Access control implementation method for intelligent substation system configuration description file

Abstract

The invention provides an intelligent substation system configuration description file-oriented access control implementation method, which relates to the technical field of data processing, and comprises the following steps of: analyzing a business process of an intelligent substation system, and determining various roles of a configuration description file SCD needing to be accessed; defining roles required in the intelligent substation system, and defining responsibilities and permissions for each role; determining mutually exclusive roles and setting cardinality constraints; determining the comprehensive authority of the user in a configuration description file SCD part; and judging whether the role has the authority of reading, writing, modifying or managing the configuration description file SCD or not according to the comprehensive authority of the user in the configuration description file SCD part. According to the invention, the problem that the traditional access control method cannot carry out fine access control on the configuration description file SCD is solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of data processing, and in particular relates to an access control implementation method for a configuration description file of an intelligent substation system. Background Art

[0002] With the development of smart grid technology, smart substations, as an important part of it, have become particularly important for the security and flexibility of their system configuration. The system configuration description (SCD) file of a smart substation contains key data such as the substation's topology, equipment information, and communication configuration. These data are essential for each stage of the substation's design, construction, commissioning, and operation and maintenance. Therefore, the demand for access control of the configuration description file SCD is growing, and traditional access control methods often cannot meet the demand for fine-grained access control of the configuration description file SCD.

[0003] In existing technologies, access control usually adopts a role-based access control (RBAC) model, which manages user access rights to system resources through roles. However, when these models are applied to the configuration description file SCD of smart substations, they face challenges such as how to finely control access rights and how to ensure role mutual exclusivity and cardinality constraints. In addition, the traditional access control model RBAC often lacks fine-grained access control to specific components of the configuration description file SCD during implementation, resulting in the inability to effectively protect key data in the configuration description file SCD. Summary of the invention

[0004] In view of the above-mentioned deficiencies in the prior art, the present invention provides an access control implementation method for the configuration description file of a smart substation system, which aims to achieve fine access control on the configuration description file SCD by defining roles, assigning permissions, designing role permission coding, and embedding permission fields in various components of the configuration description file SCD. At the same time, the present invention clearly considers the mutual exclusivity and cardinality constraints of roles to ensure the security and flexibility of the system.

[0005] In order to achieve the above objectives, the technical solution adopted by the present invention is: a method for implementing access control for a configuration description file of a smart substation system, comprising the following steps:

[0006] S1. Analyze the business process of the smart substation system and determine the various roles that need to access the configuration description file SCD;

[0007] S2. Based on the analysis results, define the roles required in the smart substation system and define the responsibilities and permissions for each role;

[0008] S3. Define responsibilities and permissions for each role, determine mutually exclusive roles, and set cardinality constraints;

[0009] S4. According to the determination result of step S3, the required permissions of the configuration description file SCD node are determined, and the permission code PCode is formed. The formed permission code PCode is inserted into each node as a field, and the mapping code MCode corresponding to the role is generated by the smart substation system to obtain the comprehensive permissions of the user in the configuration description file SCD;

[0010] S5. Based on the comprehensive permissions of the user in the configuration description file SCD, determine whether the role has the permission to read, write, modify or manage the configuration description file SCD to implement access control.

[0011] The beneficial effects of the present invention are as follows: the present invention is used to manage the system configuration description file SCD of the smart substation. The present invention defines roles, assigns permissions, designs role permission codes, and embeds permission fields in various components of the configuration description file SCD to achieve refined access control to the configuration description file SCD. At the same time, the present invention takes into account the mutual exclusivity and cardinality constraints of access roles in the access control model RBAC to ensure the security and flexibility of the system. When designing the role permission code, a binary code with three times the number of roles is used, and each three bits corresponds to a role, and the three bits are used to represent the role's operating permissions for this part of the content. Each role has a mapping field for storing the number of bits corresponding to the role in the permission code. The present invention achieves precise access control to various parts of the configuration description file SCD through refined role permission coding and mapping field design, and enhances the security of key system file resource protection in smart substations.

[0012] Furthermore, the determining of mutually exclusive roles and setting of cardinality constraints are specifically as follows:

[0013] Define responsibilities and permissions for each role, identify mutually exclusive roles, and implement logic in the smart substation system to ensure that roles are mutually exclusive;

[0014] Set cardinality constraints to limit the number of users that can be assigned to each role and the number of roles that each user can have.

[0015] The beneficial effect of the above further scheme is that the present invention ensures that no two roles will perform operations that may cause conflicts at the same time through role mutual exclusion, prevents malicious users from using multiple role permissions to perform improper operations, and thus protects the system from internal threats. By setting cardinality constraints, it ensures that resources are reasonably allocated to avoid resource waste, prevents users from obtaining excessive permissions through multiple roles, and thus reduces the possibility of abuse of permissions.

[0016] Furthermore, step S4 includes the following steps:

[0017] S401, according to the determination result of step S3, define the actions performed on the configuration description file SCD as reading, writing and modifying, and assign corresponding permissions to each role;

[0018] S402, generating a permission code PCode corresponding to each role permission, and adding a permission field permissions in each component of each configuration description file SCD, and inserting the permission code PCode into the permission field permissions of the configuration description file SCD, wherein each role is assigned a 3-bit binary code;

[0019] S403, creating a mapping field mapping for each role in the smart substation system, matching the role with the authority, and generating a mapping code MCode corresponding to the role through the smart substation system, wherein the mapping code MCode is used to store the 3-digit number corresponding to the role in the role authority code;

[0020] S404. According to the processing results of step S401 to step S403, the comprehensive authority of the user in the configuration description file SCD is obtained.

[0021] The beneficial effect of the above further scheme is that the present invention ensures that roles and responsibilities are closely aligned by clearly defining the permissions of each role, thereby reducing the risk of over-allocation of permissions. By generating a permission code PCode for each part of the configuration description file SCD, indicating the access control permissions of each role to that part, and creating a mapping field mapping for each role, a clear mapping relationship between roles and access control permissions is defined, so that the system can make quick and accurate decisions when processing permission requests, and permission verification is more efficient.

[0022] Furthermore, the expression of the permission code PCode is as follows:

[0023] PCode=b 3(1-1)+1 b 3(1-1)+2 b 3(1-1)+3 b 3(2-1)+1 b 3(2-1)+2 b 3(2-1)+3 ,…,b 3(k-1)+1 b 3(k-1)+2 b 3(k-1)+3

[0024] Among them, b 3(i-1)+j (j=1,2,3) represents the j-th binary code of the i-th character.

[0025] The beneficial effect of the above further solution is that the system can handle permission allocation more flexibly by defining permission codes PCode. The permission codes of each role can be independent of other roles, making permission management more modular and scalable. This coding method also facilitates the search and comparison of permissions in the system, improving the efficiency of permission management.

[0026] Furthermore, the expression of the mapping code MCode corresponding to the role is as follows:

[0027] MCode=000000,…,b 3(i-1)+1 b 3(i-1)+2 b 3(i-1)+3 ,…,000

[0028] b 3(i-1)+1 b 3(i-1)+2 b 3(i-1)+3 =111

[0029] Among them, b 3(i-1)+j (j=1,2,3) represents the j-th binary code of the i-th character.

[0030] The beneficial effect of the above further solution is: by defining the MCode code, a mapping field is created for each role, and the role is matched with the permission code, so that the system can quickly match and verify when processing permission requests.

[0031] Furthermore, the S5 comprises the following steps:

[0032] S501. According to the comprehensive authority of the user in the configuration description file SCD, when the user accesses the configuration description file SCD, the smart substation system checks the role corresponding to the user and obtains the mapping field mapping of the corresponding role;

[0033] S502, performing an AND operation on the obtained mapping code MCode value of the mapping field mapping and the permission code PCode value of the permission field permissions of the accessed configuration description file SCD;

[0034] S503, when the results of the AND operation are all 0, it means that the access is denied, otherwise, take out b 3(i-1)+1 b 3(i-1)+ 2 b 3(i-1)+3 These three bits are matched with the configuration description file SCD execution action to determine the operation permissions, where b 3(i-1)+ 1 b 3(i-1)+2 b 3(i-1)+3 Indicates the permission code of role i;

[0035] S504: for a user who is assigned multiple roles, perform an OR operation on the mapping field mapping of each role to obtain a mapping code MCode value;

[0036] S505, perform an AND operation on the mapping code MCode value obtained in step S504 and the permission code PCode value of the permission field permissions of the access configuration description file SCD, and extract b 3(j-1)+1 b 3(j-1)+2 b 3(j-1)+3 Perform an OR operation to obtain 3 bits of binary, where b 3(j-1)+1 b 3(j-1)+2 b 3(j-1)+3 Indicates the permission code of role j;

[0037] S506: Match the obtained 3-bit binary with the execution action of the configuration description file SCD, determine the operation authority, and complete the implementation of access control.

[0038] The beneficial effect of the above further scheme is: the present invention ensures that users can only perform operations permitted by their roles through a precise role and access permission matching mechanism, simplifies the permission checking logic, enables the system to quickly verify whether the user has the permission to perform specific operations, and improves the efficiency of permission verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 The present invention is a flow chart of the method.

[0040] Figure 2 The SCD structure diagram of the smart substation configuration description file. DETAILED DESCRIPTION

[0041] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0042] Example

[0043] Before describing the present invention, the configuration description file SCD and the RBAC access control model involved in the present invention are first introduced:

[0044] The Substation Configuration Description (SCD) file of the smart substation is a standardized file format that describes the substation configuration and communication settings.

[0045] like Figure 2 As shown in the figure, the basic structure of the configuration description file SCD usually includes the following main parts:

[0046] Header: Contains information such as the configuration description file SCD identifier, file version, configuration tool, and file modification history.

[0047] Substation: Describes the functional structure of the substation, identifies the primary equipment and their electrical connections.

[0048] Communication: describes the address information of the SV control block and GOOSE control block of each intelligent electronic device (IED).

[0049] IED: describes the specific configuration of intelligent electronic devices.

[0050] DataTypeTemplates: defines data type templates such as logical node types, data object types, and data attribute types.

[0051] RBAC (Role-Based Access Control) is a common access control model that manages user access rights to system resources through roles. The core idea of ​​the access control model RBAC is to assign permissions to roles instead of directly to users, thereby simplifying permission management and improving system security. The following are the main components of the access control model RBAC:

[0052] User: A user is an entity in the system, usually an operator or visitor in the system.

[0053] Role: A role is a collection of permissions that defines the tasks that can be performed in a specific context. A role can represent a position, a responsibility, or a set of similar permissions. For example, a company may have an "Accountant" role that has permissions to view financial statements, create invoices, etc.

[0054] Target (Object): The target is the resource that needs to be protected in the system, which refers to the configuration description file SCD in this patent.

[0055] Operation: An operation is an action that can be performed on a target, such as read, write, modify, etc. Operations are often closely related to permissions, as permissions define which operations can be performed on a target.

[0056] Permission: A permission is an authorization that allows a specific action to be performed. In the access control model RBAC, permissions are usually associated with roles rather than directly with users.

[0057] Constraints: Constraints are rules in the access control model RBAC that are used to further restrict the use of roles and permissions. Constraints can be cardinality constraints (which can limit the number of users that can be assigned to certain roles.

[0058] For example, there may be regulations that there can be only one "system administrator" role in the system), role exclusivity (a user cannot be assigned to two mutually exclusive roles at the same time. For example, a user cannot be an approver and an auditor at the same time, as this may lead to a conflict of interest.) or other business rules.

[0059] like Figure 1 As shown, the present invention provides an access control implementation method for a configuration description file of a smart substation system, and the implementation method is as follows:

[0060] S1. Analyze the business process of the smart substation system and determine the various roles that need to access the configuration description file SCD;

[0061] In this embodiment, the business process of the smart substation system is analyzed, and the definitions of various roles and their access requirements to the configuration description file SCD are clarified.

[0062] S2. Based on the analysis results, define the roles required in the smart substation system and define the responsibilities and permissions for each role;

[0063] In this embodiment, the analysis results define the roles required in the system R = {r 1 ,r 2 ,…,r k}, define clear responsibilities and authority scope for each role, and provide each role with permissions including read, write, modify and other operations to ensure that the role's access rights are reasonable and in compliance with regulations.

[0064] S3. Define responsibilities and permissions for each role, determine mutually exclusive roles, and set cardinality constraints, as follows:

[0065] Define responsibilities and permissions for each role, identify mutually exclusive roles, and implement logic in the smart substation system to ensure that roles are mutually exclusive;

[0066] Set cardinality constraints to limit the number of users that can be assigned to each role and the number of roles that each user can have.

[0067] In this embodiment, mutual exclusion of roles is achieved. When defining role permissions, mutual exclusion rules between roles are set to ensure that the same user does not have mutually exclusive role permissions at the same time. That is, logic is implemented in the smart substation system (when a user registers, multiple mutually exclusive roles cannot be selected at the same time) to ensure mutual exclusion of roles.

[0068] In this embodiment, a cardinality constraint is set to limit the number of users that can be assigned to each role and the number of roles that each user can have. For users who need multiple roles, the permission cardinality that meets the conditions is allocated according to the actual situation.

[0069] S4. According to the determination result of step S3, the required permissions of the configuration description file SCD node are determined, and the permission code PCode is formed. The formed permission code PCode is inserted into each node as a field, and the mapping code MCode corresponding to the role is generated by the smart substation system to obtain the comprehensive permissions of the user in the configuration description file SCD. The implementation method is as follows:

[0070] S401, according to the determination result of step S3, define the actions performed on the configuration description file SCD as reading, writing and modifying, and assign corresponding permissions to each role;

[0071] S402, generating a permission code PCode corresponding to each role permission, and adding a permission field permissions in each component of each configuration description file SCD, and inserting the permission code PCode into the permission field permissions of the configuration description file SCD, wherein each role is assigned a 3-bit binary code;

[0072] S403, creating a mapping field mapping for each role in the smart substation system, matching the role with the authority, and generating a mapping code MCode corresponding to the role through the smart substation system, wherein the mapping code MCode is used to store the 3-digit number corresponding to the role in the role authority code;

[0073] S404. According to the processing results of step S401 to step S403, the comprehensive authority of the user in the configuration description file SCD is obtained.

[0074] In this embodiment, the corresponding permission requirements are generated according to the defined roles. The smart substation system maps the role permissions to specific operations to ensure that each role has an appropriate scope of permissions. The operations that can be performed on the configuration description file SCD are clearly defined as read (R), write (W) and modify (M), and three-bit binary codes are used to represent the respective permissions. The read operation is represented by 001, the write operation is represented by 010, and the modify operation is represented by 100. When a user has multiple operation permissions, the system combines the corresponding binary codes through an "OR" operation. For example, 001 clearly indicates that the user has read permission, 011 indicates that the user has read and write permissions, and 111 indicates that the user has read, write and modify permissions at the same time. This encoding method accurately reflects the user's operation permissions in the configuration description file SCD, and assigns corresponding permissions to each role. The permissions are detailed enough to access the Header, Substation, IED, Communication, and DataTypeTemplate specific parts of the configuration description file SCD.

[0075] In this embodiment, a permission code PCode corresponding to each role permission is generated, and a permission field permissions is added to each component (Header, Substation, IED, Communication, DataTypeTemplate) of the configuration description file SCD, and the permission code PCode is inserted into the permission field permissions of the configuration description file SCD. The permission code PCode is a unique identifier used by the smart substation system to identify each role permission, ensuring the accuracy of permission allocation. i (i=1,2,3) is assigned a 3-bit binary code, represented as:

[0076] PCode=b 3(1-1)+1 b 3(1-1)+2 b 3(1-1)+3 b 3(2-1)+1 b 3(2-1)+2 b 3(2-1)+3 ,…,b 3(k-1)+1 b 3(k-1)+2 b 3(k-1)+3

[0077] Among them, b 3(i-1)+j (j=1,2,3) represents the j-th binary code of the i-th character.

[0078] In this embodiment, in the smart substation system, for each role r iCreate a mapping field mapping to match roles with permissions. At the same time, the system generates a mapping code MCode to store the 3-digit number corresponding to the role in the role permission code. Set all 3 bits to 1 and the rest to 0 to facilitate subsequent permission verification and matching. i The corresponding mapping code MCode:

[0079] MCode=000000,…,b 3(i-1)+1 b 3(i-1)+2 b 3(i-1)+3 ,…,000

[0080] b 3(i-1)+1 b 3(i-1)+2 b 3(i-1)+3 =111

[0081] Among them, b 3(i-1)+j (j=1,2,3) represents the j-th binary code of the i-th character.

[0082] In this embodiment, when a user accesses the configuration description file SCD node, the smart substation system will automatically check the user's role and determine whether the user has multiple roles. If the user has multiple roles, the mapping codes MCode of all roles are "OR" operated to merge all the role permissions of the user and generate the final mapping code MCode. If the user has only one role, the mapping code MCode recorded in the mapping field mapping is directly used as the user's final mapping code MCode to ensure the accuracy of permission verification.

[0083] In this embodiment, a permission field permissions is added to each component (Header, Substation, IED, Communication, DataTypeTemplate) of the configuration description file SCD. Using the defined role permission encoding PCode rule, the permission field permissions of each component of the configuration description file SCD stores the access rights of each role to the component.

[0084] S5. According to the comprehensive permissions of the user in the configuration description file SCD, determine whether the role has the permission to read, write, modify or manage the configuration description file SCD, and implement access control. The implementation method is as follows:

[0085] S501. According to the comprehensive authority of the user in the configuration description file SCD, when the user accesses the configuration description file SCD, the smart substation system checks the role corresponding to the user and obtains the mapping field mapping of the corresponding role;

[0086] S502, performing an AND operation on the obtained mapping code MCode value of the mapping field mapping and the permission code PCode value of the permission field permissions of the accessed configuration description file SCD;

[0087] S503, when the results of the AND operation are all 0, it means that the access is denied, otherwise, take out b 3(i-1)+1 b 3(i-1)+ 2 b 3(i-1)+3 These three bits are matched with the configuration description file SCD execution action to determine the operation permissions, where b 3(i-1)+ 1 b 3(i-1)+2 b 3(i-1)+3 Indicates the permission code of role i;

[0088] S504: for a user who is assigned multiple roles, perform an OR operation on the mapping field mapping of each role to obtain a mapping code MCode value;

[0089] S505, perform an AND operation on the mapping code MCode value obtained in step S504 and the permission code PCode value of the permission field permissions of the access configuration description file SCD, and extract b 3(j-1)+1 b 3(j-1)+2 b 3(j-1)+3 Perform an OR operation to obtain 3 bits of binary, where b 3(j-1)+1 b 3(j-1)+2 b 3(j-1)+3 Indicates the permission code of role j;

[0090] S506: Match the obtained 3-bit binary with the execution action of the configuration description file SCD, determine the operation authority, and complete the implementation of access control.

[0091] In this embodiment, the access control logic is implemented. When a user attempts to access a certain part of the configuration description file SCD, the smart substation system will first check the user's corresponding role r i , and get the mapping field mapping of the corresponding role, then perform an AND operation (AND) on the obtained mapping code MCode value and the permission code PCode value of the permission field permissions of a certain part of the access configuration description file SCD. If the result is all 0, it means that access is denied, otherwise take out b 3(i-1)+1 b 3(i-1)+2 b 3(i-1)+3 These 3 bits match the defined operation code to determine its operation authority;

[0092] If a user is assigned multiple roles m1 ,r m2,...,r mn (n≤k, n represents the number of roles assigned to the user, k represents the number of roles in the system) mn The mapping field mapping is ORed to obtain the final MCode value, and then the mapping code MCode is ANDed with the permission code PCode value of the permission field permissions of a certain part of the access configuration description file SCD, and the b in the result is taken out respectively. 3(j-1)+1 b 3(j-1)+2 b 3(j-1)+3 (j=m 1 ,m 2 ,...,m n , j represents the jth role in the permission code PCode, m n The label representing the role assigned to the user) is ORed to obtain a 3-bit binary number, which is matched with the operation code defined in 5 to determine the operation permission.

[0093] In summary, the present invention proposes an RBAC implementation method for the smart substation configuration description file SCD, which can effectively control access to the smart substation configuration description file SCD; the present invention ensures that only authorized users can access important files and sensitive data of the substation, while improving the flexibility and maintainability of the system. Through the refined role permission coding and mapping field mapping design, accurate access control of each part of the configuration description file SCD is achieved, and the security of the system is enhanced.

Claims

1. A method for implementing access control of a configuration description file for a smart substation system, characterized in that: The following steps are involved: S1. Analyze the business process of the smart substation system and determine the various roles that need to access the configuration description file SCD; S2. Based on the analysis results, define the roles required in the smart substation system and define the responsibilities and permissions for each role; S3. Define responsibilities and permissions for each role, determine mutually exclusive roles, and set cardinality constraints; S4. According to the determination result of step S3, the required permissions of the configuration description file SCD node are determined, and the permission code PCode is formed. The formed permission code PCode is inserted into each node as a field, and the mapping code MCode corresponding to the role is generated by the smart substation system to obtain the comprehensive permissions of the user in the configuration description file SCD; S5. According to the comprehensive permissions of the user in the configuration description file SCD, determine whether the role has the permission to read, write, modify or manage the configuration description file SCD to implement access control.

2. The method for implementing access control for a configuration description file of a smart substation system according to claim 1, characterized in that: The specific steps of determining mutually exclusive roles and setting cardinality constraints are as follows: Define responsibilities and permissions for each role, identify mutually exclusive roles, and implement logic in the smart substation system to ensure that roles are mutually exclusive; Set cardinality constraints to limit the number of users that can be assigned to each role and the number of roles that each user can have.

3. The method for implementing access control for a configuration description file of a smart substation system according to claim 1, characterized in that: The step S4 comprises the following steps: S401, according to the determination result of step S3, define the actions performed on the configuration description file SCD as reading, writing and modifying, and assign corresponding permissions to each role; S402, generating a permission code PCode corresponding to each role permission, and adding a permission field permissions in each component of each configuration description file SCD, and inserting the permission code PCode into the permission field permissions of the configuration description file SCD, wherein each role is assigned a 3-bit binary code; S403, creating a mapping field mapping for each role in the smart substation system, matching the role with the authority, and generating a mapping code MCode corresponding to the role through the smart substation system, wherein the mapping code MCode is used to store the 3-digit number corresponding to the role in the role authority code; S404. According to the processing results of step S401 to step S403, the comprehensive authority of the user in the configuration description file SCD is obtained.

4. The method for implementing access control for a configuration description file of a smart substation system according to claim 3 is characterized in that: The expression of the permission code PCode is as follows: PCode=b 3(1-1)+1 b 3(1-1)+2 b 3(1-1)+3 b 3(2-1)+1 b 3(2-1)+2 b 3(2-1)+3 ,…,b 3(k-1)+1 b 3(k-1)+2 b 3(k-1)+3 Among them, b 3(i-1)+j (j=1,2,3) represents the j-th binary code of the i-th character.

5. The method for implementing access control for a configuration description file of a smart substation system according to claim 3, characterized in that: The expression of the mapping code MCode corresponding to the role is as follows: MCode=000000,…,b 3(i-1)+1 b 3(i-1)+2 b 3(i-1)+3 ,…,000 b 3(i-1)+1 b 3(i-1)+2 b 3(i-1)+3 =111 Among them, b 3(i-1)+j (j=1,2,3) represents the j-th binary code of the i-th character.

6. The method for implementing access control for a configuration description file of a smart substation system according to claim 3, characterized in that: The S5 comprises the following steps: S501. According to the comprehensive authority of the user in the configuration description file SCD, when the user accesses the configuration description file SCD, the smart substation system checks the role corresponding to the user and obtains the mapping field mapping of the corresponding role; S502, performing an AND operation on the obtained mapping code MCode value of the mapping field mapping and the permission code PCode value of the permission field permissions of the accessed configuration description file SCD; S503, when the results of the AND operation are all 0, it means that the access is denied, otherwise, take out b 3(i-1)+1 b 3(i-1)+2 b 3(i-1)+3 These three bits are matched with the configuration description file SCD execution action to determine the operation permissions, where b 3(i-1)+1 b 3(i-1)+ 2b 3(i-1)+3 Indicates the permission code of role i; S504: for a user who is assigned multiple roles, perform an OR operation on the mapping field mapping of each role to obtain a mapping code MCode value; S505, perform an AND operation on the mapping code MCode value obtained in step S504 and the permission code PCode value of the permission field permissions of the access configuration description file SCD, and extract b 3(j-1)+1 b 3(j-1)+2 b 3(j-1)+3 Perform an OR operation to obtain 3 bits of binary, where b 3(j-1)+1 b 3(j-1)+2 b 3(j-1)+3 Indicates the permission code of role j; S506: Match the obtained 3-bit binary with the execution action of the configuration description file SCD, determine the operation authority, and complete the implementation of access control.

Images