control subsystem.

[0102] In this embodiment, in order to realize the secure storage of privileged access credentials of the digital power grid, it can be realized based on the management and storage algorithm of the distributed secret sharing primitive. In this algorithm, the password corresponding to each privileged access credential is encrypted with a primary key; for each computing power resource, after being encrypted with the primary key, it is encrypted with a secondary key; for each privileged access personnel, after being encrypted with the secondary key, it is encrypted with a management key, so that the final encryption key can be obtained, and the encryption is realized by using a standard symmetric encryption algorithm in the above process, such as AES-192, AES-256, etc.

[0103] Optionally, after encryption is performed, a secret sharing algorithm is used to divide the final management key into N key blocks, and the N key blocks are secretly sent to N privileged access credential administrators. When there are N administrators, at least K of them are selected to provide their key blocks at the same time, and then based on the K key blocks, the root key aggregation algorithm is used to realize the storage of the decrypted credential password.

[0104] Optionally, the implementation of the secret sharing primitive can be divided into three stages: initialization stage, management key dispersion stage and management key aggregation stage. Based on the above three stages, the storage and extraction of privileged access credentials can be realized.

[0105] Optionally, initialization phase: In the initialization phase, a finite field GF(p) is first defined, where p is a large prime number. Then, the secure storage module of the privileged access credentials will randomly select N non-zero elements in GF(p) and record them as (x1, x2, ..., x N ), and publicly send N non-zero elements to the corresponding N administrators, denoted as (A1, A2, ..., A N ). N non-zero elements are used to represent the specific identity of the administrator, such as element x r Can represent administrator A r .

[0106] Optionally, manage the key dispersion phase: In this phase, the secure storage module will select a random integer s less than a large prime number p as A K , and select any K-1 elements in GF(p), denoted as (a1, a2, ..., a K-1 ). Based on K-1 elements, perform the following polynomial function. Where a0=s:

[0107] f(x)=a0+…+a K-1 x K-1 (modp)

[0108] For N administrators (A1, A2, ..., A N Any administrator A in r The secure storage module for privileged access credentials will generate a unique key that matches the administrator A according to the following formula: r The corresponding s r :

[0109]

[0110] Based on the above formula, the obtained s r Sent secretly to Admin A r .

[0111] Optionally, in the management key aggregation phase: Now assume that there are any K administrators (A1, A2, ..., A K ) wishes to submit (x1,x2,...,x K ) to recover the final management key. The secure storage module will perform the final management key aggregation process, the implementation process of which is shown in the following formula, and the Lagrange interpolation formula is used:

[0112]

[0113] It should be noted that based on the above three stages, the storage and retrieval of privileged access credentials can be realized. After the credential password management module is initialized, all passwords are encrypted and stored in a secure memory. When more than K administrators submit key blocks and recover the final management key, the module will decrypt the secondary key, primary key and privileged access credentials in turn, and then start the verification of privileged access.

[0114] The digital power grid resource pool 203 is used to store power grid data and basic power grid resources.

[0115] Digital grid privileged user 204 is used to store user access information of privileged users.

[0116] Optionally, the digital grid privileged user 204 may access the relevant data in the secure storage module 2011 of the privileged access credentials in the privileged access credential management subsystem 201 by using an access method such as an access browser.

[0117] The digital grid privileged application 205 is used to store application access information of the privileged application.

[0118] Optionally, the digital grid privileged application 205 may access the grid data in the digital grid resource pool 203 through the privileged management and control middleware module 2013 .

[0119] In this embodiment, considering that after obtaining the privileged access credentials, the target access resource and the target privileged access object, the initial password corresponding to the obtained privileged access credentials, the initial password corresponding to the target access resource and the initial password corresponding to the target privileged access object are hierarchically encrypted to obtain the target encryption key. According to the target encryption key, the initial password corresponding to the above data can be hierarchically decrypted to obtain the target decryption key. The initial password, target decryption key and target encryption key corresponding to the different data obtained above are stored in the data security access system, so as to achieve the purpose of securely storing the power grid privileged access credentials, thereby solving the technical problem of low storage security of the power grid privileged access credentials and achieving the technical effect of improving the storage security of the power grid privileged access credentials.

[0120] In an embodiment of the present invention, Figure 3 is a schematic diagram of a secure storage module for privileged access credentials according to an embodiment of the present invention. Figure 3 As shown, the secure storage module 2011 for privileged access credentials may include: a secure storage and encryption submodule 20111 and a management key distribution and aggregation submodule 20112 .

[0121] The secure storage and encryption submodule 20111 is used to perform multi-level encryption on the privileged access credentials of the power grid resources in the privileged access credential management system before hosting, obtain the encrypted privileged access credentials, and store the encrypted secondary key, primary key, management key and privileged access credentials. Among them, the secure storage and encryption submodule can be called the privileged access credential secure storage and encryption submodule.

[0122] Optionally, the above multi-level encryption process is to achieve the correspondence between keys and attributes, wherein the final management key corresponds to the administrator of the power grid system, the secondary key corresponds to the privileged access right, and the primary key corresponds to the specific power grid resource. The secure storage and encryption submodule performs step-by-step encryption before distributing the final management key, and after aggregating the obtained multiple management keys, performs step-by-step decryption on the privileged access credentials of the power grid resources to obtain the decrypted privileged access credentials, and the decryption result will be used for the privileged access verification process.

[0123] The management key distribution and aggregation submodule 20112 is used to perform management key distribution and management key aggregation.

[0124] Optionally, the obtained key block is sent to the selected N power grid system administrators using the management key distribution algorithm, and only any K power grid system administrators are selected from the privileged access credential administrators of the N-bit digital power grid, and the key blocks corresponding to the K administrators are aggregated using the management key aggregation algorithm. The input of the management key distribution and the output of the management key aggregation are both connected to the secure storage and encryption submodule.

[0125] In this embodiment, the secure storage module of privileged access credentials can implement the following five functions. Credential management function: Administrators can register resources in the power grid with the module, including administrator access credentials, database credentials or other credentials. Among them, the secure storage module of privileged access credentials will automatically manage all credential management; dynamic password management function: The secure storage module of privileged access credentials can connect to power grid resources and create dynamic credentials and passwords for these resources. Authentication function: Authenticate privileged personnel and applications, and allow authenticated privileged personnel or programs to obtain their credential passwords; Credential life cycle management function: If the power grid resource has exceeded the lease period, the secure storage module of privileged access credentials will automatically cancel its password. Password rotation function: If the password has not been changed for a long time or is in a leaked state (the password change cycle can be defined by the administrator of the power grid), the secure storage module of privileged access credentials will automatically change the password; in addition, if the storage is attacked or the storage device fails, the secure storage module of privileged access credentials will automatically freeze and re-encrypt the KEK, DEK and credential password.

[0126] In this embodiment, the privileged access credentials, target access resources and target privileged access objects of the power grid can be obtained first, and then the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object can be hierarchically encrypted to obtain the target encryption key of the target privileged access object. Then, based on the target encryption key obtained above, the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object can be hierarchically decrypted to obtain the target decryption key of the target privileged access object. Finally, the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, the initial password corresponding to the target privileged access object, the target encryption key and the target decryption key obtained in the above process are stored in the data security access system of the power grid. Considering that after obtaining the privileged access credentials, the target access resources and the target privileged access objects, the initial passwords corresponding to the obtained privileged access credentials, the initial passwords corresponding to the target access resources and the initial passwords corresponding to the target privileged access objects are hierarchically encrypted to obtain the target encryption keys. According to the target encryption keys, the initial passwords corresponding to the above data can be hierarchically decrypted to obtain the target decryption keys. The initial passwords, target decryption keys and target encryption keys corresponding to the different data obtained above are stored in the data security access system to achieve the purpose of securely storing the power grid privileged access credentials, thereby solving the technical problem of low storage security of the power grid privileged access credentials and achieving the technical effect of improving the storage security of the power grid privileged access credentials.

[0127] According to an embodiment of the present invention, a secure storage device for power grid privileged access credentials is provided. It should be noted that the secure storage device for power grid privileged access credentials can be used to execute a secure storage method for power grid privileged access credentials in an embodiment.

[0128] Figure 4 is a secure storage device for power grid privileged access credentials according to an embodiment of the present invention, such as Figure 4 As shown, a secure storage device 400 for power grid privileged access credentials may include: an acquisition unit 401 , an encryption processing unit 402 , a decryption processing unit 403 and a storage unit 404 .

[0129] The acquisition unit 401 is used to acquire a privileged access credential, a target access resource and a target privileged access object of the power grid, wherein the privileged access object is used to access the target access resource through the privileged access credential.

[0130] The encryption processing unit 402 is used to perform hierarchical encryption processing on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain a target encryption key of the target privileged access object.

[0131] The decryption processing unit 403 is used to perform hierarchical decryption processing on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object based on the target encryption key to obtain the target decryption key of the target privileged access object.

[0132] The storage unit 404 is used to store the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, the initial password corresponding to the target privileged access object, the target encryption key and the target decryption key in the data security access system of the power grid.

[0133] Optionally, the encryption processing unit 402 may include: a first acquisition module, used to perform a first-level encryption processing on the initial password corresponding to the privileged access credential to obtain a first encryption key; a second acquisition module, used to perform a second-level encryption processing on the initial password corresponding to the target access resource based on the first encryption key to obtain a second encryption key, wherein the complexity of the second encryption key is higher than the complexity of the first encryption key; a third acquisition module, used to perform a third-level encryption processing on the initial password corresponding to the target privileged access object based on the second encryption key to obtain a third encryption key, wherein the complexity of the third encryption key is higher than the second encryption key; a first determination module, used to determine the third encryption key as the target encryption key.

[0134] Optionally, the decryption processing unit 403 may include: a fourth acquisition module, used to divide the target encryption key to obtain multiple initial key blocks corresponding to multiple target privileged access objects; a second determination module, used to determine multiple target key blocks based on the multiple initial key blocks; a fifth acquisition module, used to perform hierarchical decryption processing on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object based on the multiple target key blocks to obtain the target decryption key of the target privileged access object.

[0135] Optionally, the second determination module may include: a selection submodule, used to select at least a target value of initial key blocks from multiple initial key blocks; and a determination submodule, used to determine the target value of initial key blocks as multiple target key blocks.

[0136] Optionally, the fifth acquisition module may include: a first acquisition sub-module, used to aggregate multiple target key blocks to obtain a root key; a second acquisition sub-module, used to use the root key to perform hierarchical decryption processing on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain the target decryption key of the target privileged access object.

[0137] Optionally, the data security access system includes: a privileged access credential management subsystem and a privileged behavior detection and control subsystem, wherein the privileged access credential management subsystem is used to manage data resources in the resource pool of the power grid, and the privileged behavior detection and control subsystem is used to detect and control access to data resources.

[0138] Optionally, the privileged access credential management subsystem includes: a secure storage module, a secure access gateway module and a middleware module, wherein the secure access gateway module is used to characterize that the target privileged access object successfully accesses the cloud platform resources of the power grid, the middleware module is used to characterize that the target application successfully accesses data resources, and the secure storage module includes: a secure storage and encryption submodule, and a management key distribution and aggregation submodule. The secure storage and encryption submodule is used to encrypt and store data, and the management key distribution and aggregation submodule is used to distribute the obtained multiple keys to different target privileged access objects, and aggregate the multiple keys.

[0139] In this embodiment, the privileged access credentials, target access resources and target privileged access objects of the power grid are acquired by an acquisition unit, wherein the privileged access objects are used to access the target access resources through the privileged access credentials; the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object are hierarchically encrypted by an encryption processing unit to obtain a target encryption key of the target privileged access object; the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object are hierarchically decrypted by a decryption processing unit based on the target encryption key to obtain a target decryption key of the target privileged access object; the initial password corresponding to the privileged access credentials, the initial password corresponding to the target access resource, the initial password corresponding to the target privileged access object, the target encryption key and the target decryption key are stored in the data security access system of the power grid by a storage unit, so as to solve the technical problem of low storage security of the privileged access credentials of the power grid and achieve the technical effect of improving the storage security of the privileged access credentials of the power grid.

[0140] According to an embodiment of the present invention, a computer-readable storage medium is also provided, which includes a stored program, wherein when the program is executed by a processor, the device where the readable storage medium is located is controlled to execute the secure storage method of power grid privileged access credentials in the embodiment.

[0141] According to an embodiment of the present invention, a processor is further provided. The processor is used to run a program, wherein the method for securely storing power grid privileged access credentials in the embodiment is executed when the program is run.

[0142] According to an embodiment of the present invention, a computer program product is further provided, including a computer program, and when the computer program is executed by a processor, the method for securely storing power grid privileged access credentials in the embodiment of the present invention is implemented.

[0143] According to an embodiment of the present invention, an electronic device is also provided, the electronic device comprising a processor and a memory for storing instructions executable by the processor, wherein the processor is configured to execute instructions to implement the method for securely storing privileged access credentials for a power grid in an embodiment of the present invention.

[0144] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0145] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0146] In the several embodiments provided by the present invention, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic, for example, the division of units can be a logical function division, and there can be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0147] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0148] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0149] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0150] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for securely storing privileged access credentials for a power grid, characterized in that: include: Acquire a privileged access credential of a power grid, a target access resource, and a target privileged access object, wherein the privileged access object is used to access the target access resource through the privileged access credential; Performing hierarchical encryption processing on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain a target encryption key for the target privileged access object; Based on the target encryption key, hierarchically decrypt the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain a target decryption key for the target privileged access object; The initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, the initial password corresponding to the target privileged access object, the target encryption key and the target decryption key are stored in the data security access system of the power grid.

2. The method according to claim 1, characterized in that Performing hierarchical encryption processing on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain a target encryption key of the target privileged access object, including: Performing primary encryption processing on the initial password corresponding to the privileged access credential to obtain a first encryption key; Based on the first encryption key, perform secondary encryption processing on the initial password corresponding to the target access resource to obtain a second encryption key, wherein the complexity of the second encryption key is higher than the complexity of the first encryption key; Based on the second encryption key, perform three-level encryption processing on the initial password corresponding to the target privileged access object to obtain a third encryption key, wherein the complexity of the third encryption key is higher than that of the second encryption key; The third encryption key is determined as the target encryption key.

3. The method according to claim 1, characterized in that Based on the target encryption key, hierarchical decryption processing is performed on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain a target decryption key for the target privileged access object, including: Dividing the target encryption key to obtain a plurality of initial key blocks corresponding to a plurality of target privileged access objects; Based on the multiple initial key blocks, determining multiple target key blocks; Based on the multiple target key blocks, the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object are hierarchically decrypted to obtain a target decryption key for the target privileged access object.

4. The method according to claim 3, characterized in that Based on the multiple initial key blocks, determining multiple target key blocks includes: Selecting at least a target value of the initial key blocks from a plurality of the initial key blocks; The target value of the initial key blocks is determined as a plurality of the target key blocks.

5. The method according to claim 3, characterized in that: Based on the multiple target key blocks, hierarchical decryption processing is performed on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain a target decryption key of the target privileged access object, including: Aggregating the plurality of target key blocks to obtain a root key; The root key is used to perform the hierarchical decryption processing on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object to obtain a target decryption key for the target privileged access object.

6. The method according to claim 1, characterized in that The data security access system includes: a privileged access credential management subsystem and a privileged behavior detection and control subsystem, wherein the privileged access credential management subsystem is used to manage data resources in the resource pool of the power grid, and the privileged behavior detection and control subsystem is used to detect and control access to the data resources.

7. The method according to claim 6, characterized in that The privileged access credential management subsystem includes: a secure storage module, a secure access gateway module and a middleware module, wherein the secure access gateway module is used to characterize that the target privileged access object has successfully accessed the cloud platform resources of the power grid, and the middleware module is used to characterize that the target application has successfully accessed the data resources. The secure storage module includes: a secure storage and encryption submodule, and a management key distribution and aggregation submodule. The secure storage and encryption submodule is used to encrypt and store data, and the management key distribution and aggregation submodule is used to distribute the obtained multiple keys to different target privileged access objects, and aggregate the multiple keys.

8. A secure storage device for power grid privileged access credentials, characterized in that: include: an acquisition unit, configured to acquire a privileged access credential of a power grid, a target access resource, and a target privileged access object, wherein the privileged access object is used to access the target access resource through the privileged access credential; an encryption processing unit, configured to perform hierarchical encryption processing on an initial password corresponding to the privileged access credential, an initial password corresponding to the target access resource, and an initial password corresponding to the target privileged access object, to obtain a target encryption key for the target privileged access object; a decryption processing unit, configured to perform hierarchical decryption processing on the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, and the initial password corresponding to the target privileged access object based on the target encryption key, so as to obtain a target decryption key for the target privileged access object; A storage unit is used to store the initial password corresponding to the privileged access credential, the initial password corresponding to the target access resource, the initial password corresponding to the target privileged access object, the target encryption key and the target decryption key in the data security access system of the power grid.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed by a processor, the device where the storage medium is located is controlled to execute the method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the method according to any one of claims 1 to 7.

Images