Security assessment method, device and equipment of electric power information system and medium

Abstract

The invention discloses a safety assessment method, device and equipment for an electric power information system and a medium. The method comprises the steps of performing validity evaluation on an authority management mode of a target electric power information system to obtain an evaluation result; wherein the target electric power information system adopts an openEuler micro-service architecture; identifying an unauthorized access behavior and an abnormal behavior according to the log record of the target electric power information system to obtain an identification result; performing a performance test on the target electric power information system in the high-concurrency pressure scene to obtain a test result; and adjusting role and authority configuration in the authority management mode according to the evaluation result and the identification result, and adjusting micro-service configuration in the authority management mode according to the test result. According to the technical scheme, the problem of potential security risks caused by improper permission configuration and unauthorized access can be effectively solved, the security and the high efficiency of the electric power information system are ensured, and thus the stable operation and the reliability of the electric power system are ensured.

Description

Technical Field

[0001] The present invention relates to the field of electric power technology, and in particular to a safety assessment method, device, equipment and medium for an electric power information system. Background Art

[0002] In the power sector, the security and performance of information systems are crucial. With the development of digitalization and intelligence of power systems, more and more power companies are using microservice architecture to build their information systems. Microservice architecture has the advantages of flexibility, scalability and easy maintenance, but it also faces the challenges of complex permission management and high concurrency processing.

[0003] The security of microservice architecture is mainly reflected in permission management and access control. In a microservice architecture, each microservice may need to manage permissions separately. Due to the large number of microservices and complex permission configuration, the following problems are prone to occur: 1. Improper permission configuration: unreasonable configuration of roles and permissions leads to excessive or insufficient permissions, which poses a security risk; 2. Unauthorized access: due to incorrect or missing permission configuration, some users or services may try to access unauthorized resources, causing potential security risks. Summary of the invention

[0004] The present invention provides a security assessment method, device, equipment and medium for an electric power information system, which can effectively solve potential security risk problems caused by improper permission configuration and unauthorized access based on the security assessment and configuration adjustment of the electric power information system, ensure the security and efficiency of the electric power information system, and thus ensure the stable operation and reliability of the electric power system.

[0005] According to one aspect of the present invention, a method for safety assessment of an electric power information system is provided, the method comprising:

[0006] An effectiveness evaluation is performed on the permission management method of the target power information system to obtain an evaluation result; wherein the target power information system adopts the openEuler microservice architecture, and the permission management method is used to describe the mapping relationship between roles, permissions and microservices;

[0007] Identify unauthorized access behavior and abnormal behavior according to the log records of the target power information system to obtain identification results; wherein the log records include request logs through the API gateway and access logs between microservices;

[0008] Performing a performance test on the target power information system in a high concurrency pressure scenario to obtain a test result; wherein the high concurrency pressure scenario is a scenario in which the number of concurrent users is greater than a preset number threshold;

[0009] The role and permission configuration in the permission management method are adjusted according to the evaluation result and the identification result, and the microservice configuration in the permission management method is adjusted according to the test result.

[0010] According to another aspect of the present invention, there is provided a safety assessment device for an electric power information system, the device comprising:

[0011] The validity evaluation module is used to evaluate the validity of the permission management method of the target power information system to obtain an evaluation result; wherein the target power information system adopts the openEuler microservice architecture, and the permission management method is used to describe the mapping relationship between roles, permissions and microservices;

[0012] A behavior identification module, used to identify unauthorized access behavior and abnormal behavior according to the log records of the target power information system to obtain identification results; wherein the log records include request logs through the API gateway and access logs between microservices;

[0013] A performance testing module, used to perform a performance test on the target power information system in a high concurrency stress scenario to obtain a test result; wherein the high concurrency stress scenario is a scenario in which the number of concurrent users is greater than a preset number threshold;

[0014] A configuration adjustment module is used to adjust the role and permission configuration in the permission management method according to the evaluation result and the identification result, and to adjust the microservice configuration in the permission management method according to the test result.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] at least one processor; and,

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the security assessment method of the power information system described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the safety assessment method of the power information system described in any embodiment of the present invention when executed.

[0020] The technical solution of the embodiment of the present invention first evaluates the effectiveness of the permission management method of the target power information system to obtain an evaluation result; wherein the target power information system adopts the openEuler microservice architecture, and the permission management method is used to describe the mapping relationship between roles, permissions and microservices; then, unauthorized access behavior and abnormal behavior are identified according to the log records of the target power information system to obtain an identification result; wherein the log records include request logs through the API gateway and access logs between microservices; then, the target power information system is subjected to a performance test under a high concurrency pressure scenario to obtain a test result; wherein the high concurrency pressure scenario is a scenario in which the number of concurrent users is greater than a preset number threshold; finally, the role and permission configuration in the permission management method are adjusted according to the evaluation results and the identification results, and the microservice configuration in the permission management method is adjusted according to the test results. This technical solution can effectively solve the potential security risk problems caused by improper permission configuration and unauthorized access based on the security evaluation and configuration adjustment of the power information system, ensure the security and efficiency of the power information system, and thus ensure the stable operation and reliability of the power system.

[0021] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 is a flow chart of a safety assessment method for a power information system provided according to Embodiment 1 of the present invention;

[0024] Figure 2 is a flow chart of a safety assessment method for a power information system provided according to a second embodiment of the present invention;

[0025] Figure 3 is a schematic diagram of the structure of a safety assessment device for a power information system provided according to a third embodiment of the present invention;

[0026] Figure 4 It is a structural schematic diagram of an electronic device for implementing a safety assessment method for a power information system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", "target", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment 1

[0030] Figure 1 This is a flowchart of a method for safety assessment of a power information system provided in the first embodiment of the present invention. This embodiment is applicable to the situation of safety assessment and configuration adjustment of a power information system. The method can be executed by a safety assessment device of a power information system. The safety assessment device of the power information system can be implemented in the form of hardware and / or software. The safety assessment device of the power information system can be configured in an electronic device with data processing capabilities. Figure 1 As shown, the method includes:

[0031] S110, evaluating the effectiveness of the authority management method of the target power information system to obtain an evaluation result.

[0032] The target power information system may refer to a power information system that needs to be security assessed, and the target power information system adopts the openEuler microservice architecture. Exemplarily, the target power information system may be a domestic system in the power field. The permission management method is used to describe the mapping relationship between roles, permissions, and microservices, that is, to describe what permissions a role corresponds to and what microservices it has permission to use.

[0033] In this embodiment, in order to evaluate whether the permission configuration is reasonable, we first obtain and organize the permission management method of the target power information system using the openEuler microservice architecture, and extract the main data sources from it, including role definition, permission definition, and microservice definition. Exemplarily, the above main data sources can be expressed as follows:

[0034] Role A: system administrator, Role B: ordinary user;

[0035] Permission 1: read permission, permission 2: write permission;

[0036] Microservice A: user management service, Microservice B: order processing service.

[0037] Based on the above main data sources, the mapping relationship between roles, permissions and microservices can be analyzed, and the mapping relationship between the three can be recorded by building a mapping relationship table, and then the effectiveness of the permission management method can be evaluated based on the mapping relationship between the three in the mapping relationship table to obtain the evaluation results. For example, a mapping relationship table is shown in Table 1 below:

[0038] Table 1 Mapping relationship table

[0039] Role Permissions Microservices Role A Permission 1 Microservice A Role A Permission 2 Microservice B Role B Permission 1 Microservice A

[0040] In this embodiment, optionally, an effectiveness evaluation is performed on the permission management method of the target power information system to obtain an evaluation result, including: determining the permission coverage rate of each role based on the ratio of the number of permissions possessed by each role in the permission management method to the total number of permissions of the target power information system; determining the permission applicability index of each role based on the ratio of the number of applicable permissions possessed by each role in the permission management method to the number of permissions possessed by each role; and performing an effectiveness evaluation on the permission management method of the target power information system based on the permission coverage rate and the permission applicability index to obtain an evaluation result.

[0041] The permission coverage rate can be used to describe the permission coverage of each role, and the permission applicability index can be used to evaluate whether the permissions of each role are used within its scope of responsibility. Determine the permission coverage of each role, where f i represents the permission coverage of role i; j i,q Indicates the number of permissions that role i has; x q Represents the total number of permissions of the target power information system. It can be obtained by the formula Determine the permission applicability index for each role, where s i represents the authority applicability index of role i; j i,s Indicates the number of applicable permissions that role i has.

[0042] After determining the permission coverage rate and permission applicability index of each role, the effectiveness of the permission management method of the target power information system can be evaluated based on the permission coverage rate and the permission applicability index based on a pre-set threshold value (as a critical reference value of effectiveness) to obtain an evaluation result. Optionally, the effectiveness of the permission management method of the target power information system is evaluated based on the permission coverage rate and the permission applicability index to obtain an evaluation result, including: if the permission coverage rate is less than the first threshold, it is determined that the permission management method has risks; if the permission applicability index is less than the second threshold, it is determined that the permission management method has risks.

[0043] The first threshold and the second threshold may refer to preset critical reference values ​​corresponding to the permission coverage rate and the permission applicability, respectively. If the permission coverage rate is less than the first threshold or the permission applicability index is less than the second threshold, it can be determined that the permission management method has risks in terms of effectiveness.

[0044] S120, identifying unauthorized access behavior and abnormal behavior according to the log records of the target power information system to obtain an identification result.

[0045] In this embodiment, the log records of the target power information system can be used to analyze the actual access between users and microservices, identify unauthorized access behaviors and abnormal behaviors to obtain identification results, and thus implement permission access auditing. Among them, the log records include request logs through the API gateway and access logs between microservices. For example, the request log may include information such as the requester identity (such as user ID or microservice ID), request path, request method, request time, and response status; the access log may include information such as the service call source (i.e., the called service), target service, call time, call results, and call parameters. Exemplarily, abnormal behavior types may include behaviors such as login exceptions, abnormal access, and data leakage attempts.

[0046] In the present embodiment, optionally, identifying unauthorized access behavior and abnormal behavior based on the log records of the target power information system to obtain an identification result includes: performing data preprocessing on the log records of the target power information system to obtain a first log record; wherein the data preprocessing includes deleting duplicate log records, unifying the time format and field names of the log records, and deleting log records that are not related to permission auditing; classifying the first log record based on request type and time to obtain a second log record; wherein the request type includes user requests and service requests; performing permission verification on each request in the second log record according to the permission management method, and identifying unauthorized access behavior based on the verification result; and performing abnormal behavior identification on each request in the second log record based on a preset abnormal behavior identification model.

[0047] Specifically, firstly, data preprocessing is performed on the log records of the target power information system, including deleting duplicate log records, unifying the time format and field names of log records, and deleting log records that are not related to permission audit (such as health check requests, etc.), to obtain a first log record. Then, the first log record is classified according to the requester's identity to distinguish between user requests and service requests, and the first log record is classified according to time to obtain a second log record. Then, according to the permission management method (specifically, the mapping relationship between the role, permission and microservice recorded in the mapping relationship can be referred to), each request in the second log record is checked to see whether it meets the permission requirements. If it meets, it belongs to legal access, and if it does not meet, it belongs to unauthorized access. Then, a pre-trained machine learning model (i.e., a preset abnormal behavior recognition model) is used to identify abnormal behavior for each request in the second log record to obtain abnormal access behavior. The number of unauthorized access behaviors and the number of abnormal behaviors identified are counted respectively, and whether there is a security risk is determined based on the pre-set first quantity threshold and second quantity threshold. Specifically, if the number of unauthorized access behaviors is greater than the first quantity threshold or the number of abnormal behaviors is greater than the second quantity threshold, it can be determined that there is a security risk.

[0048] Further, an unauthorized access report can be generated, listing all unauthorized access attempts, including the requester, request time, request path, and response status. Exemplarily, the unauthorized access report may include: user ID: user123, request time: 2024-09-26 10:00:00, request path: / admin / data, response status: 403. In addition, an abnormal behavior report can be generated, listing all identified abnormal behaviors, including the requester, abnormal behavior type, and abnormal time period. Exemplarily, the abnormal behavior report may include: user ID: serviceA, abnormality type: frequent failed requests, time period: 2024-09-26 10:00:00-10:30:00.

[0049] S130, performing a performance test on the target power information system under a high concurrency pressure scenario to obtain a test result.

[0050] The high concurrency pressure scenario is a scenario where the number of concurrent users is greater than a preset number threshold. The preset number threshold may refer to a reference value of the number of concurrent users pre-set according to actual needs.

[0051] In this embodiment, JMeter can be used to perform high-concurrency stress testing, simulate user behavior in real scenarios, and record performance data; and while performing stress testing, use penetration testing tools to perform security testing on microservices to identify potential security vulnerabilities and risks. Optionally, a performance test is performed on the target power information system in a high-concurrency stress scenario to obtain test results, including: determining the user operation script based on JMeter, setting thread group parameters, and starting a high-concurrency stress test of the target power information system; during the high-concurrency stress test, determining the performance data of the target power information system, and determining performance evaluation indicators based on the performance data; wherein the performance evaluation indicators include average response time, throughput, and error rate; and identifying the performance bottleneck of the target power information system based on the performance evaluation indicators.

[0052] Among them, the average response time can be used to analyze the response performance of the system, the throughput can be used to evaluate the processing capacity of the system under high concurrency conditions, and the error rate can be used to check the stability of the system under high load. It should be noted that if the average response time is low, it means that the overall performance of the system is good; otherwise, it means that the overall performance of the system is poor. If the throughput is high, it means that the system can handle more requests and adapt to a larger concurrent load. If the error rate is high, it means that the system is unstable under high load and there may be reliability issues.

[0053] Specifically, first use JMeter's HTTP(S)Test Script Recorder to record the user operation script, or write the script manually. Among them, all users can use the same operation script, which is suitable for simple performance testing. Through parameterization technology, each user uses the same script, but the operation data is different. For example, different users log in to different accounts or access different data entries. In addition, you can also simulate different types of user behaviors, create multiple different scripts, and assign them to different thread groups, which can be determined according to the actual scenario during performance testing. For example, one thread group simulates the operation of ordinary users, and another thread group simulates the operation of administrators. After the recording is completed, you can set the thread group parameters, including setting the number of threads to simulate the number of concurrent users, for example, it can be set to 1000, indicating that 1000 concurrent users are simulated; setting the Ramp-Up time, indicating the time required for all threads to start, for example, it can be set to 60 seconds, indicating that all threads are gradually started within 60 seconds; setting the number of times each thread executes the test, which can be set to a fixed number or loop forever.

[0054] Then run the JMeter test plan and start a high-concurrency stress test. During the test, record relevant performance data and monitor system resource usage in real time (such as CPU, memory, disk I / O, network bandwidth, etc.). For example, the performance data may include the response time of each request, the number of requests processed per unit time, and the proportion of failed requests. Then determine the performance evaluation indicators based on the performance data, including average response time, throughput, and error rate. For example, the formula Calculate the average response time, where T i represents the response time of the i-th request; n is the total number of requests. Calculate the throughput, where T total Represents the total test time. Calculate the error rate, where n error Indicates the number of error requests.

[0055] After the performance evaluation index is determined, the performance bottleneck of the target power information system can be identified according to the performance evaluation index. Optionally, identifying the performance bottleneck of the target power information system according to the performance evaluation index includes: if the average response time of the target power information system is greater than the third threshold, it is determined that the target power information system has a performance bottleneck; if the throughput of the target power information system is less than the fourth threshold, it is determined that the target power information system has a performance bottleneck; if the error rate of the target power information system is greater than the fifth threshold, it is determined that the target power information system has a performance bottleneck.

[0056] Among them, the third threshold value may refer to a preset reference value of the average response time. The fourth threshold value may refer to a preset reference value of the throughput. The fifth threshold value may refer to a preset reference value of the error rate. Specifically, if the average response time of the target power information system is greater than the third threshold value, it indicates that the average response time of the system is long and the overall performance of the system is poor. At this time, it can be determined that the target power information system has a performance bottleneck; if the throughput of the target power information system is less than the fourth threshold value, it indicates that the system can process a small number of requests and cannot adapt to a larger concurrent load. At this time, it can be determined that the target power information system has a performance bottleneck; if the error rate of the target power information system is greater than the fifth threshold value, it indicates that the system is unstable under high load and may have reliability issues. At this time, it can be determined that the target power information system has a performance bottleneck.

[0057] Furthermore, the response performance of the system can be analyzed based on the 90th percentile response time indicator. Among them, the 90th percentile response time can mean that among the response times of all requests, 90% of the request response times are less than or equal to this value, and only 10% of the request response times are greater than this value, that is, the data in 90% is used. The 90th percentile response time can better reflect the user experience than the average response time, especially in high concurrency situations. A higher 90th percentile response time indicates that the system has a large delay when processing the slowest 10% of requests. At this time, the system response performance is poor and needs further optimization.

[0058] S140, adjusting the role and permission configuration in the permission management method according to the evaluation results and the identification results, and adjusting the microservice configuration in the permission management method according to the test results.

[0059] In this embodiment, the roles and permission configurations in the permission management method can be adjusted according to the evaluation results and identification results to ensure that the access rights of each microservice are minimized; and the microservice configurations in the permission management method can be adjusted according to the performance bottlenecks in the test results to optimize the calling logic and load balancing configuration of the microservices. Specifically, if the evaluation result is that there is no risk, there is no need to adjust the role and permission configuration; if the evaluation result is that there is a risk, it is necessary to increase or adjust the permissions of the role to ensure that its permission coverage and permission applicability index meet the standards. Exemplarily, according to the principle of least privilege, the permissions of each role can be checked one by one, and redundant permissions can be eliminated. As long as the necessary permissions are retained, it is ensured that each role only has the minimum permission set required to complete its duties. Then re-perform the permission access audit to verify whether the adjusted permission configuration meets the security requirements and ensure that unauthorized access and abnormal behavior are effectively controlled.

[0060] When optimizing the call logic of microservices, you can optimize the service call chain, reduce unnecessary calls, merge repeated or redundant service calls, and use asynchronous calls or batch processing to reduce the waiting time of synchronous calls. When optimizing the load balancing configuration of microservices, you can adjust the load balancing strategy based on the throughput and response time data to ensure that requests are reasonably distributed to each service instance and avoid overloading some instances. In addition, you can configure an automatic expansion strategy to automatically increase the number of service instances when the load increases to ensure system stability. You can also use caching technology to cache frequently accessed data, reduce the number of database queries, and optimize database queries to ensure efficient query statements and avoid complex joint table queries. Then rerun the performance benchmark to verify the effect of the optimization measures and ensure that performance bottlenecks are effectively alleviated. Continuously monitor system performance and adjust the optimization strategy in a timely manner to ensure that the system runs stably under high concurrency conditions.

[0061] The technical solution of the embodiment of the present invention first evaluates the effectiveness of the permission management method of the target power information system to obtain an evaluation result; wherein the target power information system adopts the openEuler microservice architecture, and the permission management method is used to describe the mapping relationship between roles, permissions and microservices; then, unauthorized access behavior and abnormal behavior are identified according to the log records of the target power information system to obtain an identification result; wherein the log records include request logs through the API gateway and access logs between microservices; then, the target power information system is subjected to a performance test under a high concurrency pressure scenario to obtain a test result; wherein the high concurrency pressure scenario is a scenario in which the number of concurrent users is greater than a preset number threshold; finally, the role and permission configuration in the permission management method are adjusted according to the evaluation results and the identification results, and the microservice configuration in the permission management method is adjusted according to the test results. This technical solution can be based on the security assessment and configuration adjustment of the power information system, can effectively solve the potential security risk problems caused by improper permission configuration and unauthorized access, ensure the security and efficiency of the power information system, and thus ensure the stable operation and reliability of the power system.

[0062] Embodiment 2

[0063] Figure 2 A flowchart of a security assessment method for an electric power information system provided in the second embodiment of the present invention, this embodiment is optimized based on the above embodiment. The specific optimization is: after identifying unauthorized access behavior and abnormal behavior according to the log records of the target electric power information system to obtain the identification results, it also includes: determining the microservice call relationship according to the access logs between microservices, and generating a call relationship graph according to the microservice call relationship; wherein the call relationship graph includes nodes and edges, nodes represent microservices, edges represent calls between microservices, and the direction of the edge represents the call direction; mapping the permission management method to the call relationship graph to obtain a dependency relationship graph; wherein the dependency relationship graph is used to describe the access path and permission relationship between microservices.

[0064] like Figure 2 As shown, the method of this embodiment specifically includes the following steps:

[0065] S210, evaluating the effectiveness of the authority management method of the target power information system to obtain an evaluation result.

[0066] Among them, the target power information system adopts the openEuler microservice architecture, and the permission management method is used to describe the mapping relationship between roles, permissions and microservices.

[0067] S220, identifying unauthorized access behavior and abnormal behavior according to the log records of the target power information system to obtain an identification result.

[0068] Among them, logging includes request logs through the API gateway and access logs between microservices.

[0069] S230, determining a microservice call relationship according to the access logs between the microservices, and generating a call relationship graph according to the microservice call relationship.

[0070] The call relationship graph includes nodes and edges, where nodes represent microservices, edges represent calls between microservices, and the direction of the edge represents the call direction. Specifically, the microservice call relationship is extracted based on the access logs between microservices, and a call relationship graph is generated, where each microservice is a node, the calls between microservices are edges, and the direction of the edge represents the call direction.

[0071] S240, mapping the permission management mode to the call relationship graph to obtain a dependency relationship graph.

[0072] The dependency graph is used to describe the access paths and permission relationships between microservices. Specifically, the permission allocation information in the permission management method is mapped to the call relationship graph, and the permission relationship on each edge is marked. Use a graphical tool to generate a dependency graph to show the access paths and permission relationships between services, where the nodes are marked with microservice names and role information, and the edges are marked with permission types and call frequencies. Exemplarily, the dependency graph can be represented as follows:

[0073] Microservice A->Microservice B (read permission);

[0074] Microservice B -> Microservice C (write permission).

[0075] S250, performing a performance test on the target power information system under a high concurrency pressure scenario to obtain a test result.

[0076] Among them, the high concurrency pressure scenario is a scenario where the number of concurrent users is greater than the preset number threshold.

[0077] S260, adjusting the role and permission configuration in the permission management method according to the evaluation results and the identification results, and adjusting the microservice configuration in the permission management method according to the test results.

[0078] The technical solution of the embodiment of the present invention, after identifying unauthorized access behavior and abnormal behavior according to the log records of the target power information system to obtain the identification results, determines the microservice call relationship according to the access logs between microservices, and generates a call relationship graph according to the microservice call relationship; wherein the call relationship graph includes nodes and edges, nodes represent microservices, edges represent calls between microservices, and the direction of the edge represents the call direction; the permission management method is mapped to the call relationship graph to obtain a dependency relationship graph; wherein the dependency relationship graph is used to describe the access path and permission relationship between microservices. This technical solution can intuitively display the access path and permission relationship between microservices through the generated dependency relationship graph.

[0079] Embodiment 3

[0080] Figure 3 This is a schematic diagram of the structure of a power information system security assessment device provided in the third embodiment of the present invention. The device can execute the power information system security assessment method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. Figure 3 As shown, the device comprises:

[0081] The validity evaluation module 310 is used to evaluate the validity of the permission management method of the target power information system to obtain an evaluation result; wherein the target power information system adopts the openEuler microservice architecture, and the permission management method is used to describe the mapping relationship between roles, permissions and microservices;

[0082] A behavior identification module 320 is used to identify unauthorized access behavior and abnormal behavior according to the log records of the target power information system to obtain an identification result; wherein the log records include request logs through the API gateway and access logs between microservices;

[0083] The performance test module 330 is used to perform a performance test on the target power information system in a high concurrency pressure scenario to obtain a test result; wherein the high concurrency pressure scenario is a scenario in which the number of concurrent users is greater than a preset number threshold;

[0084] The configuration adjustment module 340 is used to adjust the role and permission configuration in the permission management method according to the evaluation result and the identification result, and to adjust the microservice configuration in the permission management method according to the test result.

[0085] Optionally, the effectiveness evaluation module 310 includes:

[0086] A permission coverage ratio determination unit, configured to determine the permission coverage ratio of each role according to the ratio of the number of permissions possessed by each role in the permission management mode to the total number of permissions of the target power information system;

[0087] A permission applicability index determination unit, configured to determine the permission applicability index of each role according to the ratio of the number of applicable permissions possessed by each role in the permission management mode to the number of permissions possessed by each role;

[0088] An evaluation result determination unit is used to evaluate the effectiveness of the authority management method of the target power information system according to the authority coverage rate and the authority applicability index to obtain an evaluation result.

[0089] Optionally, the evaluation result determination unit is used to:

[0090] If the permission coverage rate is less than a first threshold, it is determined that the permission management method has risks;

[0091] If the permission applicability index is less than a second threshold, it is determined that the permission management method has risks.

[0092] Optionally, the behavior recognition module 320 is used to:

[0093] Performing data preprocessing on the log records of the target power information system to obtain a first log record; wherein the data preprocessing includes deleting duplicate log records, unifying the time format and field names of log records, and deleting log records that are not related to authority auditing;

[0094] Classifying the first log record based on request type and time to obtain a second log record; wherein the request type includes user request and service request;

[0095] Performing permission verification on each request in the second log record according to the permission management method, and identifying unauthorized access behavior according to the verification result;

[0096] Abnormal behavior identification is performed on each request in the second log record based on a preset abnormal behavior identification model.

[0097] Optionally, the device further includes: a dependency graph determining module, configured to:

[0098] After identifying unauthorized access behavior and abnormal behavior according to the log records of the target power information system and obtaining identification results, determining the microservice call relationship according to the access logs between the microservices, and generating a call relationship graph according to the microservice call relationship; wherein the call relationship graph includes nodes and edges, the nodes represent microservices, the edges represent calls between microservices, and the direction of the edges represents the call direction;

[0099] The permission management method is mapped to the call relationship graph to obtain a dependency graph; wherein the dependency graph is used to describe the access path and permission relationship between microservices.

[0100] Optionally, the performance testing module 330 is used to:

[0101] A high-concurrency stress test unit, used to determine the user operation script based on JMeter, set thread group parameters, and start the high-concurrency stress test of the target power information system;

[0102] A performance evaluation index determination unit, used to determine the performance data of the target power information system during the high concurrency stress test, and determine the performance evaluation index according to the performance data; wherein the performance evaluation index includes average response time, throughput and error rate;

[0103] A system performance bottleneck identification unit is used to identify the performance bottleneck of the target power information system according to the performance evaluation index.

[0104] Optionally, the system performance bottleneck identification unit is used to:

[0105] If the average response time of the target power information system is greater than a third threshold, determining that the target power information system has a performance bottleneck;

[0106] If the throughput of the target power information system is less than a fourth threshold, determining that the target power information system has a performance bottleneck;

[0107] If the error rate of the target power information system is greater than a fifth threshold, it is determined that a performance bottleneck exists in the target power information system.

[0108] A safety assessment device for a power information system provided in an embodiment of the present invention can execute a safety assessment method for a power information system provided in any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0109] Embodiment 4

[0110] Figure 4A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0111] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0112] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0113] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a security assessment method for a power information system.

[0114] In some embodiments, the security assessment method of the power information system may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the security assessment method of the power information system described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the security assessment method of the power information system in any other appropriate manner (e.g., by means of firmware).

[0115] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0116] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0117] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0118] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0119] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0120] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0121] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0122] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A security assessment method for a power information system, characterized in that: The method comprises: An effectiveness evaluation is performed on the permission management method of the target power information system to obtain an evaluation result; wherein the target power information system adopts the openEuler microservice architecture, and the permission management method is used to describe the mapping relationship between roles, permissions and microservices; Identify unauthorized access behavior and abnormal behavior according to the log records of the target power information system to obtain identification results; wherein the log records include request logs through the API gateway and access logs between microservices; Performing a performance test on the target power information system in a high concurrency pressure scenario to obtain a test result; wherein the high concurrency pressure scenario is a scenario in which the number of concurrent users is greater than a preset number threshold; The role and permission configuration in the permission management method are adjusted according to the evaluation result and the identification result, and the microservice configuration in the permission management method is adjusted according to the test result.

2. The method according to claim 1, characterized in that: The effectiveness of the authority management method of the target power information system is evaluated to obtain the evaluation results, including: Determining the permission coverage rate of each role according to the ratio of the number of permissions possessed by each role in the permission management method to the total number of permissions of the target power information system; Determining the permission applicability index of each role according to the ratio of the number of applicable permissions possessed by each role in the permission management method to the number of permissions possessed by each role; An effectiveness evaluation is performed on the authority management method of the target power information system according to the authority coverage rate and the authority applicability index to obtain an evaluation result.

3. The method according to claim 2, characterized in that The effectiveness of the authority management method of the target power information system is evaluated according to the authority coverage rate and the authority applicability index to obtain an evaluation result, including: If the permission coverage rate is less than a first threshold, it is determined that the permission management method has risks; If the permission applicability index is less than a second threshold, it is determined that the permission management method has risks.

4. The method according to claim 1, characterized in that Identifying unauthorized access behavior and abnormal behavior according to the log records of the target power information system to obtain identification results, including: Performing data preprocessing on the log records of the target power information system to obtain a first log record; wherein the data preprocessing includes deleting duplicate log records, unifying the time format and field names of log records, and deleting log records that are not related to authority auditing; Classifying the first log record based on request type and time to obtain a second log record; wherein the request type includes user request and service request; Performing permission verification on each request in the second log record according to the permission management method, and identifying unauthorized access behavior according to the verification result; Abnormal behavior identification is performed on each request in the second log record based on a preset abnormal behavior identification model.

5. The method according to claim 1, characterized in that After identifying unauthorized access behavior and abnormal behavior according to the log records of the target power information system to obtain identification results, the method further includes: Determine the microservice call relationship according to the access logs between the microservices, and generate a call relationship graph according to the microservice call relationship; wherein the call relationship graph includes nodes and edges, the nodes represent microservices, the edges represent calls between microservices, and the direction of the edges represents the call direction; The permission management method is mapped to the call relationship graph to obtain a dependency graph; wherein the dependency graph is used to describe the access path and permission relationship between microservices.

6. The method according to claim 1, characterized in that The target power information system is subjected to a performance test under a high concurrent pressure scenario to obtain test results, including: Determine the user operation script based on JMeter, set the thread group parameters, and start the high concurrency stress test of the target power information system; During the high-concurrency stress test, performance data of the target power information system is determined, and performance evaluation indicators are determined according to the performance data; wherein the performance evaluation indicators include average response time, throughput and error rate; A performance bottleneck of the target power information system is identified according to the performance evaluation index.

7. The method according to claim 6, characterized in that Identifying the performance bottleneck of the target power information system according to the performance evaluation indicator includes: If the average response time of the target power information system is greater than a third threshold, determining that the target power information system has a performance bottleneck; If the throughput of the target power information system is less than a fourth threshold, determining that the target power information system has a performance bottleneck; If the error rate of the target power information system is greater than a fifth threshold, it is determined that a performance bottleneck exists in the target power information system.

8. A safety assessment device for an electric power information system, characterized in that: The device comprises: The validity evaluation module is used to evaluate the validity of the permission management method of the target power information system to obtain an evaluation result; wherein the target power information system adopts the openEuler microservice architecture, and the permission management method is used to describe the mapping relationship between roles, permissions and microservices; A behavior identification module, used to identify unauthorized access behavior and abnormal behavior according to the log records of the target power information system to obtain identification results; wherein the log records include request logs through the API gateway and access logs between microservices; A performance testing module, used to perform a performance test on the target power information system in a high concurrency stress scenario to obtain a test result; wherein the high concurrency stress scenario is a scenario in which the number of concurrent users is greater than a preset number threshold; A configuration adjustment module is used to adjust the role and permission configuration in the permission management method according to the evaluation result and the identification result, and to adjust the microservice configuration in the permission management method according to the test result.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the security assessment method for the power information system according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the safety assessment method for the power information system according to any one of claims 1 to 7 when executed.

Images