Power monitoring system dispatching master station network security strategy approval management method and system

Abstract

The invention discloses a power monitoring system dispatching master station network security policy approval management method and system, and belongs to the technical field of network security. Comprising the steps of obtaining a security strategy; the method comprises the following steps: extracting key features from a preset rule decision table, performing hierarchical storage on the key features to form a condition hierarchical structure, and determining an execution sequence of the key features according to priorities of the key features; and based on the condition hierarchical structure, according to the execution sequence, verifying the security and protection strategy through a stack, and obtaining a verification result. The requirements of standardization, process and intensification of security and protection strategy approval management of the scheduling master station can be met, and the management efficiency and accuracy are improved; the problem that the efficiency and accuracy of existing security policy automatic approval management need to be improved is solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for approving and managing network security strategies of a dispatching master station of an electric power monitoring system. Background Art

[0002] The statements in this section merely mention background art related to the present invention and do not necessarily constitute prior art.

[0003] With the development of new power systems, more and more technical support systems are being built in power monitoring systems, and host devices such as servers and workstations, as well as network equipment and security equipment, are being added. The addition of systems and equipment will inevitably lead to the increase and change of security strategies. A large number of security strategy changes have further increased the workload of security strategy approval and management at the main station of the power monitoring system.

[0004] Traditional power monitoring system security protection strategy management relies on emails, paper version signature approval and other methods, with many points and wide areas, many communication links, unsmooth circulation, lax closed-loop control, and low management efficiency. With the development of informatization, existing technologies automatically parse and compare policy configuration files through policy configuration management systems to achieve management of policy configuration files without manual verification; but the following problems still exist: 1. Security policies may contain unstructured descriptive text, such as explanations or notes of specific rules. These contents are usually difficult to parse and process, resulting in the need to improve the efficiency and accuracy of automatic approval management of security policies.

[0005] 2. The security environment is constantly changing and new threats are constantly emerging, but this is not taken into account in the approval and management process of existing security strategies, and they are unable to adapt to the real-time changing security situation. Summary of the invention In order to overcome the deficiencies of the prior art, the present invention provides a method and system for the approval management of network security strategies of a power monitoring system dispatching master station, which realizes the automated approval management of security strategies through a multi-rule matching algorithm, thereby improving the approval efficiency and accuracy.

[0006] In a first aspect, the present invention provides a method for approving and managing network security strategies of a dispatching master station of a power monitoring system; A method for approving and managing network security strategies of a dispatching master station of a power monitoring system, comprising: Obtain security strategies; Extract key features from a preset rule decision table, store the key features in layers to form a conditional hierarchical structure, and determine the execution order of the key features according to the priorities of the key features; Based on the conditional hierarchical structure and according to the execution order, the security strategy is verified through a stack to obtain a verification result.

[0007] In some implementations, extracting key features from a preset rule decision table, storing the key features in layers to form a conditional hierarchical structure, and determining the execution order of the key features according to the priorities of the key features includes: Using regular expressions to extract key fields and logical conditions in the rule decision table, and storing the key fields in layers according to condition categories to form a conditional hierarchical structure; Based on the conditional hierarchical structure, the execution order of the logical conditions is determined according to the priorities of the logical conditions.

[0008] In some embodiments, the security strategy is verified through a stack based on the conditional hierarchical structure and according to the execution order. Specifically, based on the conditional hierarchical structure and according to the execution order, the rules in the sub-rule set are pushed into the stack in sequence, and the security strategy is verified step by step through the judgment expressions and judgment functions built into the stack.

[0009] In some implementations, if the verification result is failed, the next operation is prohibited and the sub-rule unsatisfied information is fed back.

[0010] In some implementations, before obtaining the security strategy, the method further includes: performing personnel identity verification in response to a verification operation by an operation and maintenance personnel.

[0011] In some implementations, the security strategy acquisition is triggered in real time in response to a user input operation, a modification operation, and a strategy confirmation operation.

[0012] In a second aspect, the present invention provides a network security strategy approval management system for a power monitoring system dispatching master station; A network security strategy approval management system for a power monitoring system dispatching master station, comprising: The acquisition module is configured to: acquire security strategies; The verification rule extraction module is configured to: extract key features from a preset rule decision table, store the key features in layers to form a conditional hierarchical structure, and determine the execution order of the key features according to the priorities of the key features; The verification module is configured to: based on the conditional hierarchical structure and according to the execution order, verify the security strategy through a stack to obtain a verification result.

[0013] In a third aspect, the present invention provides an electronic device; An electronic device comprises a memory, a processor and a computer program stored in the memory, wherein the processor executes the computer program to implement the steps of the above-mentioned power monitoring system dispatching master station network security strategy approval management method.

[0014] In a fourth aspect, the present invention provides a computer-readable storage medium; A computer-readable storage medium stores a computer program / instruction, which, when executed by a processor, implements the steps of the above-mentioned power monitoring system dispatching master station network security strategy approval management method.

[0015] In a fifth aspect, the present invention provides a computer program product; A computer program product includes a computer program / instruction, which, when executed by a processor, implements the steps of the above-mentioned power monitoring system dispatching master station network security strategy approval management method.

[0016] Compared with the prior art, the present invention has the following beneficial effects: 1. The technical solution provided by the present invention verifies the security strategy through a multi-level rule matching algorithm, and can optimize the processing flow through priority sorting, first quickly filtering out the security strategies that are obviously unexecutable, and then performing a more detailed inspection of the remaining data; this not only improves the processing speed, but also ensures the accuracy of deep detection.

[0017] 2. The technical solution provided by the present invention can continuously evaluate and optimize its security strategy based on the result feedback of multi-level rule matching; by analyzing the problems found in actual operation, the rules can be adjusted in time to cope with new threat challenges, thereby achieving continuous improvement of security protection capabilities.

[0018] 3. The technical solution provided by the present invention can meet the requirements of standardization, process-based and intensified approval management of the dispatching master station security strategy; and provide a real-time verification feedback mechanism. During the rule matching and verification process, clear prompt information will be provided for security strategies that do not meet the conditions (for example, "the vertical density strategy has more than 20 consecutive IPs"), and feasibility suggestions will be given to ensure the accuracy and compliance of the strategy. If it fails, the next step cannot be performed, ensuring technical accuracy and safety, and smooth and compliant management. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0020] Figure 1 A schematic diagram of a process flow of a method for approving and managing network security strategies of a power monitoring system dispatching master station provided by an embodiment of the present invention; Figure 2 An example diagram of a security strategy provided by an embodiment of the present invention; Figure 3 A schematic diagram of the framework of the network security strategy approval management system for the power monitoring system dispatching master station provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0021] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used in the present invention have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0022] It should be noted that the terms used herein are only for describing specific embodiments, and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that the terms "include" and "have" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0024] Embodiment 1 Since the data content of security strategies is rich and the security environment is constantly changing, the efficiency, accuracy and adaptability of the existing automatic approval management of security strategies need to be improved; therefore, the present invention provides a network security strategy approval management method for a power monitoring system dispatching master station, which centralizes and processes the approval of the master station power monitoring strategy, and integrates different approval authorities and different approval angles into the process for approval in sequence, thereby achieving convenient disposal and closed-loop management.

[0025] Next, combine Figure 1-Figure 2 , a method for approving and managing network security strategies of a power monitoring system dispatching master station disclosed in this embodiment is described in detail. The method for approving and managing network security strategies of a power monitoring system dispatching master station comprises the following steps: S1. In response to the verification operation of the operation and maintenance personnel, perform personnel identity authentication; after the verification is passed, execute S2.

[0026] Specifically, in response to the input operation of the operation and maintenance personnel, the user password is obtained, and if the user password is entered correctly, the identity authentication is passed.

[0027] To further improve security, in some embodiments, in response to the operation and maintenance personnel inserting the U-key, the digital certificate is read and identity authentication is performed based on the digital certificate.

[0028] S2. According to business requirements and the assigned IP address, fill in the tunnel, policy and other information based on the policy template to form a security strategy.

[0029] Here, the policy template is specially formulated by the operation and maintenance personnel according to the characteristics of the policy configuration of different security equipment; there are corresponding policy templates for forward and reverse isolation devices, vertical encryption devices, firewalls and other devices, and the security policies of different devices are filled in using the corresponding policy templates.

[0030] Furthermore, after the security strategy is completed, the data is transferred to the background and stored using a relational database. The relational database uses the type field to distinguish different types of policy templates and merges and stores similar fields to optimize the database structure and reduce redundancy.

[0031] Furthermore, in order to monitor data changes in real time, a real-time verification feedback mechanism is provided based on user input and modification events, as follows: (1) Input trigger: After the user enters information such as IP address, port number, policy type, etc. in the configuration interface, the system automatically detects the new input data and triggers real-time verification.

[0032] (2) Modification trigger: When a user modifies existing data, the system automatically captures the modification behavior and rechecks the relevant rules.

[0033] (3) Policy confirmation trigger: When a user completes a policy configuration and attempts to save it, the system will perform a final check on the complete configuration.

[0034] S3. Verify the security strategy through a multi-rule matching algorithm to obtain a verification result; if the verification result is not passed, execute S4; if the verification result is passed, execute S5.

[0035] Security policies have various formats and field definitions. Therefore, in this embodiment, a multi-rule matching algorithm is used to process them to improve the accuracy of the inspection. As an implementation method, S3 includes: S301, extract key features from a preset rule decision table, store the key features in layers to form a conditional layered structure, and determine the execution order of the key features according to the priorities of the key features.

[0036] Specifically, regular expressions are used to extract key fields and logical conditions in the rule decision table, and the key fields are stored in layers according to the condition categories to form a conditional hierarchical structure; based on the conditional hierarchical structure, the execution order of the logical conditions is determined according to the priority of the logical conditions. As an implementation manner, before executing S301, the step further includes designing and importing the rules in the form of a decision table.

[0037] The rules support the import of Excel files, which contain specific rule definitions, such as rule ID, priority, operation description, prompt instructions, etc. For the vertical density strategy, the number of consecutive IPs shall not exceed 20, and the number of consecutive ports shall not exceed 4; for the firewall, the number of consecutive destination ports shall not exceed 5; the rule definitions are stored in the system relational database to facilitate batch management and adjustment, and can also be directly created and modified in the system through the visual editor.

[0038] Rule Decision Table Example

[0039] In order to accurately and efficiently extract various judgment conditions from the rule decision table, illustratively, the specific process of S301 is as follows: (1) Initialization and input data preparation: Read the rule decision table from the database and load each rule record into the memory; these rules should include fields such as rule ID, priority, judgment condition, operation type and prompt information, and convert the rule decision table into a structure suitable for processing (such as JSON or dictionary) for operation.

[0040] (2) Conditional word segmentation and parsing: Parse the "judgment condition" field in the rule decision table and decompose the conditional expression into logical operators (such as and, or, not) and conditional functions (such as source IP address is valid(), destination IP address is valid()); use regular expressions to identify and extract the judgment conditions in the conditional expression, including key fields (such as source IP address, destination port, etc.) and logical conditions (such as less than, equal to, etc.), and store them as structured data for subsequent processing.

[0041] (3) Hierarchical storage: Key fields, such as "source IP address" and "destination port", are stored hierarchically according to conditional categories to form a conditional hierarchical structure, with each layer being a sub-rule set.

[0042] Based on this, the dependency relationship between conditions can be clearly presented, which makes it easier for the subsequent rule matching algorithm to verify in order according to the condition hierarchy and avoid repeated processing between conditions.

[0043] (4) Condition priority and execution order setting: Sort the extracted logical conditions according to the priority field in the decision table to determine the execution order of the conditions; for complex conditions, further subdivide the execution priority.

[0044] For example, basic IP and port validity checks can be placed at a high level for priority execution, while policy-type conditions are executed step by step at lower levels to ensure that the order of the condition hierarchy is met.

[0045] (5) Storage and structured output: The extracted conditional hierarchy is stored in a structured data format (such as JSON or dictionary), all key fields and logical conditions are sorted by priority and category, and output to the rule engine.

[0046] S302: Based on the conditional hierarchical structure and in accordance with the execution order, the security strategy is verified through the stack to obtain the verification result. The specific process is as follows: S3021. Push rules onto the stack: Starting from the first rule of the conditional hierarchy, push the current rule onto the stack for processing.

[0047] S3022, condition judgment: when processing the rule, the judgment is made according to the conditional expression and priority of the rule, and if the condition is met, the corresponding operation is performed, such as pass, fail, jump.

[0048] S3023. Jump and stack operation: If a "jump" operation is encountered, the stack will directly push the target rule to the top of the stack according to the rule instructions to give priority to the rule after the jump.

[0049] S3024, rule popping: After a rule is processed, the stack will pop it out and return to the previous unfinished rule to continue execution until the stack is empty.

[0050] In summary, according to the priority and execution order of the rules, the policy configuration is verified layer by layer. If the judgment condition of the rule is met, it is executed according to the operation. If it fails, a corresponding prompt is added; if the judgment condition of the rule is not met, it will continue to try to match the next rule.

[0051] At the same time, the stack-based implementation can effectively handle complex rule nesting and jumps, and record matching progress so that it can return after the jump. Built-in judgment expressions and common functions make the rules more flexible and extensible, and even support custom functions to meet specific needs. Custom functions can accept input parameters, execute specific logic, and return Boolean values ​​or other data results, making rule configuration more flexible. Common judgment functions for rule matching include continuous IP segment checks, port range checks, etc., to ensure rule compliance and accuracy.

[0052] Exemplarily, if the rule decision table given in S301 is taken as an example, the following checks will be performed: (1) IP address validity check: Determine whether the source IP address is valid and the destination IP address is valid.

[0053] (2) Port validity check: Determine whether the source port is valid and the destination port is valid and meets the conditions.

[0054] (3) Policy type check and diversion: Depending on the policy type (such as vertical density, firewall), the system will jump to the corresponding rule block for verification. If the policy type = vertical density, then jump to rule 8 to further check the continuous IP and continuous port. If the policy type = firewall, then jump to rule 12 and check the number of continuous ports in turn.

[0055] S4. For security policies that do not meet the conditions, the user is prevented from proceeding to the next step and must complete the corresponding adjustments until the configuration meets all rule requirements.

[0056] For example, if a rule does not meet the system's IP or port restrictions, the system will disable the "Save" button and display the unmet rule information and prompt information (such as "Vertical density strategy has more than 20 consecutive IPs") on the interface, prompting the user to make further changes. Only after all rules have passed the verification will the "Save" button be unlocked, allowing the user to complete the configuration. Ensure technical accuracy and security, and smooth and compliant management.

[0057] S5. The verified security strategies shall be submitted to the business manager of the applicant unit, the business management department, and the network security personnel for review in turn.

[0058] Specifically, the business manager of the applicant unit reviews and checks the submitted tunnel and policy information; the business management department reviews the necessity of the business, and different businesses are automatically sent to the corresponding business management department for review. Here, the management departments of different businesses are pre-fixed. After selecting a specific business, the business management department will conduct a licensing review; the network security officer reviews the security of the strategy to determine whether it complies with the minimization principle.

[0059] S6. Network security practitioners shall configure network security equipment according to the security strategy.

[0060] Furthermore, after the process is reviewed and approved, a set value list is generated and transmitted to the network security platform of the safety zone II in the form of an E file through the reverse isolation device. The network security platform receives the set value list and parses it into the database. After the execution of the set value list, the network security platform collects and reviews the equipment security strategy and compares and verifies it with the content of the set value list. When the collected security strategy is inconsistent with the set value list, an alarm is generated. The verification result is transmitted to the safety zone III through the forward isolation device. The network security professional ends or rolls back the process according to the verification result, realizing the closed-loop management of the security strategy set value.

[0061] Furthermore, all approved and configured security strategies can be searched and reviewed according to information such as "applicant" and "applicant".

[0062] Embodiment 2 Combination Figure 3 Based on the power monitoring system dispatching master station network security strategy approval management method described in Example 1, this embodiment discloses a power monitoring system dispatching master station network security strategy approval management system, including: The acquisition module is configured to: acquire security strategies; The verification rule extraction module is configured to: extract key features from a preset rule decision table, decompose the key features into multiple sub-rule sets, and create a conditional hierarchical structure according to the priority and execution order of the sub-rule sets; The verification module is configured to: based on the conditional hierarchical structure, according to the priority and the execution order, verify the security strategy through the stack to obtain a verification result.

[0063] As an implementation method, the specific implementation process of the acquisition module is as follows: According to business requirements and the assigned IP address, fill in tunnel, policy and other information based on the policy template to form a security strategy.

[0064] Here, the policy template is specially formulated by the operation and maintenance personnel according to the characteristics of the policy configuration of different security equipment; there are corresponding policy templates for forward and reverse isolation devices, vertical encryption devices, firewalls and other devices, and the security policies of different devices are filled in using the corresponding policy templates.

[0065] Furthermore, after the security strategy is completed, the data is transferred to the background and stored using a relational database. The relational database uses the type field to distinguish different types of policy templates and merges and stores similar fields to optimize the database structure and reduce redundancy.

[0066] Furthermore, in order to monitor data changes in real time, a real-time verification feedback mechanism is provided based on user input and modification events, as follows: (1) Input trigger: After the user enters information such as IP address, port number, policy type, etc. in the configuration interface, the system automatically detects the new input data and triggers real-time verification.

[0067] (2) Modification trigger: When a user modifies existing data, the system automatically captures the modification behavior and rechecks the relevant rules.

[0068] (3) Policy confirmation trigger: When a user completes a policy configuration and attempts to save it, the system will perform a final check on the complete configuration.

[0069] As an implementation method, the implementation process of the verification rule extraction module is as follows: S301, extract key features from a preset rule decision table, store the key features in layers to form a conditional layered structure, and determine the execution order of the key features according to the priorities of the key features.

[0070] Specifically, regular expressions are used to extract key fields and logical conditions in the rule decision table, and the key fields are stored in layers according to the condition categories to form a conditional hierarchical structure; based on the conditional hierarchical structure, the execution order of the logical conditions is determined according to the priority of the logical conditions. As an implementation manner, before executing S301, the step further includes designing and importing the rules in the form of a decision table.

[0071] The rules support the import of Excel files, which contain specific rule definitions, such as rule ID, priority, operation description, prompt instructions, etc. For the vertical density strategy, the number of consecutive IPs shall not exceed 20, and the number of consecutive ports shall not exceed 4; for the firewall, the number of consecutive destination ports shall not exceed 5; the rule definitions are stored in the system relational database to facilitate batch management and adjustment, and can also be directly created and modified in the system through the visual editor.

[0072] Rule Decision Table Example

[0073] In order to accurately and efficiently extract various judgment conditions from the rule decision table, illustratively, the specific process of S301 is as follows: (1) Initialization and input data preparation: Read the rule decision table from the database and load each rule record into the memory; these rules should include fields such as rule ID, priority, judgment condition, operation type and prompt information, and convert the rule decision table into a structure suitable for processing (such as JSON or dictionary) for operation.

[0074] (2) Conditional word segmentation and parsing: Parse the "judgment condition" field in the rule decision table and decompose the conditional expression into logical operators (such as and, or, not) and conditional functions (such as source IP address is valid(), destination IP address is valid()); use regular expressions to identify and extract the judgment conditions in the conditional expression, including key fields (such as source IP address, destination port, etc.) and logical conditions (such as less than, equal to, etc.), and store them as structured data for subsequent processing.

[0075] (3) Hierarchical storage: Key fields, such as "source IP address" and "destination port", are stored hierarchically according to conditional categories to form a conditional hierarchical structure, with each layer being a sub-rule set.

[0076] Based on this, the dependency relationship between conditions can be clearly presented, which makes it easier for the subsequent rule matching algorithm to verify in order according to the condition hierarchy and avoid repeated processing between conditions.

[0077] (4) Condition priority and execution order setting: Sort the extracted logical conditions according to the priority field in the decision table to determine the execution order of the conditions; for complex conditions, further subdivide the execution priority.

[0078] For example, basic IP and port validity checks can be placed at a high level for priority execution, while policy-type conditions are executed step by step at lower levels to ensure that the order of the condition hierarchy is met.

[0079] (5) Storage and structured output: The extracted conditional hierarchy is stored in a structured data format (such as JSON or dictionary), all key fields and logical conditions are sorted by priority and category, and output to the rule engine.

[0080] As an implementation method, the implementation process of the verification module is as follows: S302: Based on the conditional hierarchical structure and in accordance with the execution order, the security strategy is verified through the stack to obtain the verification result. The specific process is as follows: S3021. Push rules onto the stack: Starting from the first rule of the conditional hierarchy, push the current rule onto the stack for processing.

[0081] S3022, condition judgment: when processing the rule, the judgment is made according to the conditional expression and priority of the rule, and if the condition is met, the corresponding operation is performed, such as pass, fail, jump.

[0082] S3023. Jump and stack operation: If a "jump" operation is encountered, the stack will directly push the target rule to the top of the stack according to the rule instructions to give priority to the rule after the jump.

[0083] S3024, rule popping: After a rule is processed, the stack will pop it out and return to the previous unfinished rule to continue execution until the stack is empty.

[0084] In summary, according to the priority and execution order of the rules, the policy configuration is verified layer by layer. If the judgment condition of the rule is met, it is executed according to the operation. If it fails, a corresponding prompt is added; if the judgment condition of the rule is not met, it will continue to try to match the next rule.

[0085] At the same time, the stack-based implementation can effectively handle complex rule nesting and jumps, and record matching progress so that it can return after the jump. Built-in judgment expressions and common functions make the rules more flexible and extensible, and even support custom functions to meet specific needs. Custom functions can accept input parameters, execute specific logic, and return Boolean values ​​or other data results, making rule configuration more flexible. Common judgment functions for rule matching include continuous IP segment checks, port range checks, etc., to ensure rule compliance and accuracy.

[0086] Exemplarily, if the rule decision table given in S301 is taken as an example, the following checks will be performed: (1) IP address validity check: Determine whether the source IP address is valid and the destination IP address is valid.

[0087] (2) Port validity check: Determine whether the source port is valid and the destination port is valid and meets the conditions.

[0088] (3) Policy type check and diversion: Depending on the policy type (such as vertical density, firewall), the system will jump to the corresponding rule block for verification. If the policy type = vertical density, then jump to rule 8 to further check the continuous IP and continuous port. If the policy type = firewall, then jump to rule 12 and check the number of continuous ports in turn.

[0089] It should be noted that the acquisition module, verification rule extraction module and verification module described above correspond to the steps in Embodiment 1, and the examples and application scenarios implemented by the modules described above are the same as those of the corresponding steps, but are not limited to the contents disclosed in Embodiment 1 described above. It should be noted that the modules described above as part of the system can be executed in a computer system such as a set of computer executable instructions.

[0090] Embodiment 3 Embodiment 3 of the present invention provides an electronic device, including a memory and a processor, and computer instructions stored in the memory and running on the processor. When the computer instructions are executed by the processor, the steps of the above-mentioned power monitoring system dispatching master station network security policy approval management method are completed.

[0091] Embodiment 4 Embodiment 4 of the present invention provides a computer-readable storage medium for storing computer instructions. When the computer instructions are executed by a processor, the steps of the above-mentioned power monitoring system dispatching master station network security strategy approval management method are completed.

[0092] Embodiment 5 Embodiment 5 of the present invention provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the above-mentioned power monitoring system dispatching master station network security policy approval management method.

[0093] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0094] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0095] These computer program instructions can also be loaded onto a computer or other programmable data processing device, and a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0096] The description of each embodiment in the above embodiments has different emphases. For parts not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0097] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for approving and managing network security strategies for a power monitoring system dispatching master station, characterized in that: include: Obtain security strategies; Extract key features from a preset rule decision table, store the key features in layers to form a conditional hierarchical structure, and determine the execution order of the key features according to the priorities of the key features; Based on the conditional hierarchical structure and according to the execution order, the security strategy is verified through a stack to obtain a verification result.

2. The power monitoring system dispatching master station network security strategy approval management method according to claim 1, characterized in that: The extracting of key features from the preset rule decision table, storing the key features in layers to form a conditional layered structure, and determining the execution order of the key features according to the priorities of the key features include: Using regular expressions to extract key fields and logical conditions in the rule decision table, and storing the key fields in layers according to condition categories to form a conditional hierarchical structure; Based on the conditional hierarchical structure, the execution order of the logical conditions is determined according to the priorities of the logical conditions.

3. The power monitoring system dispatching master station network security strategy approval management method according to claim 1, characterized in that: The method of verifying the security strategy through a stack based on the conditional hierarchical structure and according to the execution order is as follows: based on the conditional hierarchical structure and according to the execution order, the rules in the sub-rule set are pushed into the stack in sequence, and the security strategy is verified step by step through the judgment expressions and judgment functions built into the stack.

4. The method for approving and managing network security strategies of a power monitoring system dispatching master station according to claim 1, characterized in that: If the verification result is not passed, the next step is prohibited and the sub-rule information is fed back that is not met.

5. The method for approval management of network security strategy of the power monitoring system dispatching master station according to claim 1, characterized in that: Before obtaining the security strategy, it also includes: responding to the verification operation of the operation and maintenance personnel, performing personnel identity authentication.

6. The method for approval management of network security strategy of the power monitoring system dispatching master station according to claim 1, characterized in that: The security strategy acquisition is triggered in real time in response to the user's input operation, modification operation and strategy confirmation operation.

7. The network security strategy approval management system of the power monitoring system dispatching master station is characterized by: include: The acquisition module is configured to: acquire security strategies; The verification rule extraction module is configured to: extract key features from a preset rule decision table, store the key features in layers to form a conditional hierarchical structure, and determine the execution order of the key features according to the priorities of the key features; The verification module is configured to: based on the conditional hierarchical structure and according to the execution order, verify the security strategy through a stack to obtain a verification result.

8. An electronic device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the power monitoring system dispatching master station network security strategy approval management method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instruction is executed by the processor, the steps of the power monitoring system dispatching master station network security strategy approval management method described in any one of claims 1-6 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by the processor, the steps of the power monitoring system dispatching master station network security strategy approval management method described in any one of claims 1-6 are implemented.

Images