Basin information security architecture construction method and device, computer equipment and product

Abstract

The invention relates to the technical field of watershed information management, and discloses a watershed information security architecture construction method and device, computer equipment and a product, and the watershed information security architecture construction method comprises the steps: constructing a security policy management layer, a security policy control layer and a security policy execution layer based on a watershed information network, a drainage basin information production large area, a drainage basin information operation large area and a drainage basin information internet-of-things large area are constructed based on drainage basin information data, and data are transmitted in a one-way mode in a security policy management layer, a security policy control layer and a security policy execution layer according to transmission authority; constructing a watershed information security policy by using the security policy management layer, applying the watershed information security policy to a watershed information total platform and sending the watershed information security policy to the security policy control layer; the security policy control layer is utilized to generate a watershed information security sub-policy, and the watershed information security sub-policy is applied to a watershed information sub-platform and issued to the security policy execution layer; and executing the drainage basin information security sub-policy by using the security policy execution layer. According to the invention, the watershed information data security can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of watershed information management, and in particular to a method, device, computer equipment and product for constructing a watershed information security architecture. Background Art

[0002] Security Architecture is a collection of security policies, technologies, and controls designed and implemented in an information system or network to protect assets from unauthorized access, use, disclosure, disruption, or modification.

[0003] In the watershed information model, the security architecture is the guarantee of watershed applications and can provide security for business architecture, data architecture, application architecture and technical architecture.

[0004] At present, the scale, relevance and complexity of river basin informatization construction are gradually increasing. River basin data involves water resources allocation, water pollution control, flood prevention and disaster reduction, etc., including a variety of confidential data. The security of the river basin information management system directly affects data security. An unreasonable security architecture cannot guarantee the confidentiality, integrity, availability and security of river basin information data. Summary of the invention

[0005] In view of this, the present invention provides a method, device, computer equipment and product for constructing a watershed information security architecture to improve the security of watershed information data.

[0006] In the first aspect, the present invention provides a method for constructing a watershed information security architecture, which includes: constructing a security policy management layer, a security policy control layer and a security policy execution layer based on the watershed information network, constructing a watershed information production area, a watershed information operation area and a watershed information Internet of Things area based on watershed information data, and transmitting data in the watershed information production area, the watershed information operation area and the watershed information Internet of Things area in a unidirectional manner in the security policy management layer, the security policy control layer and the security policy execution layer according to the transmission authority; constructing a watershed information security policy using the security policy management layer, applying the watershed information security policy to the watershed information general platform, and sending the watershed information security policy to the security policy control layer; generating a watershed information security sub-policy based on the watershed information security policy using the security policy control layer, applying the watershed information security sub-policy to the watershed information sub-platform, and sending the watershed information security sub-policy to the security policy execution layer; and executing the watershed information security sub-policy using the security policy execution layer.

[0007] In this implementation, a watershed information security architecture including a security policy management layer, a security policy control layer, and a security policy execution layer is constructed. The hierarchical relationship is used from top to bottom. The security policy control layer is controlled by the security policy management layer, and the security policy execution layer is controlled by the security policy control layer to ensure the security of policy management. At the same time, a general security policy is set for the watershed information platform, and corresponding security sub-policies are set according to different watershed information sub-platforms. This can ensure data security between different watershed information sub-platforms and further improve network policy management security. The security architecture of this application can be migrated and customized to increase the scope of adaptation while ensuring security. On the basis of network security, data is divided into watershed information production areas, watershed information operation areas, and watershed information Internet of Things areas. By limiting the data transmission permissions in different areas, the confidentiality of data and the security of data transmission are guaranteed.

[0008] In an optional implementation, the watershed information security policy includes an overall security policy and a meta-security policy, and the watershed information security policy is sent down to the security policy control layer, including: using the overall security policy to send the meta-security policy down to the corresponding watershed information sub-platform in the security policy control layer.

[0009] In an optional implementation, a security policy control layer is used to generate a watershed information security sub-policy based on the watershed information security policy, and the watershed information security sub-policy is applied to the watershed information sub-platform, including: using the security policy control layer to generate a watershed information security sub-policy in combination with the business and meta-security policies of the watershed information sub-platform; and applying the watershed information security sub-policy to the corresponding watershed information sub-platform.

[0010] In this implementation, the security policy is divided into an overall security policy and a meta-security policy. The overall security policy distributes the meta-security policy according to different river basin information sub-platforms to ensure the security of policy distribution. For different river basin information sub-platforms, security sub-policies are generated according to business adaptability, which can generate policies that meet the business security requirements of the river basin information sub-platform, ensure the internal data security of each river basin information sub-platform and the data security between different river basin information sub-platforms, and further improve the security of policy management. At the same time, the security policy control layer of this application allows construction and expansion based on the meta-network security policy according to the application system and business, improving applicability and scalability.

[0011] In an optional implementation, the meta-security policy includes an identity policy and a control policy, wherein the identity policy is used for identity management and identity authentication of the watershed information sub-platform; the control policy is used to set access rights based on the user's security level on the watershed information sub-platform, and to authenticate requests to access the watershed information sub-platform.

[0012] In this implementation, identity strategy and control strategy are used to ensure the user access security of the watershed information sub-platform.

[0013] In an optional implementation, the watershed information production area includes a variety of watershed information production data, the watershed information operation area includes a variety of watershed information operation data, and the watershed information Internet of Things area includes a variety of watershed information Internet of Things data. The data in the watershed information production area, the watershed information operation area and the watershed information Internet of Things area are transmitted unidirectionally in the security policy management layer, the security policy control layer and the security policy execution layer according to the transmission authority, including: using the security policy execution layer to collect watershed information production data, and transmitting the watershed information production data to the security policy control layer after processing; using the security policy control layer to collect watershed information operation data, and processing the watershed information operation data, and transmitting the processed watershed information production data and / or watershed information operation data to the security policy management layer; using the security policy management layer to collect watershed information management data.

[0014] In this implementation method, by restricting the transmission method between the watershed information production area, the watershed information operation area and the watershed information Internet of Things area, it is ensured that data can only flow from the watershed information production area to the watershed information operation area, and from the watershed information operation area to the watershed information Internet of Things area, ensuring that the underlying data cannot be widely disseminated, thereby improving the security of data management.

[0015] In an optional implementation, constructing a watershed information production area, a watershed information operation area and a watershed information Internet of Things area based on watershed information data includes: obtaining a business architecture for watershed information data; hierarchically dividing the watershed information data into watershed characteristic data, watershed element data and watershed object data according to the watershed vision, business domain and business process in the business architecture, each watershed object data corresponds to multiple watershed element data, and each watershed element data corresponds to multiple watershed characteristic data; constructing a watershed information production area based on watershed characteristic data, constructing a watershed information operation production area based on watershed element data, and constructing a watershed information Internet of Things area based on watershed object data.

[0016] In this implementation method, by dividing the data into watershed characteristic data, watershed element data and watershed object data according to the hierarchy, the watershed characteristic data with the highest confidentiality is divided into the watershed information production area, the watershed element data with the second highest confidentiality is divided into the watershed information operation and production area, and the watershed object data is divided into the watershed information Internet of Things area. Combined with the corresponding management level of each area, the security of watershed data can be further guaranteed.

[0017] In a second aspect, the present invention provides a device for constructing a watershed information security architecture, which includes: a construction module, which is used to construct a security policy management layer, a security policy control layer and a security policy execution layer based on the watershed information network, and to construct a watershed information production area, a watershed information operation area and a watershed information Internet of Things area based on the watershed information data. The data in the watershed information production area, the watershed information operation area and the watershed information Internet of Things area are transmitted unidirectionally in the security policy management layer, the security policy control layer and the security policy execution layer according to the transmission authority; a policy management module, which is used to use the security policy management layer to construct a watershed information security policy, apply the watershed information security policy to the watershed information platform, and send the watershed information security policy to the security policy control layer; a policy control module, which is used to use the security policy control layer to generate a watershed information security sub-policy based on the watershed information security policy, apply the watershed information security sub-policy to the watershed information sub-platform, and send the watershed information security sub-policy to the security policy execution layer; a policy execution module, which is used to execute the watershed information security sub-policy using the security policy execution layer.

[0018] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, computer instructions are stored in the memory, and the processor executes the method for constructing a watershed information security architecture according to the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0019] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the method for constructing a watershed information security architecture according to the first aspect or any corresponding embodiment thereof.

[0020] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions, and the computer instructions are used to enable a computer to execute the method for constructing a watershed information security architecture according to the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 is a flow chart of a method for constructing a watershed information security architecture according to an embodiment of the present invention; Figure 2is a schematic diagram of a watershed information security architecture according to an embodiment of the present invention; Figure 3 is a flowchart of another method for constructing a watershed information security architecture according to an embodiment of the present invention; Figure 4 is a schematic diagram of another watershed information security architecture according to an embodiment of the present invention; Figure 5 is a structural block diagram of a device for constructing a watershed information security architecture according to an embodiment of the present invention; Figure 6 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0024] The watershed information model of this application includes business architecture, data architecture, application architecture, technical architecture, security architecture, etc. The security architecture is the guarantee of watershed applications and can provide security for business architecture, data architecture, application architecture and technical architecture.

[0025] Therefore, a reasonable security architecture can ensure the confidentiality, integrity, availability and security of watershed information data.

[0026] According to an embodiment of the present invention, an embodiment of a method for constructing a watershed information security architecture is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0027] In this embodiment, a method for constructing a watershed information security architecture is provided. Figure 1 is a flow chart of a method for constructing a watershed information security architecture according to an embodiment of the present invention. It should be noted that if there are substantially the same results, this embodiment is not based on Figure 1 The process sequence shown is limited. Figure 1 As shown, the process includes the following steps: Step S101, construct a security policy management layer, a security policy control layer and a security policy execution layer based on the river basin information network, and construct a river basin information production area, a river basin information operation area and a river basin information Internet of Things area based on the river basin information data.

[0028] This application divides the river basin information network into a security policy management layer, a security policy control layer and a security policy execution layer from the perspective of policy management.

[0029] Among them, the management relationship between the security policy management layer, the security policy control layer and the security policy execution layer is "total-division-total-division" management, the security policy control layer manages the security policy execution layer, and the security policy execution layer manages the security policy execution layer.

[0030] On the basis of strategy zoning, the river basin information production area, river basin information operation area and river basin information Internet of Things area are constructed based on the river basin information data. The data in the river basin information production area, river basin information operation area and river basin information Internet of Things area are transmitted unidirectionally in the security policy management layer, security policy control layer and security policy execution layer according to the transmission permissions.

[0031] Specifically, see Figure 2 , Figure 2 is a schematic diagram of a watershed information security architecture according to an embodiment of the present invention. Figure 2 As shown, the security policy management layer distributes policies to the security policy control layer, and when there is a security threat, attacks are blocked. The security policy control layer distributes policies to the security policy execution layer, and when there is a security threat, attacks are blocked. The security policy execution layer transmits data to the security policy control layer, and the security policy control layer transmits data to the security policy management layer.

[0032] Step S102, using the security policy management layer to construct the watershed information security policy, applying the watershed information security policy to the watershed information general platform, and sending the watershed information security policy to the security policy control layer.

[0033] The security policy management layer is used to analyze the current watershed information data, and the watershed information security policy is specified based on the analysis results. The watershed information security policy is applied to the watershed information platform, and the watershed information platform is used for policy distribution and linkage processing, and the watershed information security policy is sent down to the security policy control layer.

[0034] Step S103, using the security policy control layer to generate a watershed information security sub-policy based on the watershed information security policy, applying the watershed information security sub-policy to the watershed information sub-platform, and sending the watershed information security sub-policy to the security policy execution layer.

[0035] It can be understood that different watershed information sub-platforms process different watershed information services, and the corresponding data access rights, data management methods, etc. are different. This application will adaptively adjust each security policy in the corresponding watershed information sub-platform.

[0036] Specifically, based on the corresponding policy requirements of each watershed information sub-platform, the watershed information security policy is adjusted to generate a watershed information security sub-policy, the watershed information security sub-policy is applied to the corresponding watershed information sub-platform, and the watershed information security sub-policy is sent to the corresponding watershed information sub-platform.

[0037] Step S104, using the security policy execution layer to execute the watershed information security sub-strategy.

[0038] The security policy execution layer is the data source for the security policy control layer and the security policy management layer. The security policy execution layer connects various perception front-ends and terminal devices, and controls the secure access and data collection of each terminal device according to the security sub-policy.

[0039] The method for constructing a watershed information security architecture provided in this embodiment constructs a watershed information security architecture including a security policy management layer, a security policy control layer, and a security policy execution layer. The hierarchical relationship is used from top to bottom, and the security policy management layer controls the security policy control layer, and the security policy control layer controls the security policy execution layer to ensure policy management security. At the same time, a general security policy is set for the watershed information platform, and corresponding security sub-policies are set according to different watershed information sub-platforms, which can ensure data security between different watershed information sub-platforms and further improve network policy management security. The security architecture of this application can be migrated and customized to increase the scope of adaptability while ensuring security. On the basis of network security, data is divided into watershed information production areas, watershed information operation areas, and watershed information Internet of Things areas. By limiting the data transmission permissions in different areas, the confidentiality of data and the security of data transmission are guaranteed.

[0040] In this embodiment, a method for constructing a watershed information security architecture is provided. Figure 3 is a flowchart of another method for constructing a watershed information security architecture according to an embodiment of the present invention. It should be noted that if there are substantially the same results, this embodiment does not use Figure 3 The process sequence shown is limited. Figure 3 As shown, the process includes the following steps: Step S301, constructing a security policy management layer, a security policy control layer and a security policy execution layer based on the watershed information network.

[0041] Specifically, see Figure 4 , Figure 4 is a schematic diagram of another watershed information security architecture according to an embodiment of the present invention. Figure 4As shown, the security policy management layer acts on the watershed information platform, the security policy control layer acts on the watershed information sub-platform, and the security policy execution layer acts on various perception front-ends and various terminal devices. The security policy management layer deploys the policy on the watershed information platform, and distributes the policy to the watershed information sub-platform of the security policy control layer. When there is a security threat, the attack is blocked. The security policy control layer deploys the policy on the watershed information sub-platform, and distributes the policy to the security policy execution layer. When there is a security threat, the attack is blocked. The security policy execution layer uses the collection device to collect basic data, and transmits the basic data to multiple watershed information sub-platforms of the security policy control layer. Each watershed information sub-platform collects the corresponding sub-platform data and transmits it to the watershed information platform of the security policy management layer.

[0042] Step S302, using the security policy management layer to construct the watershed information security policy, applying the watershed information security policy to the watershed information general platform, and sending the watershed information security policy to the security policy control layer.

[0043] Specifically, the above step S302 includes: Step S3021, use the security policy management layer to construct the watershed information security policy, and apply the watershed information security policy to the watershed information platform.

[0044] See also Figure 4 , use the security policy management layer to build a situation awareness system from factor perception to situation understanding to situation prediction, and build a security model of watershed information based on the situation awareness system, and use the security model to determine the corresponding watershed information security strategy.

[0045] Specifically, basic data and information of watershed information are obtained through various sensors, monitoring equipment or information sources to form a basic understanding of watershed information. Based on the perception of elements, a comprehensive scenario description is constructed through comprehensive analysis of watershed information data to reveal the internal connections and development trends between watershed information. Based on the existing situation understanding and historical data, inferences are made about what may happen to watershed information in the future, and on this basis, a safety model for watershed information is constructed, and preventive measures or optimization strategies are formulated based on the safety model.

[0046] Furthermore, the watershed information security policy is applied to the watershed information platform, and the watershed information platform is used for policy distribution and linkage processing. Among them, policy distribution is used to distribute security policies to the security policy control layer, and linkage processing is used to link multiple watershed information sub-platforms of the security policy control layer.

[0047] Among them, the river basin information security strategy is the basic security library of the river basin information platform, which includes the overall security strategy and meta-security strategy.

[0048] Step S3022: Use the overall security strategy to send the meta-security policy to the corresponding watershed information sub-platform in the security policy control layer.

[0049] Among them, the overall security strategy is responsible for issuing the meta-security strategy of the river basin information platform to each river basin information sub-platform, and supports each river basin information sub-platform to establish each river basin security sub-strategy based on the meta-security strategy.

[0050] Exemplarily, the basin information sub-platform includes an immigration management platform, a hydrological sedimentation platform, and a meteorological water situation platform. The basin information master platform determines the meta-security strategies corresponding to the immigration management platform, the hydrological sedimentation platform, and the meteorological water situation platform according to the overall security strategy, and issues the meta-security strategies to the corresponding sub-platforms respectively.

[0051] Furthermore, the meta-security policy includes identity policy and control policy.

[0052] Specifically, the identity strategy is used for identity management and authentication of the watershed information sub-platform.

[0053] Exemplarily, identity policies include user management, organizational management, user identity verification, user token management, application token management, and the like.

[0054] Specifically, the control strategy is used to set access rights according to the user's security level on the watershed information sub-platform and to authenticate requests to access the watershed information sub-platform.

[0055] Exemplarily, the control policy sets user access rights. When a user accesses the data service of the watershed information sub-platform, the user request is dynamically and finely authenticated; when the user's security level changes, the user's access rights are updated in a timely manner.

[0056] In this implementation, identity strategy and control strategy are used to ensure the user access security of the watershed information sub-platform.

[0057] Step S303, using the security policy control layer to generate a watershed information security sub-policy based on the watershed information security policy, applying the watershed information security sub-policy to the watershed information sub-platform, and sending the watershed information security sub-policy to the security policy execution layer.

[0058] Specifically, the above step S303 includes: Step S3031, using the security policy control layer to combine the business and meta-security policies of the watershed information sub-platform to generate a watershed information security sub-policy.

[0059] It can be understood that different watershed information sub-platforms process different watershed information services, and the corresponding data access rights, data management methods, etc. are different. This application will adaptively adjust each security policy in the corresponding watershed information sub-platform.

[0060] Specifically, the business of each watershed information sub-platform is obtained, the meta-security strategy is adaptively adjusted according to business needs, and the watershed information security sub-strategy of each watershed information sub-platform is constructed.

[0061] For example, for the immigration management platform, the security sub-strategies are adjusted according to the user management, organizational management, user identity verification, user token management, application token management, authentication methods, etc. of the immigration management platform to generate the corresponding immigration management platform security policy. Similarly, for the hydrological sediment platform, the hydrological sediment platform security policy is generated, and for the meteorological water situation platform, the meteorological water situation platform security policy is generated.

[0062] Step S3032, apply the watershed information security sub-strategy to the corresponding watershed information sub-platform.

[0063] For example, the immigration management platform security policy is applied to the immigration management platform to perform immigration management and identity authentication; the hydrological and sediment platform security policy is applied to the hydrological and sediment platform to perform hydrological and sediment identity management and identity authentication; the meteorological and water situation platform security policy is applied to the meteorological and water situation platform to perform meteorological and water situation identity management and identity authentication.

[0064] In this implementation, the security policy is divided into an overall security policy and a meta-security policy. The overall security policy distributes the meta-security policy according to different river basin information sub-platforms to ensure the security of policy distribution. For different river basin information sub-platforms, security sub-policies are generated according to business adaptability, which can generate policies that meet the business security requirements of the river basin information sub-platform, ensure the internal data security of each river basin information sub-platform and the data security between different river basin information sub-platforms, and further improve the security of policy management. At the same time, the security policy control layer of this application allows construction and expansion based on the meta-network security policy according to the application system and business, improving applicability and scalability.

[0065] Step S304: Utilize the security policy execution layer to execute the watershed information security sub-policy.

[0066] The security policy execution layer is the data source for the security policy control layer and the security policy management layer. The security policy execution layer connects various perception front-ends and terminal devices, and controls the secure access and data collection of each terminal device according to the security sub-policy.

[0067] Step S305, constructing a watershed information production area, a watershed information operation area and a watershed information Internet of Things area based on the watershed information data.

[0068] Specifically, the above step S305 includes: Step S3051, obtaining the business architecture of the watershed information data.

[0069] Obtain the watershed vision, business domain and business processes of the business architecture of watershed information data.

[0070] Step S3052, divide the watershed information data into watershed feature data, watershed element data and watershed object data according to the watershed vision, business domain and business process in the business architecture.

[0071] Determine the data characteristics of the watershed information data based on the watershed vision, business domain and business process in the business architecture. Combined with the spatial position, spatial relationship and time relationship, the watershed information data is modeled according to "feature-element-object" and divided into watershed feature data, watershed element data and watershed object data.

[0072] Among them, the watershed vision is used to clarify the research objectives of watershed information, the business domain is used to clarify resource allocation and department division, and the business process is used for specific business nodes.

[0073] Among them, the basin object data defines the basic objects of the basin information, and each basin object data corresponds to multiple basin element data. The basin element data defines the basic elements of the basin information, and each basin element data corresponds to multiple basin feature data. The basin feature data defines the basic features of the basin information. Each basin object class has corresponding attributes, behaviors and rules, and there is a data connection between each object class.

[0074] Specifically, the watershed information data describing natural objects and socio-economic objects are divided into watershed object data.

[0075] Exemplarily, natural objects mainly include rivers, mountains, oceans, etc., and socio-economic objects include humans, various industrial activities, agricultural activities, commercial activities, production activities, etc.

[0076] Specifically, the watershed information data describing the natural elements and socio-economic elements contained in the watershed object is divided into watershed element data.

[0077] Illustratively, natural elements are elements that represent the natural form of the earth's surface, such as geology, geophysics, topography, landforms, hydrology, meteorology, climate, soil quality, vegetation, animals, natural disasters, etc.; socio-economic elements are elements formed by human beings' transformation of nature in production activities, such as settlements, transportation networks, administrative boundaries, population, history, culture, enterprises and institutions, industrial and agricultural output, commerce, trade, communications, electricity, disease and prevention, and tourist facilities.

[0078] Specifically, the watershed information data describing the natural characteristics and socio-economic characteristics of the watershed element attributes are divided into watershed characteristic data.

[0079] For example, natural characteristics mainly describe the natural characteristics within the basin, referring to the attributes of natural elements, such as runoff, sediment content, flood season, freezing period, self-purification capacity of water bodies, presence or absence of ice floods, flow velocity and water level, etc.; socio-economic characteristics mainly describe the socio-economic characteristics within the basin, referring to the attributes of socio-economic elements, population attributes, such as birth rate, death rate, number, gender ratio, etc., and road attributes, such as location, length and width, type, pavement material, usage function, maintenance status, etc.

[0080] Specifically, in the “feature-element-object” modeling, the relationship between objects or the relationship between two different feature classes is defined. For example, the relationship between rivers and administrative divisions, section A of the river belongs to province A; the relationship between immigrants and their migration destinations, etc.

[0081] Specifically, in the “feature-element-object” modeling, constraints are imposed on the values ​​of elements and objects. For example, a specific person must belong to a certain administrative division.

[0082] Step S3053, construct a watershed information production area based on the watershed characteristic data, construct a watershed information operation and production area based on the watershed element data, and construct a watershed information Internet of Things area based on the watershed object data.

[0083] The river basin information production area includes a variety of river basin information production data, the river basin information operation area includes a variety of river basin information operation data, and the river basin information Internet of Things area includes a variety of river basin information Internet of Things data.

[0084] In one implementation, the watershed characteristic data is used as the watershed information production data, the watershed element data is used as the watershed information operation data, and the watershed object data is used as the watershed information IoT data.

[0085] In another implementation, the basin information production area includes river topography data in the basin, meteorological station data in the basin, and other data related to describing natural characteristics in the basin, socio-economic characteristic data of all power production in the basin, and basin characteristic data of socio-economic objects related to production operations such as power production data. The basin information operation area includes basin element data of social and economic objects such as company operation conditions, population activities, industrial and agricultural conditions, and basin-related commercial activities of companies in the basin management, as well as basin element data of natural objects that affect the company's basin cascade scheduling.

[0086] Furthermore, data within the river basin information production area, river basin information operation area and river basin information Internet of Things area are transmitted unidirectionally according to transmission permissions.

[0087] In one implementation, the security policy execution layer is used to collect watershed information production data, and the watershed information production data is processed and then transmitted to the security policy control layer.

[0088] Specifically, the data transmission of river basin information production data is limited according to the confidentiality level. River basin information production data is only allowed to be transmitted to the river basin information operation area and the river basin information Internet of Things area after processing. If the river basin information operation area and the river basin information Internet of Things area want to transmit data in the opposite direction, they need to go through the reverse isolation device. Direct transmission and instruction issuance are not allowed.

[0089] In one implementation, the security policy control layer is used to collect watershed information operation data, and the watershed information operation data is processed, and the processed watershed information production data and / or watershed information operation data is transmitted to the security policy management layer.

[0090] Specifically, data from the security policy control layer can be directly transmitted to the river basin IoT area, but the river basin IoT area is not allowed to directly transmit data to this area and issue instructions.

[0091] In one implementation, the watershed information management data is collected using the security policy management layer.

[0092] Specifically, the river basin IoT area is an area with extensive information transmission within the river basin information, covering the entire river basin information domain. The data generated in this area, except for the river basin information management data specified by the confidentiality level, can be widely disseminated within the river basin IoT area.

[0093] The method for constructing a watershed information security architecture provided in this embodiment, in this implementation, by limiting the transmission method between the watershed information production area, the watershed information operation area and the watershed information IoT area, it is ensured that data can only flow from the watershed information production area to the watershed information operation area, and from the watershed information operation area to the watershed information IoT area, ensuring that the underlying data cannot be widely disseminated, and improving the security of data management. The data is divided into watershed characteristic data, watershed element data and watershed object data according to the level, ensuring that the watershed characteristic data with the highest confidentiality is divided into the watershed information production area, the watershed element data with the second highest confidentiality is divided into the watershed information operation production area, and the watershed object data is divided into the watershed information IoT area. Combined with the management level corresponding to each area, the watershed data security can be further guaranteed.

[0094] In this embodiment, a device for constructing a watershed information security architecture is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated hereafter. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0095] This embodiment provides a device for constructing a watershed information security architecture. Figure 5As shown, Figure 5 is a structural block diagram of a device for constructing a watershed information security architecture according to an embodiment of the present invention, and the device for constructing a watershed information security architecture includes: Construction module 501 is used to construct a security policy management layer, a security policy control layer and a security policy execution layer based on the river basin information network, and to construct a river basin information production area, a river basin information operation area and a river basin information Internet of Things area based on the river basin information data. The data in the river basin information production area, the river basin information operation area and the river basin information Internet of Things area are transmitted unidirectionally among the security policy management layer, the security policy control layer and the security policy execution layer according to the transmission authority.

[0096] The policy management module 502 is used to construct the watershed information security policy by using the security policy management layer, apply the watershed information security policy to the watershed information platform, and send the watershed information security policy to the security policy control layer.

[0097] The policy control module 503 is used to generate a watershed information security sub-policy based on the watershed information security policy using the security policy control layer, apply the watershed information security sub-policy to the watershed information sub-platform, and send the watershed information security sub-policy to the security policy execution layer.

[0098] The policy execution module 504 is used to execute the watershed information security sub-policy using the security policy execution layer.

[0099] In some optional implementations, the policy management module 502 includes: The sub-policy management unit is used to use the overall security policy to send the meta-security policy to the corresponding watershed information sub-platform in the security policy control layer. The meta-security policy includes identity policy and control policy. The identity policy is used for identity management and identity authentication of the watershed information sub-platform; the control policy is used to set access rights according to the user's security level on the watershed information sub-platform and authenticate requests to access the watershed information sub-platform.

[0100] In some optional implementations, the policy control module 503 includes: The generation unit is used to generate a watershed information security sub-policy by utilizing the security policy control layer in combination with the business and meta-security policies of the watershed information sub-platform.

[0101] The application unit is used to apply the watershed information security sub-strategy to the corresponding watershed information sub-platform.

[0102] In some optional implementations, the watershed information security architecture construction device further includes: The data management module is used to construct the river basin information production area, river basin information operation area and river basin information Internet of Things area based on the river basin information data. The data in the river basin information production area, river basin information operation area and river basin information Internet of Things area are transmitted unidirectionally according to the transmission authority.

[0103] In some optional implementations, the building block 501 includes: The acquisition unit is used to obtain the business architecture of watershed information data.

[0104] The division unit is used to divide the watershed information data into watershed characteristic data, watershed element data and watershed object data according to the watershed vision, business domain and business process in the business architecture. Each watershed object data corresponds to multiple watershed element data, and each watershed element data corresponds to multiple watershed characteristic data.

[0105] Construct sub-units to construct watershed information production areas based on watershed characteristic data, construct watershed information operation and production areas based on watershed element data, and construct watershed information Internet of Things areas based on watershed object data.

[0106] In some optional implementations, the building block 501 includes: The first transmission unit is used to collect watershed information production data using the security policy execution layer, and transmit the watershed information production data to the security policy control layer after processing.

[0107] The second transmission unit is used to collect watershed information operation data using the security policy control layer, process the watershed information operation data, and transmit the processed watershed information production data and / or watershed information operation data to the security policy management layer.

[0108] The third transmission unit is used to collect watershed information management data using the security policy management layer.

[0109] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0110] The watershed information security architecture construction device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0111] The embodiment of the present invention also provides a computer device having the above Figure 5 The watershed information security architecture construction device shown.

[0112] See also Figure 6 , Figure 6 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 6 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 10 is taken as an example.

[0113] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0114] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0115] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0116] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0117] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 6 The example of connecting through bus is taken in the following.

[0118] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device may be a touch screen.

[0119] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0120] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0121] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for constructing a watershed information security architecture, characterized in that: The method comprises: Construct a security policy management layer, a security policy control layer and a security policy execution layer based on the river basin information network; construct a river basin information production area, a river basin information operation area and a river basin information Internet of Things area based on the river basin information data, and the data in the river basin information production area, the river basin information operation area and the river basin information Internet of Things area are transmitted unidirectionally in the security policy management layer, the security policy control layer and the security policy execution layer according to the transmission authority; Utilize the security policy management layer to construct a watershed information security policy, apply the watershed information security policy to the watershed information general platform, and send the watershed information security policy to the security policy control layer; Utilizing the security policy control layer to generate a watershed information security sub-policy based on the watershed information security policy, applying the watershed information security sub-policy to the watershed information sub-platform, and sending the watershed information security sub-policy to the security policy execution layer; The security policy execution layer is used to execute the watershed information security sub-policy.

2. The method for constructing a watershed information security architecture according to claim 1, characterized in that: The watershed information security policy includes an overall security policy and a meta-security policy. The sending of the watershed information security policy to the security policy control layer includes: The meta-security policy is sent down to the corresponding watershed information sub-platform in the security policy control layer using the overall security policy.

3. The method for constructing a watershed information security architecture according to claim 2, characterized in that: The method of using the security policy control layer to generate a watershed information security sub-policy based on the watershed information security policy, and applying the watershed information security sub-policy to the watershed information sub-platform includes: The security policy control layer is used to generate the watershed information security sub-policy in combination with the services of the watershed information sub-platform and the meta-security policy; Apply the watershed information security sub-strategy to the corresponding watershed information sub-platform.

4. The method for constructing a watershed information security architecture according to claim 2, characterized in that: The meta-security policy includes identity policy and control policy, wherein: The identity strategy is used for identity management and identity authentication of the watershed information sub-platform; The control strategy is used to set access rights according to the security level of the user on the watershed information sub-platform and to authenticate requests for access to the watershed information sub-platform.

5. The method for constructing a watershed information security architecture according to claim 1, characterized in that: The watershed information production area includes a variety of watershed information production data, the watershed information operation area includes a variety of watershed information operation data, and the watershed information IoT area includes a variety of watershed information IoT data. The data in the watershed information production area, the watershed information operation area, and the watershed information IoT area are transmitted unidirectionally in the security policy management layer, the security policy control layer, and the security policy execution layer according to the transmission authority, including: The security policy execution layer is used to collect the watershed information production data, and the watershed information production data is processed and then transmitted to the security policy control layer; Utilize the security policy control layer to collect the watershed information operation data, process the watershed information operation data, and transmit the processed watershed information production data and / or the watershed information operation data to the security policy management layer; The watershed information management data is collected using the security policy management layer.

6. The method for constructing a watershed information security architecture according to claim 5, characterized in that: The construction of the watershed information production area, watershed information operation area and watershed information IoT area based on watershed information data includes: A business architecture for obtaining the watershed information data; According to the watershed vision, business domain and business process in the business architecture, the watershed information data is divided into watershed characteristic data, watershed element data and watershed object data according to the hierarchy, each of the watershed object data corresponds to a plurality of the watershed element data, and each of the watershed element data corresponds to a plurality of the watershed characteristic data; The watershed information production area is constructed based on the watershed characteristic data, the watershed information operation and production area is constructed based on the watershed element data, and the watershed information Internet of Things area is constructed based on the watershed object data.

7. A device for constructing a watershed information security architecture, characterized in that: The device comprises: A construction module is used to construct a security policy management layer, a security policy control layer and a security policy execution layer based on the watershed information network; construct a watershed information production area, a watershed information operation area and a watershed information Internet of Things area based on the watershed information data, and the data in the watershed information production area, the watershed information operation area and the watershed information Internet of Things area are transmitted unidirectionally in the security policy management layer, the security policy control layer and the security policy execution layer according to the transmission authority; A policy management module, used to construct a watershed information security policy using the security policy management layer, apply the watershed information security policy to the watershed information platform, and send the watershed information security policy to the security policy control layer; A policy control module, used to generate a watershed information security sub-policy based on the watershed information security policy by using the security policy control layer, apply the watershed information security sub-policy to the watershed information sub-platform, and send the watershed information security sub-policy to the security policy execution layer; A policy execution module is used to execute the watershed information security sub-policy using the security policy execution layer.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for constructing a watershed information security architecture according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method for constructing a watershed information security architecture according to any one of claims 1 to 6.

10. A computer program product, characterized in that It includes computer instructions, which are used to enable a computer to execute the method for constructing a watershed information security architecture according to any one of claims 1 to 6.

Images