Dynamic desensitization-based data authority management and control method for power grid data center

Abstract

The invention provides a dynamic desensitization-based data authority management and control method for a power grid data center, and belongs to the technical field of power grid data security. Comprising the steps of obtaining a data access permission of a user accessing related services in power grid data; intercepting each item of data sent to the related service, and obtaining the data type and the corresponding sensitivity level of each item of data; obtaining a desensitization rule of the type of data according to the data type, the sensitivity level of the type of data and the data access permission of the user; performing desensitization processing on the original data of the data by using a desensitization rule; and sending the desensitized data to a service system of the related service. According to the method, effective data authority control is carried out through a dynamic desensitization technology, so that the user authority and the data sensitivity are consistent with the desensitization level, the security and privacy of the data are ensured, and meanwhile, reasonable data access is allowed.

Description

Technical Field

[0001] The present invention belongs to the technical field of power grid data security, and specifically relates to a data authority management and control method for a power grid data middle station based on dynamic desensitization. Background Art

[0002] The power grid data center is a unified data platform built on the basis of big data, cloud computing and other technologies in the power system. It integrates various types of data inside and outside the power enterprise to provide unified data services and application support. With the further strengthening of data use in the data center, the flow of data involves more and more complex scenarios and a variety of access roles, which brings new challenges to the data protection of the data center.

[0003] The power grid data center contains sensitive and critical power data, and it is necessary to ensure that only authorized personnel can access this data to prevent unauthorized data from being accessed, thereby causing data leakage. However, the existing protection model cannot effectively respond to the differentiated security, privacy and efficiency requirements caused by different data sensitivity and user business permissions. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a data authority management method for a power grid data center based on dynamic desensitization.

[0005] In order to solve one, part or all of the above technical problems, the technical solution adopted by the present invention is: A data permission management method for a power grid data center based on dynamic desensitization, comprising: obtaining data access rights of users who access services related to the power grid data center; intercepting each data item sent to the related services, obtaining the data type and corresponding sensitivity level of each data item; obtaining desensitization rules for data of this type according to the data type, the sensitivity level of the data of this type and the data access rights of the user; desensitizing the original data of the data item using the desensitization rules; and sending the desensitized data to the business system of the related services.

[0006] Furthermore, it also includes: configuring a user data permission setting template and a user data permission update template; using the user data permission setting template to allocate initial data permissions to new users; and using the user data permission update template to update user permissions.

[0007] Furthermore, the sensitivity levels include public data, internal data, sensitive data and highly sensitive data from low to high; the data access rights correspond to the sensitivity levels, including public data access rights, internal data access rights, sensitive data access rights and highly sensitive data access rights.

[0008] Furthermore, each of the desensitization rules sets a desensitization method for the original data according to the data type, sensitivity level and data access rights of the data to be processed.

[0009] Furthermore, the desensitization methods include covering, replacing, leaving blank and confusing.

[0010] Furthermore, the masking method is used to hide a part of the original data; the masking rules of the masking method are set according to different data types, sensitivity levels and data access permissions, and are implemented by string interception or regular expression replacement.

[0011] Furthermore, the replacement method is used to replace original data with random or specific virtual data; the replacement rules of the replacement method are set according to different data types, sensitivity levels and data access permissions.

[0012] Furthermore, the null mode is used to return a null value.

[0013] Furthermore, the obfuscation method is used to obfuscate original data by using encryption or encoding; the obfuscation rules of the obfuscation method are set according to different data types, sensitivity levels and data access permissions.

[0014] Compared with the prior art, the present invention has the following beneficial effects: The present invention uses dynamic desensitization technology to effectively manage data permissions, so that user permissions are consistent with data sensitivity and desensitization levels, ensuring data security and privacy while allowing reasonable data access. The present invention helps the power industry better manage its data resources, improve data security, protect user privacy, and achieve a balance in data sharing.

[0015] The present invention can be applied to the power industry and energy management field to ensure the security and privacy of the power grid data center database while allowing appropriate data access and sharing. The present invention has the potential to play an important role in the fields of smart grid, power distribution and monitoring systems, and improve the efficiency of data management and the protection level of data privacy. DETAILED DESCRIPTION

[0016] In order to better understand the present invention, the content of the present invention is further clearly set forth in conjunction with the embodiments below, but the protection content of the present invention is not limited to the following embodiments. In the following description, a large number of specific details are provided in order to provide a more thorough understanding of the present invention. However, it is obvious to those skilled in the art that the present invention can be implemented without one or more of these details.

[0017] Embodiment 1: The purpose of this embodiment is to provide a data authority control method for a power grid data middle station based on dynamic desensitization. The method includes: S1. Obtain data access rights for users who access services related to the power grid data center.

[0018] When a user accesses relevant services in the power grid data center, or when the relevant services used by the user need to call relevant data through the power grid data center, the user's data access rights are obtained.

[0019] The present invention divides each type of data in the power grid data center into sensitivity levels, and the divided sensitivity levels include public data, internal data, sensitive data and highly sensitive data from low to high.

[0020] Public data refers to data that does not require any restrictions and whose public sharing will not have a negative impact on grid operations or any individual, such as electricity supply and demand, electricity price information, public policies and regulations, environmental data, publicly released statistical reports, etc.

[0021] Internal data is for internal use only. Leakage of internal data may have a certain impact on power grid operations, but generally will not cause serious consequences, such as operation and maintenance logs, equipment operating status, internal processes and rules and regulations, internal training materials, general employee information, etc.

[0022] Sensitive data involves key grid operations, customer information or business secrets, and its leakage will have a significant impact on grid operations or related parties, such as user power consumption data, contracts and business agreements, supplier and partner information, detailed equipment failure records, power dispatch plans, etc.

[0023] Highly sensitive data involves national security, critical infrastructure or confidential information, and its leakage will have serious impacts or even catastrophic consequences, such as the location information of critical infrastructure, detailed technical data of major substations and transmission lines, national power grid operation plans, personal information of senior managers, security system configuration and vulnerability information, etc.

[0024] The user's data access rights correspond to the sensitivity level of the data. The data access rights include public data access rights, internal data access rights, sensitive data access rights, and highly sensitive data access rights from low to high. Public data access rights allow access to public data, internal data access rights allow access to internal data, sensitive data access rights allow access to sensitive data, and highly sensitive data access rights allow access to highly sensitive data.

[0025] Public data access permissions are granted to all employees, external partners and public users, internal data access permissions are granted to internal employees, sensitive data access permissions are granted to department managers and senior analysts, and highly sensitive data access permissions are granted to senior managers and security supervisors.

[0026] Each user is assigned several data access permissions, such as internal employees have public data access permissions and internal data access permissions. When a user's position or responsibilities change, their data access permissions should be updated synchronously.

[0027] In order to facilitate the setting or updating of user data access rights, the present invention also provides a user data permission setting template and a user data permission update template. The data permission setting template is used to allocate initial data permissions to new users. In the case of new employees joining, new project launch, system expansion, etc., it can ensure that new users quickly and accurately obtain the required data permissions, so that they can quickly get started. The user data permission update template is used to adjust and update the permissions of existing users. In the case of employee promotion or transfer, project completion or change, permission abuse monitoring and rectification, etc., it can dynamically manage data access permissions according to user position changes, responsibility adjustments, etc.

[0028] S2. Intercept each piece of data sent to the relevant business and obtain the data type and corresponding sensitivity level of each piece of data.

[0029] At present, after the relevant business requests data, the power grid data center directly returns the requested data. This step intercepts each piece of data to be sent to the relevant business and obtains the data type and corresponding sensitivity level of each piece of data. By screening and processing each piece of data, unauthorized data leakage can be avoided.

[0030] S3. Obtain desensitization rules for data of this type based on the data type, the sensitivity level of the data of this type, and the user's data access rights.

[0031] Each desensitization rule includes the desensitization method, as well as the corresponding data type, sensitivity level and data access permission. Desensitization methods include masking, replacement, blanking and obfuscation.

[0032] Masking is used to hide part of sensitive information. You can cut off part of the string or replace some characters with specific symbols. When masking is used, each desensitization rule is configured with a corresponding masking rule. Masking is implemented by string truncation or regular expression replacement. For example, for data of the ID card type, when the masking rule replace( / [xX\d]{8}$ / ,'*') is used (regular expression replacement), the last 8 digits of the ID card number can be replaced with *.

[0033] Replacement is used to generate virtual data. It can replace sensitive data with random or specific values. When using the replacement method, each desensitization rule is configured with a corresponding replacement rule. For example, the replacement rule can replace the original value with a random number within a certain range.

[0034] Empty is used to return empty values. The empty rules are the same in different desensitization rules. Under the empty rules, no matter what the original data is, the original data is directly replaced with empty values.

[0035] Obfuscation is used to confuse data by encryption or encoding. When using obfuscation, each desensitization rule is configured with a corresponding obfuscation rule. For example, the obfuscation rule can use different obfuscation algorithms, such as the SHA-256 hash algorithm, the national secret hash algorithm, etc. to obfuscate the original data.

[0036] When the sensitivity of data changes, its sensitivity level and associated desensitization rules should be updated synchronously.

[0037] S4. Desensitize the original data of the data using desensitization rules.

[0038] S5. Send the desensitized data to the business system of the relevant business.

[0039] The original data is desensitized using the desensitization rules obtained, and the desensitized data is returned to the business system of the relevant business. At this time, the data received and viewed by the user side are all desensitized data. Since the desensitization rules corresponding to users with different access rights are different, the data content viewed by users with different access rights is also different.

[0040] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Other modifications or equivalent substitutions made to the technical solution of the present invention by ordinary technicians in the field should be included in the scope of the claims of the present invention as long as they do not depart from the spirit and scope of the technical solution of the present invention.

Claims

1. A data authority control method for a power grid data center based on dynamic desensitization, characterized in that: include: Obtain data access rights for users who access services related to the power grid data center; Intercept every piece of data sent to the relevant business, and obtain the data type and corresponding sensitivity level of each piece of data; Obtain desensitization rules for data of this type based on the data type, the sensitivity level of the data of this type, and the data access rights of the user; Use desensitization rules to desensitize the original data of the data; The desensitized data will be sent to the business system of the relevant business.

2. The data authority control method based on dynamic desensitization of the power grid data middle station according to claim 1 is characterized in that: Also includes: Configure user data permission setting template and user data permission update template; Use the user data permission setting template to assign initial data permissions to new users; Use the user data permission update template to update user permissions.

3. The data authority control method based on dynamic desensitization of the power grid data middle station according to claim 1 is characterized in that: The sensitivity levels include public data, internal data, sensitive data and highly sensitive data from low to high; the data access rights correspond to the sensitivity levels, including public data access rights, internal data access rights, sensitive data access rights and highly sensitive data access rights.

4. The data authority control method based on dynamic desensitization of the power grid data middle station according to claim 1 is characterized in that: Each of the desensitization rules sets a desensitization method for the original data based on the data type, sensitivity level and data access permissions of the data to be processed.

5. The data authority control method based on dynamic desensitization of the power grid data middle station according to claim 4 is characterized in that: The desensitization methods include covering, replacing, leaving blank and confusing.

6. The data authority control method based on dynamic desensitization of the power grid data middle station according to claim 5 is characterized in that: The masking method is used to hide a part of the original data; the masking rules of the masking method are set according to different data types, sensitivity levels and data access permissions, and are implemented by string interception or regular expression replacement.

7. The data authority control method based on dynamic desensitization of the power grid data middle station according to claim 5 is characterized in that: The replacement method is used to replace original data with random or specific virtual data; the replacement rules of the replacement method are set according to different data types, sensitivity levels and data access permissions.

8. The data authority control method based on dynamic desensitization of the power grid data middle station according to claim 5 is characterized in that: The null method is used to return a null value.

9. The data authority control method based on dynamic desensitization in the power grid data middle station according to claim 5 is characterized in that: The obfuscation method is used to obfuscate original data by using encryption or encoding; the obfuscation rules of the obfuscation method are set according to different data types, sensitivity levels and data access permissions.