Data cross-region and cross-domain sharing dynamic management and control architecture, method and system

Abstract

The invention provides a data cross-region and cross-domain sharing dynamic management and control architecture, method and system. The architecture comprises an intra-domain part and an extra-domain part; the intra-domain part comprises an intra-domain system, a database and an access control system; the extra-domain part comprises an extra-domain system and an application program interface; according to the method, access control is performed on the application program interface based on the identity and role of the extra-domain user, and dynamic management and control are performed on the access control system based on the attribute of the data object requested to be accessed by the user and the attribute of the user, so that the data is properly protected during circulation, the potential risk is reduced, and the user experience is improved. Meanwhile, the method adapts to dynamic changes of authority requirements in a multi-domain data sharing interaction scene, fine-grained division is carried out on different types of object data, access constraint after an access request entity obtains data resource access authority is achieved, privacy protection is carried out on sensitive data, the precision and effectiveness of data access control are improved, and the user experience is improved. The data is always controlled in the transmission process, and the management of cross-domain transmission data is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of power data security technology, and in particular to a dynamic management and control architecture, method and system for cross-region and cross-domain data sharing. Background Art

[0002] Access control is a constraint and restriction on user access requests. It determines whether users have the right to access the system, whether they can obtain certain resources or perform certain actions, and prevents unauthorized users from sending data acquisition requests, providing security for data, and reducing data abuse and privacy leakage. Access control methods include user identification codes, passwords, login control, resource authorization (such as user profiles, resource profiles, and control lists), authorization verification, logs, and audits. Access control often exists in systems that need to provide data information. Since there are many ways to classify the aspects that affect whether users have the right to access data, and different data flow forms also limit the implementation of some access control, the concept of access control model has been proposed and continues to evolve with the development of technology. The current hot access control models mainly include: attribute-based access control model, role-based access control model, task-based access control model, and risk-based access control model. These models have different advantages according to different business scenarios and access control requirements.

[0003] The application number CN201910224268.6, "A Multi-domain Data Sharing and Exchange Platform Architecture Based on Blockchain", aims to realize data sharing and exchange between subdomains by connecting subdomain modules in series through the data sharing and exchange center module, and to uniformly manage and provide services for subdomain data. Although the interoperability of IoT data sharing has been effectively improved, firstly, the platform relies on the data sharing and exchange center for authority determination and data transmission, which may lead to performance bottlenecks and single point failure risks of the central node. Secondly, the subdomain system needs to implement standard service interfaces such as data provision interface and data aggregation interface, which increases the implementation complexity of the subdomain system. In addition, although blockchain technology is used for data sharing, the performance and scalability of blockchain still need to be optimized for high-frequency data exchange scenarios. Therefore, the solution has made some progress in improving the security and flexibility of data sharing, but further research and improvement are still needed in terms of system performance optimization and subdomain implementation complexity.

[0004] The application for "Industrial Internet of Things Cross-Domain Data Sharing Method Based on Alliance Blockchain and IPFS" with application number CN202111385288.5 has effectively improved data security and sharing efficiency, but the solution relies on the management and distribution of keys by the domain center server, which increases the complexity of the system and may face scalability issues in key management. At the same time, this method mainly focuses on data security and does not fully consider bandwidth optimization and delay control under large-scale data transmission. In addition, due to the reliance on IPFS for data storage, the availability of data may be affected when the IPFS network is unstable.

[0005] The application number CN202110884626.3, "Cross-domain data sharing method and system based on edge computing", improves the security and efficiency of data during transmission by processing data requests and encryption operations through edge nodes. However, this solution still has some shortcomings in practical applications. First, although the edge computing nodes share the encryption and decryption tasks, the requirements for node computing power are high, which may lead to performance degradation in environments with limited computing resources. Secondly, the scheme relies on pre-configured public-private key pairs and complex authentication mechanisms. In dynamic environments, such as when nodes frequently change or expand, it may face the complexity of key management and authentication. In addition, the system mainly focuses on the security of cross-domain data transmission, and further research is needed on bandwidth optimization and delay control of data transmission to meet large-scale and high-frequency data sharing needs.

[0006] In summary, the existing technology has the problem of coarse access control granularity and insufficient security of data transmission between multiple domains. Summary of the invention

[0007] In order to solve the problems of coarse access control granularity and insufficient security of multi-domain data transmission in the prior art, the present invention proposes a dynamic management and control architecture for cross-region and cross-domain data sharing, including: an intra-domain part and an extra-domain part;

[0008] The intra-domain part includes intra-domain systems, databases and access control systems;

[0009] The external part includes external systems and application programming interfaces;

[0010] The intra-domain system is used to accept access requests from users within the domain or access requests from users outside the domain forwarded through an application program interface, and forward the access requests to the access control system, and is also used to display the data objects returned by the database to the users within the domain initiating the access, or send the returned data objects to the application program interface;

[0011] The access control system is used to dynamically control based on the attributes of the data object requested by the user and the attributes of the user himself, and when access to the data object is allowed, send a resource access request to the database;

[0012] The database is used to store data in the domain and, upon receiving a resource access request, send the requested data object to the system in the domain;

[0013] The out-of-domain system is used to receive access requests from out-of-domain users, forward the access requests to the application program interface, and display the data objects forwarded by the application program interface to the out-of-domain users who initiated the access;

[0014] The application program interface is used to perform access control based on the identity and role of users outside the domain. When access to the system within the domain is allowed, the access request is forwarded to the system within the domain. It is also used to forward data objects sent by the system within the domain to the system outside the domain.

[0015] Preferably, the access control system includes a label library and a policy library;

[0016] The policy library is used to send a tag request to the tag library based on the attributes of the data object requested to be accessed by the user and the attributes of the user himself when receiving the access request, and is also used to determine whether to allow access to the data object based on the tag information returned by the tag library. When access to the data object is allowed, the policy library screens the data object requested to be accessed by the user and sends a resource access request to the database;

[0017] The label library is used to store label information of all users and data in the domain, and return label information to the policy library when receiving a label request.

[0018] Preferably, the policy library includes a policy implementation point, a policy decision point and a policy management point;

[0019] The policy enforcement point is used to send a tag request to the tag library according to the attributes of the data object requested to be accessed by the user and the attributes of the user himself when receiving the access request, and to construct a security access request according to the tag information returned by the tag library, and submit the security access request to the policy decision point; and is also used to send a resource access request to the database when access to the data object is allowed;

[0020] The policy decision point is used to initiate an access policy query to the policy management point according to the security access request, and is also used to determine whether to allow access to the data object according to the access policy response returned by the policy management point;

[0021] The policy management point is used to manage access control policies and return access policy responses related to the attributes of the data object requested to be accessed by the user and the attributes of the user himself according to the security access request.

[0022] Preferably, the tag information includes a subject attribute tag, an object attribute tag and an environment attribute tag, wherein the subject attribute tag corresponds to the user, and the object attribute tag corresponds to the data object requested to be accessed by the user;

[0023] The subject attribute label includes one or more of the following: company, department, employment time or security level;

[0024] The object attribute tag includes one or more of the following: belonging company, belonging department, creation time or security level;

[0025] The environmental attribute tag includes one or more of the following: access time, access location, device attribute or connection status.

[0026] Preferably, the access control strategy includes:

[0027] When all access policy responses determine that the data object is accessible to the user, access to the data object is allowed;

[0028] The access policies include:

[0029] When the user's company and the data object's company are the same, the data object is determined to be accessible to the user;

[0030] When the department to which the user belongs is the same as the department to which the data object belongs, it is determined that the data object can be accessed by the user;

[0031] When the user's joining time is earlier than or equal to the creation time of the data object, it is determined that the data object can be accessed by the user;

[0032] When the user's security level is higher than or equal to the security level of the data object, it is determined that the data object can be accessed by the user;

[0033] When the user's access time is during normal working hours, it is determined that the data object is accessible to the user;

[0034] When the device attribute of the device to which the user submits the access request is an encrypted device or a controlled device within the domain, it is determined that the data object can be accessed by the user;

[0035] When the user's access location is within the domain, it is determined that the data object is accessible to the user;

[0036] When the connection status of the device to which the user submits the access request is better than a preset threshold, it is determined that the data object is accessible to the user.

[0037] Preferably, the access control strategy of the application program interface includes:

[0038] Determine whether the user's identity allows access to the application program interface. If the user's identity allows access to the application program interface, determine whether access to the domain system is allowed according to the user's role; wherein the roles include ordinary users, administrators, and strangers;

[0039] The common user is recorded as a common user in the configuration file of the application program interface and is allowed to access the system within the domain;

[0040] The administrator is recorded as an administrator in the configuration file, is allowed to access the system within the domain, and is allowed to access the configuration file to change the user's role;

[0041] The unfamiliar user has no record in the configuration file and is not allowed to access the system within the domain.

[0042] Based on the same inventive concept, the present application also provides a method for dynamic management and control of cross-region and cross-domain data sharing, including:

[0043] The access control system receives an access request sent by a system within the domain;

[0044] Dynamically manage and control the data object requested by the user and the user's own attributes, and when access to the data object is allowed, send a resource access request to the database;

[0045] Receive the data object returned by the database, and forward the data object to the intra-domain system;

[0046] The access request is an access request initiated by a user within the domain and accepted by the system within the domain, or an access request initiated by a user outside the domain and received by the system outside the domain and access controlled through the application program interface.

[0047] Preferably, the dynamic control based on the attributes of the data object requested to be accessed by the user and the attributes of the user himself includes:

[0048] The policy library sends a tag request to the tag library based on the attributes of the data object that the user requests to access and the user's own attributes;

[0049] According to the tag information returned by the tag library, it is determined whether access to the data object is allowed.

[0050] Preferably, the adoption policy library sends a tag request to the tag library according to the attributes of the data object requested to be accessed by the user and the attributes of the user himself, including:

[0051] The policy enforcement point in the policy library is used to send a tag request to the tag library according to the attributes of the data object requested to be accessed by the user and the user's own attributes.

[0052] Preferably, judging whether to allow access to the data object according to the tag information returned by the tag library includes:

[0053] The policy enforcement point in the policy library is used to construct a security access request according to the tag information returned by the tag library;

[0054] A policy decision point in a policy library initiates an access policy query to a policy management point in the policy library according to the security access request, and determines whether access to the data object is allowed according to an access policy response returned by the policy management point.

[0055] Preferably, the application program interface performs access control on access requests initiated by users outside the domain, including:

[0056] The application program interface determines whether the identity of the user outside the domain allows access to the application program interface. When the user's identity allows access to the application program interface, it determines whether access to the system within the domain is allowed according to the user's role.

[0057] Preferably, after forwarding the data object to the intra-domain system, the method further includes:

[0058] The data objects returned by the database are displayed to the users in the domain that initiated the access through the in-domain system, or the returned data objects are forwarded to the out-domain system through the application program interface, and the out-domain system displays the data objects to the users outside the domain that initiated the access.

[0059] Based on the same inventive concept, the present application also provides a data cross-region and cross-domain sharing dynamic management and control system, including: a request receiving module, a data access module and a forwarding module;

[0060] The request receiving module is used to receive access requests sent by the system in the domain in the access control system;

[0061] The data access module is used to dynamically control based on the attributes of the data object requested by the user and the attributes of the user himself, and when access to the data object is allowed, send a resource access request to the database;

[0062] The forwarding module is used to receive the data object returned by the database and forward the data object to the intra-domain system;

[0063] The access request is an access request initiated by a user within the domain and accepted by the system within the domain, or an access request initiated by a user outside the domain and received by the system outside the domain and access controlled through an application program interface.

[0064] Preferably, the data access module performs dynamic control based on the attributes of the data object requested to be accessed by the user and the attributes of the user himself, including:

[0065] The policy library sends a tag request to the tag library based on the attributes of the data object that the user requests to access and the user's own attributes;

[0066] According to the tag information returned by the tag library, it is determined whether access to the data object is allowed.

[0067] Preferably, the data access module uses the policy library to send a tag request to the tag library according to the attributes of the data object requested to be accessed by the user and the attributes of the user himself, including:

[0068] The policy enforcement point in the policy library is used to send a tag request to the tag library according to the attributes of the data object requested to be accessed by the user and the user's own attributes.

[0069] Preferably, the data access module determines whether to allow access to the data object according to the tag information returned by the tag library, including:

[0070] The policy enforcement point in the policy library is used to construct a security access request according to the tag information returned by the tag library;

[0071] A policy decision point in a policy library initiates an access policy query to a policy management point in the policy library according to the security access request, and determines whether access to the data object is allowed according to an access policy response returned by the policy management point.

[0072] Preferably, the application program interface performs access control on access requests initiated by users outside the domain, including:

[0073] The application program interface determines whether the identity of the user outside the domain allows access to the application program interface. When the user's identity allows access to the application program interface, it determines whether access to the system within the domain is allowed according to the user's role.

[0074] Preferably, the management and control system further includes a display module;

[0075] The display module is used to display the data object returned by the database to the user in the domain that initiated the access through the in-domain system after the forwarding module forwards the data object to the in-domain system, or to forward the returned data object to the out-domain system through the application program interface, and the out-domain system displays the data object to the user outside the domain that initiated the access.

[0076] In another aspect, the present application further provides a computing device, comprising: at least one processor and a memory;

[0077] The memory is used to store one or more programs;

[0078] When the one or more programs are executed by the one or more processors, a method for dynamic management and control of cross-region and cross-domain data sharing as described above is implemented.

[0079] On the other hand, the present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed, it implements a method for dynamic management and control of cross-region and cross-domain data sharing as described above.

[0080] Compared with the prior art, the present invention has the following beneficial effects:

[0081] The present invention provides a dynamic management and control architecture, method and system for cross-region and cross-domain data sharing, including: an intra-domain part and an extra-domain part; the intra-domain part includes an intra-domain system, a database and an access control system; the extra-domain part includes an extra-domain system and an application program interface; the intra-domain system is used to accept access requests from users within the domain or access requests from users outside the domain forwarded through an application program interface, and forward the access requests to the access control system, and is also used to display the data objects returned by the database to the users within the domain who initiated the access, or send the returned data objects to the application program interface; the access control system is used to perform dynamic management and control based on the attributes of the data objects requested to be accessed by the users and the attributes of the users themselves, and when access to the data objects is allowed, send a resource access request to the database; the database is used to store data within the domain, and when receiving a resource access request, send the requested data object to the intra-domain system; the extra-domain system is used to receive access requests from users outside the domain, and forward the access requests to the application program interface The interface is also used to display the data object forwarded by the application program interface to the user outside the domain who initiated the access; the application program interface is used to perform access control based on the identity and role of the user outside the domain. When access to the system within the domain is allowed, the access request is forwarded to the system within the domain. It is also used to forward the data object sent by the system within the domain to the system outside the domain; the present invention ensures that data is properly protected during circulation and reduces potential risks by performing access control based on the identity and role of the user outside the domain in the application program interface, and dynamically managing and controlling the attributes of the data object requested to be accessed by the user and the attributes of the user himself in the access control system, thereby adapting to the dynamic changes in the authority requirements in the multi-domain data sharing and interaction scenarios, performing fine-grained division of different types of object data, realizing access constraints after the access request entity obtains data resource access rights, performing privacy protection on sensitive data, improving the accuracy and effectiveness of data access control, ensuring that data is always controlled during transmission, and strengthening the management of cross-domain transmission data. BRIEF DESCRIPTION OF THE DRAWINGS

[0082] Figure 1 A schematic diagram of a dynamic management and control architecture for cross-region and cross-domain data sharing provided by the present invention;

[0083] Figure 2 A schematic diagram of a specific example of a dynamic management and control architecture for cross-region and cross-domain data sharing provided by the present invention;

[0084] Figure 3 A schematic diagram of a flow chart of a method for dynamic management and control of cross-region and cross-domain data sharing provided by the present invention;

[0085] Figure 4 A schematic diagram of the process flow of the fine-grained intra-domain access control mechanism for power data provided by the present invention;

[0086] Figure 5 A schematic diagram of the process flow of the cross-domain fine-grained dual access control mechanism for power data provided by the present invention;

[0087] Figure 6 A schematic diagram of the structure of a dynamic management and control system for cross-region and cross-domain data sharing provided by the present invention;

[0088] Figure 7 A schematic diagram of the structure of a computer device provided by the present invention. DETAILED DESCRIPTION

[0089] This invention considers the access control requirements in the context of cross-region and cross-domain, designs security tags and dual access control mechanisms, solves the problems of coarse access control granularity and insufficient security of multi-domain data transmission in the prior art, improves system reliability and scalability, and provides a dynamic control method for cross-region and cross-domain data sharing based on security tags. It includes the following three core technical points:

[0090] I. A dynamic control method for cross-region and cross-domain data sharing based on security tags is designed to ensure the security of intra-domain and cross-domain access of multi-domain power data through a fine-grained dual access control mechanism;

[0091] II. Designed a fine-grained intra-domain access control mechanism for power data, and implemented fine-grained control of power data through attribute-based access control;

[0092] III. A cross-domain fine-grained dual access control mechanism for power data is designed. Role-based access control is performed at the API (Application Programming Interface) level to control the operations of out-of-domain users on the domain system. Attribute-based access control is combined at the database level to alleviate the computing and storage pressure of the API.

[0093] Embodiment 1:

[0094] The present invention provides a dynamic management and control architecture for cross-region and cross-domain data sharing. In view of the data security risk issues and access permission control requirements in data flow and data requests in multi-domain scenarios, a data sharing mechanism is designed to achieve secure sharing and permission control of data when it is transmitted between multiple domains, enhance data transmission between domains, improve work efficiency and ensure data security. There are often multiple different functional areas within a domain, so a domain can be understood as a cross-region. The structure of the dynamic management and control architecture for cross-region and cross-domain data sharing is as follows: Figure 1 As shown, it includes: the in-domain part and the out-domain part;

[0095] The intra-domain part includes intra-domain systems, databases, and access control systems;

[0096] The extraterritorial part includes extraterritorial systems and application programming interfaces;

[0097] The intra-domain system is used to accept access requests from users within the domain or access requests from users outside the domain forwarded through the application program interface, and forward the access requests to the access control system, and is also used to display the data objects returned by the database to the users within the domain initiating the access, or send the returned data objects to the application program interface;

[0098] The access control system is used to dynamically control the data object accessed by the user and the user's own attributes. When access to the data object is allowed, a resource access request is sent to the database.

[0099] The database is used to store data in the domain and send the requested data object to the system in the domain when receiving a resource access request;

[0100] The out-of-domain system is used to receive access requests from out-of-domain users, forward the access requests to the application program interface, and display the data objects forwarded by the application program interface to the out-of-domain users who initiated the access;

[0101] Application program interface, used to perform access control based on the identity and role of users outside the domain. When access to the system within the domain is allowed, the access request is forwarded to the system within the domain. It is also used to forward data objects sent by the system within the domain to the system outside the domain.

[0102] The following uses the power system domain as an example of a specific domain to illustrate the cross-region and cross-domain data sharing dynamic management and control architecture. This architecture is also called the power multi-domain data security sharing architecture. The power business system is the in-domain system, and the out-domain system can be a banking business system or a government department business system. The structure of the power multi-domain data security sharing architecture is as follows: Figure 2As shown in the figure, in the multi-domain data sharing scenario, the domain mainly includes: business systems, policy libraries, label libraries and databases, and can also include users who access the domain (i.e. users within the domain). The domain outside mainly includes systems and APIs outside the domain, and can also include users who access the domain outside the domain (i.e. users outside the domain). Data requests and access control between domains are realized through interaction and collaboration between entities.

[0103] Users in the domain have different role security levels in the system within the domain, and this information can be obtained by logging in to the system. Cross-domain access is performed within the domain. When a logged-in user applies to access data in a system within the domain, the system will generate an original access request containing the requester's attribute information based on the user's subject attributes, such as company, department, security level, etc.

[0104] In order to achieve data access for users within the domain, the system within the domain sends the original access request to the policy library. The policy library obtains the subject and object security label information (referred to as label information) by issuing a security label request to the label library, implements attribute-based access control, filters the data requested for access by the access subject, sends the resource access request to the database, and returns the data that is allowed to be accessed to the system within the domain.

[0105] For users outside the domain, in cross-domain data sharing, since the data leaves the control of the original data owner and flows outside the domain, it faces higher security risks compared to intra-domain transmission, such as data abuse and illegal viewing. Taking into account the actual application scenarios and reducing transmission costs, this application proposes an API-based multi-domain data sharing mechanism to solve the above risk problems and implement fine-grained access control. API allows different software applications or services to communicate and exchange data, providing an effective means to achieve data sharing between multiple domains.

[0106] The user logs in to the system provided by the data owner outside the domain and uses his / her user credentials for authentication. After successful authentication, the outside domain system confirms the user's identity and obtains relevant subject attributes. The access token with a certain validity period generated by the API indicates that the user has passed the authentication and obtained access authorization to the API.

[0107] When a user initiates a data access request to an out-of-domain system, the API will combine the subject attributes, call the API configuration file, and perform role-based access control by querying the role of the accessing user. The API queries the user role recorded in the configuration file, checks the user's access token, verifies his or her identity and permissions, and determines whether the access subject has permission to access the system within the domain. If the user has permission to access the system within the domain, the API will send a request to the system within the domain to obtain relevant data. The system within the domain performs attribute-based access control within the domain based on the request, which is the domain access request processing process mentioned above.

[0108] For users who use the API's role-based access control, the in-domain system will perform fine-grained attribute-based access control. At this stage, the in-domain system determines whether the user has the authority to obtain data of the relevant security level, and obtains data that meets the user's authority. The in-domain system returns the filtered results to the API, and the API passes the results to the out-domain system to display the response data to the user. By combining the API's authentication and access token mechanism, and the permission filtering of the in-domain system, the security control and efficient management of data sharing between multiple domains are effectively achieved.

[0109] The relevant attribute labels (i.e., label information) in the power system scenario are shown in Table 1, and the safety level label description is shown in Table 2.

[0110] Table 1-Related attribute tags in power system scenario

[0111]

[0112]

[0113] Table 2- Safety level label description list

[0114]

[0115] The role description list of role-based access control is shown in Table 3.

[0116] Table 3 - Role description list for role-based access control

[0117]

[0118] Embodiment 2:

[0119] Based on the same inventive concept, the present application also provides a method for dynamic management and control of cross-region and cross-domain data sharing, such as Figure 3 As shown, including:

[0120] Step 1: The access control system receives an access request sent by a system within the domain;

[0121] Step 2: Dynamically control the data object that the user requests to access and the user's own attributes. When access to the data object is allowed, a resource access request is sent to the database.

[0122] Step 3: Receive the data object returned by the database and forward the data object to the system within the domain;

[0123] The access request is an access request initiated by a user within the domain and accepted by the system within the domain, or an access request initiated by a user outside the domain and received by the system outside the domain and access controlled through the application program interface.

[0124] The following uses the power system domain as a specific example of a domain to provide a more specific explanation of the dynamic management and control method for cross-region and cross-domain data sharing.

[0125] The present invention focuses on multi-domain data sharing in power systems and designs an access control model targeting its specific requirements and data security levels, covering intra-domain and inter-domain access control.

[0126] 1. Fine-grained intra-domain access control of power data

[0127] 1-1: Fine-grained intra-domain access control mechanism for power data

[0128] Users in the domain have different role attributes and security levels in the system within the domain. This information can be obtained by logging in to the system. When a logged-in user applies to access data in the system within the domain, the system will generate an original access request containing the requester's attribute information based on the user's subject attributes, such as company, department, security level, etc.

[0129] In order to achieve data access for users within the domain, the system within the domain sends the original access request to the policy library. The policy library obtains the subject and object security label information by sending a security label request (i.e., label request) to the label library, implements attribute-based access control, filters the data that the access subject requests to access, and sends the resource access request to the database, returning the data that is allowed to be accessed to the system within the domain. Among them, the subject is the user who initiates the access, and the object is the data object requested to be accessed.

[0130] The process of the access control mechanism within the fine-grained domain of power data is as follows: Figure 4 shown. Figure 4 In the figure, numbers such as ①, ②, etc. are used to represent the step numbers from 1-1-1 to 1-1-11.

[0131] 1-1-1. Log in and apply for access: Internal users use their account and password to log in to the power grid business system located in the Internet area, verify their personal identity, and apply for data access through the power grid business system and submit an access request.

[0132] 1-1-2. Send access request: The business system sends the request to the policy library located in the management information area, where attribute-based access control (ABAC) is implemented.

[0133] 1-1-3. Label request: In the policy library, the policy enforcement point (PEP) sends a label request based on the attributes of the access subject and data object to obtain detailed security attribute label information of the requester and the requested data.

[0134] 1-1-4. Tag response: After receiving the request, the tag library responds with a tag containing attribute information such as security level, and provides tag information about the access subject and data object.

[0135] 1-1-5. Construct access request: PEP analyzes the returned label content, constructs access request based on security attributes, and submits it to the policy decision point (PDP).

[0136] 1-1-6. Access policy query: The PDP initiates an access policy query to the Policy Administration Point (PAP) to obtain policy information related to the access request attributes.

[0137] 1-1-7. Result response: The PAP queries the access policy and returns the result to the PDP in the form of an access policy response.

[0138] 1-1-8. Response request: Based on the policy response, the PDP responds to the access request and decides whether to allow access.

[0139] 1-1-9. Access resources: If access is allowed, PEP initiates a resource access request to the database.

[0140] 1-1-10. Return data: The database returns the allowed data to the internal system.

[0141] 1-1-11. View data: The authorized data is then displayed to the user, enabling secure and controllable data access within the domain.

[0142] 1-2: Design of fine-grained intra-domain access control strategy for power data

[0143] For users within the domain, attribute-based access control (ABAC) is used to filter and provide authorized data access based on subject and object attributes.

[0144] For attribute-based access control in the intra-domain system, it is necessary to bind labels with attribute information such as security level to the data. In order to implement access control of intra-domain data, it is necessary to bind security labels to sensitive data, bind four security level labels to data of different sensitivity levels, restrict user access, and ensure data privacy and security. In the multi-domain data sharing scenario of the power system, other relevant attributes need to be extracted to implement attribute-based access control.

[0145] The relevant attribute labels (i.e., label information) in the power system scenario are shown in Table 1, and the safety level label description is shown in Table 2.

[0146] After extracting the appropriate subject, object, and environment attributes, it is necessary to establish an attribute-policy association. When formulating access control policies, various attributes must be integrated to ensure a comprehensive and accurate assessment of data objects. This includes considering security factors while integrating other attributes to achieve more intelligent and logical control of access. Through multi-angle analysis of attributes, data objects are artificially assigned appropriate security levels and given corresponding security labels.

[0147] On this basis, the combination of multiple attributes needs to be considered when formulating access control strategies. For the power system scenario, the following strategy can be specified:

[0148] Strategy 1: The company to which the access subject belongs must be the same as the company to which the object data belongs, in order to determine that the data under the node can be accessed by the requesting subject.

[0149] Strategy 2: The department to which the access subject belongs must be the same as the department to which the object data belongs, in order to determine that the data under the node can be accessed by the requesting subject.

[0150] Strategy 3: The access subject’s employment time must be earlier than or equal to the creation time of the object data, that is, the access subject has no right to view the relevant data created before his / her employment.

[0151] Strategy 4: The position level of the access subject is higher than or equal to the security level of the object data, and has no right to view data that is higher than its own security level.

[0152] Strategy 5: Visitors must submit access requests during normal working hours. Accessing data at will is prohibited during non-working hours.

[0153] Strategy 6: The device attributes of the device that the visitor submits the access request must be an encrypted device or a controlled device within the domain. Private devices have no access rights.

[0154] Strategy 7: Determine whether the visitor is within the domain based on his or her geographic location, thereby implementing different permission management processes.

[0155] Strategy 8: Determine whether to transmit data based on the network connection status of the visitor's device. If the network connection status is poor, access is temporarily not allowed to prevent data loss (i.e., access is allowed only when the connection status of the device submitting the access request is better than the preset threshold).

[0156] For the above access policies, in the actual access control process, the intersection of the data that meets each policy should be calculated, that is, let P i is the i-th access control policy, Data i The value range of i is 1-N, that is, there are N access policies and corresponding data that conform to the access control policy. The final data Data-with-Policy that the user has the right to access should be:

[0157] Data-with-Policy=((P1·Data1)∩(P2·Data2)∩…(P N Data N ))#(1)

[0158] 2. Cross-domain fine-grained dual access control of power data

[0159] 2-1: Cross-domain fine-grained dual access control mechanism for power data

[0160] In order to achieve secure sharing of multi-domain power data, this application designs a dual access control mechanism for cross-domain data sharing. It performs role-based access control at the API (Application Programming Interface) level to control the access of out-of-domain users to the intra-domain system, and performs attribute-based access control at the database level, combining the access subject with data objects with multiple attributes and security levels. This can not only alleviate the computing and storage pressure of the API, but also achieve fine-grained data sharing management and control.

[0161] For users outside the domain, in cross-domain data sharing, since the data leaves the control scope of the original data owner and flows outside the domain, it faces higher security risks compared to intra-domain transmission, such as data abuse and illegal viewing. Taking into account the actual application scenarios and reducing transmission costs, this application designs a cross-domain fine-grained dual access control mechanism for power data to address the above issues.

[0162] In order to achieve fine-grained access control, reduce the burden of the API layer and improve the system response efficiency, this mechanism performs preliminary role-based access control at the API level and attribute-based access control within the domain. By reasonably dividing the required access control functions, a secure and efficient data sharing mechanism is constructed, which is suitable for data access control requirements in multi-domain scenarios. When an out-of-domain user requests to access data, the API will first authenticate the user to determine whether the user has the authority to access the in-domain system that provides the data. By performing preliminary user screening at the API level, users who pass the authentication and can access the domain submit access requests to the in-domain system to implement further access control. For users who do not have the authority to access the domain, the API will return a rejection response to the out-of-domain system and will not be able to send data requests to the in-domain system. Unauthorized users are denied access at the API level, which creates a partition between users without access rights and the in-domain system, ensuring the security of the in-domain system. This access control method can alleviate the access control pressure within and outside the domain, conform to the logic of the access process, build an out-of-domain user screening wall for the in-domain system, prevent unauthorized users from accessing the domain, avoid unnecessary access request processing, and improve the performance of the overall system.

[0163] The process of the cross-domain fine-grained dual access control mechanism for power data is as follows: Figure 5 shown. Figure 5 In the figure, numbers such as ①, ②, etc. are used to represent the step numbers from 2-1-1 to 2-1-14.

[0164] 2-1-1. Login: An out-of-domain user logs in to an out-of-domain system.

[0165] 2-1-2. Application for access: Users outside the domain apply for access to power data.

[0166] 2-1-3. Generate access token: Use its user credentials for authentication, the system confirms the user's identity and obtains relevant subject attributes, and the API generates an access token.

[0167] 2-1-4, Find Role: When an access request is initiated, the API calls its configuration file to find the role and determine whether the user has the role with access rights. In steps 2-1-3 and 2-1-4, two independent authorizations are required before the outside domain can access the inside domain. First, identity authentication is performed, an access token is issued, and the permission to access the API is obtained. Then, access control is performed based on the role to obtain the permission to access the system in the domain.

[0168] 2-1-5. Role response: Returns access control results based on the execution results of the role-based access control policy.

[0169] 2-1-6. Send request: If the user outside the domain has the authority to access the power grid domain, the API will initiate a data access request to the business system in the power grid domain.

[0170] 2-1-7. Initiate a request.

[0171] 2-1-8. Label request.

[0172] 2-1-9. Label accordingly.

[0173] 2-1-10. Get data.

[0174] 2-1-11. Return data.

[0175] In steps 2-1-1 to 2-1-11, the intra-domain business system performs the above-mentioned intra-domain attribute-based access control according to the access request, which is the same as the corresponding part of the secure sharing process within the power data domain and will not be repeated here.

[0176] 2-1-12. Return data.

[0177] 2-1-13. Return data.

[0178] 2-1-14. Check the data.

[0179] In steps 2-1-12 to 2-1-14, the filtered data is returned to the API, passed back to the external system, and provided to the accessing user.

[0180] 2-2: Design of cross-domain fine-grained dual access control strategy for power data

[0181] For role-based access control at the API level, the present invention specifies three visitor roles for determining whether a user has the authority to access the power system and for managing relevant user information. The API level saves visitor information in a configuration file, automatically calls the file when the API is enabled, searches for relevant visitor role identities, and checks access tokens. The role description list for role-based access control is shown in Table 3.

[0182] Through the strategy of comprehensive consideration of multiple roles and security attributes, flexible and fine-grained management and control of permissions can be achieved, ensuring that the security protection needs of data sensitivity can be met in different business scenarios. This role-based and attribute-based access control model provides organizations with a higher level of data protection and security management to achieve the purpose of protecting data security and preventing data leakage.

[0183] Embodiment 3:

[0184] The present invention based on the same inventive concept also provides a data cross-region and cross-domain sharing dynamic management and control system, such as Figure 6As shown, it includes: a request receiving module, a data access module and a forwarding module;

[0185] The request receiving module is used to receive access requests sent by the system in the domain in the access control system;

[0186] The data access module is used to dynamically control based on the attributes of the data object requested by the user and the attributes of the user himself, and when access to the data object is allowed, send a resource access request to the database;

[0187] The forwarding module is used to receive the data object returned by the database and forward the data object to the intra-domain system;

[0188] The access request is an access request initiated by a user within the domain and accepted by the system within the domain, or an access request initiated by a user outside the domain and received by the system outside the domain and access controlled through an application program interface.

[0189] Preferably, the data access module performs dynamic control based on the attributes of the data object requested to be accessed by the user and the attributes of the user himself, including:

[0190] The policy library sends a tag request to the tag library based on the attributes of the data object that the user requests to access and the user's own attributes;

[0191] According to the tag information returned by the tag library, it is determined whether access to the data object is allowed.

[0192] Preferably, the data access module uses the policy library to send a tag request to the tag library according to the attributes of the data object requested to be accessed by the user and the attributes of the user himself, including:

[0193] The policy enforcement point in the policy library is used to send a tag request to the tag library according to the attributes of the data object requested to be accessed by the user and the user's own attributes.

[0194] Preferably, the data access module determines whether to allow access to the data object according to the tag information returned by the tag library, including:

[0195] The policy enforcement point in the policy library is used to construct a security access request according to the tag information returned by the tag library;

[0196] A policy decision point in a policy library initiates an access policy query to a policy management point in the policy library according to the security access request, and determines whether access to the data object is allowed according to an access policy response returned by the policy management point.

[0197] Preferably, the application program interface performs access control on access requests initiated by users outside the domain, including:

[0198] The application program interface determines whether the identity of the user outside the domain allows access to the application program interface. When the user's identity allows access to the application program interface, it determines whether access to the system within the domain is allowed according to the user's role.

[0199] Preferably, the management and control system further includes a display module;

[0200] The display module is used to display the data object returned by the database to the user in the domain that initiated the access through the in-domain system after the forwarding module forwards the data object to the in-domain system, or to forward the returned data object to the out-domain system through the application program interface, and the out-domain system displays the data object to the user outside the domain that initiated the access.

[0201] Embodiment 4:

[0202] like Figure 7 As shown, the present invention also provides an electronic device, which may be a computer device, a single-chip device, an intelligent mobile device, etc. The electronic device in this embodiment may include a processor, a memory, a transceiver component, etc. The memory, the processor, and the transceiver component are connected via a bus; the memory may be used to store an execution program, and an exemplary execution program may include instructions; the processor is used to execute the instructions stored in the memory. The memory may also be used to store data, which may be called and / or modified when the instructions are executed.

[0203] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions in a storage medium to implement corresponding method processes or corresponding functions, so as to implement the steps of a method for dynamic management and control of cross-region and cross-domain data sharing in the above-mentioned embodiment.

[0204] Embodiment 5:

[0205] Based on the same inventive concept, the present invention also provides a readable storage medium, specifically an electronic device readable storage medium (Memory), which is a memory device in an electronic device for storing programs and data. It is understandable that the storage medium here may include both a built-in storage medium in an electronic device and an extended storage medium supported by the electronic device. The storage medium provides a storage space that stores the operating system of the terminal. In addition, one or more instructions suitable for being loaded and executed by a processor are also stored in the storage space, and these instructions may be one or more execution programs (including program codes). It should be noted that the storage medium here may be a high-speed RAM memory or a non-volatile memory, such as at least one disk storage. The processor loads and executes one or more instructions stored in the storage medium, which can implement the steps of a method for dynamic control of cross-region and cross-domain sharing of data in the above embodiment.

[0206] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0207] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0208] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0209] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0210] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are included in the scope of the claims of the present invention to be approved.

Claims

1. A dynamic management and control architecture for cross-region and cross-domain data sharing, characterized in that: include: The internal part and the external part; The intra-domain part includes intra-domain systems, databases and access control systems; The external part includes external systems and application programming interfaces; The intra-domain system is used to accept access requests from users within the domain or access requests from users outside the domain forwarded through an application program interface, and forward the access requests to the access control system, and is also used to display the data objects returned by the database to the users within the domain initiating the access, or send the returned data objects to the application program interface; The access control system is used to dynamically control based on the attributes of the data object requested by the user and the attributes of the user himself, and when access to the data object is allowed, send a resource access request to the database; The database is used to store data in the domain and, upon receiving a resource access request, send the requested data object to the system in the domain; The out-of-domain system is used to receive access requests from out-of-domain users, forward the access requests to the application program interface, and display the data objects forwarded by the application program interface to the out-of-domain users who initiated the access; The application program interface is used to perform access control based on the identity and role of users outside the domain. When access to the system within the domain is allowed, the access request is forwarded to the system within the domain. It is also used to forward data objects sent by the system within the domain to the system outside the domain.

2. The architecture of claim 1, wherein: The access control system includes a label library and a policy library; The policy library is used to send a tag request to the tag library based on the attributes of the data object requested to be accessed by the user and the attributes of the user himself when receiving the access request, and is also used to determine whether to allow access to the data object based on the tag information returned by the tag library. When access to the data object is allowed, the policy library screens the data object requested to be accessed by the user and sends a resource access request to the database; The label library is used to store label information of all users and data in the domain, and return label information to the policy library when receiving a label request.

3. The architecture of claim 2, wherein: The policy library includes policy implementation points, policy decision points and policy management points; The policy enforcement point is used to send a tag request to the tag library according to the attributes of the data object requested to be accessed by the user and the attributes of the user himself when receiving the access request, and to construct a security access request according to the tag information returned by the tag library, and submit the security access request to the policy decision point; Also used for sending a resource access request to the database when access to the data object is allowed; The policy decision point is used to initiate an access policy query to the policy management point according to the security access request, and is also used to determine whether to allow access to the data object according to the access policy response returned by the policy management point; The policy management point is used to manage access control policies and return access policy responses related to the attributes of the data object requested to be accessed by the user and the attributes of the user himself according to the security access request.

4. The architecture of claim 2, wherein: The tag information includes a subject attribute tag, an object attribute tag and an environment attribute tag, wherein the subject attribute tag corresponds to the user, and the object attribute tag corresponds to the data object requested to be accessed by the user; The subject attribute label includes one or more of the following: company, department, employment time or security level; The object attribute tag includes one or more of the following: belonging company, belonging department, creation time or security level; The environmental attribute tag includes one or more of the following: access time, access location, device attribute or connection status.

5. The architecture of claim 4, wherein: The access control strategy includes: When all access policy responses determine that the data object is accessible to the user, access to the data object is allowed; The access policies include: When the user's company and the data object's company are the same, the data object is determined to be accessible to the user; When the department to which the user belongs is the same as the department to which the data object belongs, it is determined that the data object can be accessed by the user; When the user's joining time is earlier than or equal to the creation time of the data object, it is determined that the data object can be accessed by the user; When the user's security level is higher than or equal to the security level of the data object, it is determined that the data object can be accessed by the user; When the user's access time is during normal working hours, it is determined that the data object is accessible to the user; When the device attribute of the device to which the user submits the access request is an encrypted device or a controlled device within the domain, it is determined that the data object can be accessed by the user; When the user's access location is within the domain, it is determined that the data object is accessible to the user; When the connection status of the device to which the user submits the access request is better than a preset threshold, it is determined that the data object is accessible to the user.

6. The architecture of claim 1, wherein: The access control strategy of the application program interface includes: Determine whether the user's identity allows access to the application program interface. If the user's identity allows access to the application program interface, determine whether access to the domain system is allowed according to the user's role; wherein the roles include ordinary users, administrators, and strangers; The common user is recorded as a common user in the configuration file of the application program interface and is allowed to access the system within the domain; The administrator is recorded as an administrator in the configuration file, is allowed to access the system within the domain, and is allowed to access the configuration file to change the user's role; The unfamiliar user has no record in the configuration file and is not allowed to access the system within the domain.

7. A method for dynamic management and control of data sharing across regions and domains, characterized in that: include: The access control system receives an access request sent by a system within the domain; Dynamically manage and control the data object requested by the user and the user's own attributes, and when access to the data object is allowed, send a resource access request to the database; Receive the data object returned by the database, and forward the data object to the intra-domain system; The access request is an access request initiated by a user within the domain and accepted by the system within the domain, or an access request initiated by a user outside the domain and received by the system outside the domain and access controlled through the application program interface.

8. The control method according to claim 7, characterized in that: The dynamic control based on the attributes of the data object requested by the user and the attributes of the user himself includes: The policy library sends a tag request to the tag library based on the attributes of the data object that the user requests to access and the user's own attributes; According to the tag information returned by the tag library, it is determined whether access to the data object is allowed.

9. The control method according to claim 8, characterized in that: The adoption strategy library sends a tag request to the tag library according to the attributes of the data object requested to be accessed by the user and the attributes of the user himself, including: The policy enforcement point in the policy library is used to send a tag request to the tag library according to the attributes of the data object requested to be accessed by the user and the user's own attributes.

10. The control method according to claim 8, characterized in that: The determining whether to allow access to the data object according to the tag information returned by the tag library includes: The policy enforcement point in the policy library is used to construct a security access request according to the tag information returned by the tag library; A policy decision point in a policy library initiates an access policy query to a policy management point in the policy library according to the security access request, and determines whether access to the data object is allowed according to an access policy response returned by the policy management point.

11. The control method according to claim 7, characterized in that: The application program interface performs access control on access requests initiated by users outside the domain, including: The application program interface determines whether the identity of the user outside the domain allows access to the application program interface. When the user's identity allows access to the application program interface, it determines whether access to the system within the domain is allowed according to the user's role.

12. The control method according to claim 7, characterized in that: After forwarding the data object to the intra-domain system, the method further includes: The data objects returned by the database are displayed to the users in the domain that initiated the access through the in-domain system, or the returned data objects are forwarded to the out-domain system through the application program interface, and the out-domain system displays the data objects to the users outside the domain that initiated the access.

13. A data cross-region and cross-domain sharing dynamic management and control system, characterized in that: include: Receiving request module, data access module and forwarding module; The request receiving module is used to receive access requests sent by the system in the domain in the access control system; The data access module is used to dynamically control based on the attributes of the data object requested by the user and the attributes of the user himself, and when access to the data object is allowed, send a resource access request to the database; The forwarding module is used to receive the data object returned by the database and forward the data object to the intra-domain system; The access request is an access request initiated by a user within the domain and accepted by the system within the domain, or an access request initiated by a user outside the domain and received by the system outside the domain and access controlled through the application program interface.

14. The control system according to claim 13, characterized in that: The data access module performs dynamic control based on the attributes of the data object requested by the user and the attributes of the user himself, including: The policy library sends a tag request to the tag library based on the attributes of the data object that the user requests to access and the user's own attributes; According to the tag information returned by the tag library, it is determined whether access to the data object is allowed.

15. The control system according to claim 14, characterized in that: The data access module uses the policy library to send a tag request to the tag library according to the attributes of the data object requested to be accessed by the user and the attributes of the user himself, including: The policy enforcement point in the policy library is used to send a label request to the label library according to the attributes of the data object requested to be accessed by the user and the user's own attributes.

16. The control system according to claim 14, characterized in that: The data access module determines whether to allow access to the data object according to the tag information returned by the tag library, including: The policy enforcement point in the policy library is used to construct a security access request according to the tag information returned by the tag library; A policy decision point in a policy library initiates an access policy query to a policy management point in the policy library according to the security access request, and determines whether access to the data object is allowed according to an access policy response returned by the policy management point.

17. The control system according to claim 14, characterized in that: The application program interface performs access control on access requests initiated by users outside the domain, including: The application program interface determines whether the identity of the user outside the domain allows access to the application program interface. When the user's identity allows access to the application program interface, it determines whether access to the system within the domain is allowed according to the user's role.

18. The control system according to claim 14, characterized in that: The control system also includes a display module; The display module is used to display the data object returned by the database to the user in the domain that initiated the access through the in-domain system after the forwarding module forwards the data object to the in-domain system, or to forward the returned data object to the out-domain system through the application program interface, and the out-domain system displays the data object to the user outside the domain that initiated the access.

19. A computer device, characterized in that: include: at least one processor and memory; The memory and the processor are connected via a bus; The memory is used to store one or more programs; When the one or more programs are executed by the at least one processor, a method for dynamic management and control of cross-region and cross-domain data sharing as described in any one of claims 7 to 12 is implemented.

20. A computer-readable storage medium, characterized in that: An execution program is stored thereon, and when the execution program is executed, a method for dynamic management and control of cross-region and cross-domain data sharing as described in any one of claims 7 to 12 is implemented.

Images