Access control implementation method for configuration description files of smart substation systems

Abstract

The present invention provides a method for implementing access control for configuration description files of smart substation systems, relating to the field of data processing technology. The method comprises analyzing the business processes of the smart substation system to determine the various roles that need to access the configuration description file (SCD); defining the roles required in the smart substation system and defining responsibilities and permissions for each role; determining mutually exclusive roles and setting cardinality constraints; determining the comprehensive permissions of the user in the configuration description file (SCD); and judging whether the role has the permission to read, write, modify, or manage the configuration description file (SCD) based on the comprehensive permissions of the user in the configuration description file (SCD). The present invention solves the problem that traditional access control methods cannot perform fine-grained access control on the configuration description file (SCD).

Description

Technical Field

[0001] The present invention belongs to the technical field of data processing, and in particular relates to an access control implementation method for a configuration description file of an intelligent substation system. Background Art

[0002] With the development of smart grid technology, smart substations, as a key component, have become increasingly important for their system configuration security and flexibility. The System Configuration Description (SCD) file for a smart substation contains key data such as the substation's topology, equipment information, and communication configuration. This data is crucial for every stage of the substation's design, construction, commissioning, and operation and maintenance. Consequently, the demand for access control over SCD files is growing, and traditional access control methods often fail to meet this demand for granular access control over SCD files.

[0003] Existing access control technologies typically employ a role-based access control (RBAC) model, which manages user access rights to system resources through roles. However, when applied to the smart substation's configuration description (SCD), these models face challenges such as fine-grained access control and ensuring role mutual exclusivity and cardinality constraints. Furthermore, traditional RBAC implementations often lack granular access control over specific components of the SCD, resulting in an inability to effectively protect critical data within the SCD. Summary of the Invention

[0004] To address the aforementioned shortcomings of the existing technology, the present invention provides a method for implementing access control for smart substation system configuration description files. This method aims to achieve refined access control over configuration description files (SCDs) by defining roles, assigning permissions, designing role-permission encoding, and embedding permission fields within each component of the SCD. Furthermore, this method explicitly considers role mutual exclusivity and cardinality constraints, ensuring system security and flexibility.

[0005] In order to achieve the above objectives, the technical solution adopted by the present invention is: a method for implementing access control for a configuration description file of a smart substation system, comprising the following steps:

[0006] S1. Analyze the business processes of the smart substation system and determine the various roles that need to access the configuration description file SCD;

[0007] S2. Based on the analysis results, define the roles required in the smart substation system and define the responsibilities and permissions for each role;

[0008] S3. Define responsibilities and permissions for each role, identify mutually exclusive roles, and set cardinality constraints.

[0009] S4. According to the result of step S3, the required permissions of the configuration description file SCD node are determined, and the permission code PCode is formed. The permission code PCode formed is inserted into each node as a field, and the mapping code MCode corresponding to the role is generated by the smart substation system to obtain the user's comprehensive permissions in the configuration description file SCD;

[0010] S5. Based on the comprehensive permissions of the user in the configuration description file SCD, determine whether the role has the permission to read, write, modify or manage the configuration description file SCD, thereby implementing access control.

[0011] The beneficial effects of the present invention are as follows: the present invention is used to manage the system configuration description file SCD of the smart substation. The present invention defines roles, assigns permissions, designs role permission codes, and embeds permission fields in the various components of the configuration description file SCD to achieve refined access control of the configuration description file SCD. At the same time, the present invention takes into account the mutual exclusivity and cardinality constraints of access roles in the access control model RBAC, ensuring the security and flexibility of the system. When designing the role permission code, a binary code with three times the number of roles is used, and every three bits corresponds to a role, and the three bits are used to represent the role's operating authority for this part of the content. Each role has a mapping field for storing the number of bits corresponding to the role in the permission code. The present invention achieves precise access control to each part of the configuration description file SCD through the refined role permission code and the design of the mapping field, thereby enhancing the security of the protection of key system file resources in the smart substation.

[0012] Furthermore, the steps of determining mutually exclusive roles and setting cardinality constraints are as follows:

[0013] Define responsibilities and permissions for each role, identify mutually exclusive roles, and implement logic in the smart substation system to ensure role mutual exclusion;

[0014] Set cardinality constraints to limit the number of users that can be assigned to each role and the number of roles each user can have.

[0015] The beneficial effects of the above further solution are as follows: the present invention ensures that no two roles can execute conflicting operations at the same time through role mutual exclusion, preventing malicious users from exploiting multiple role permissions to perform improper operations, thereby protecting the system from internal threats. By setting cardinality constraints, resources are ensured to be allocated reasonably, avoiding resource waste, and preventing users from obtaining excessive permissions through multiple roles, thereby reducing the possibility of permission abuse.

[0016] Furthermore, step S4 includes the following steps:

[0017] S401. Based on the determination result of step S3, define the actions to be performed on the configuration description file SCD as read, write, and modify, and assign corresponding permissions to each role;

[0018] S402: Generate a permission code PCode corresponding to each role permission, add a permission field permissions in each component of each configuration description file SCD, and insert the permission code PCode into the permission field permissions of the configuration description file SCD, wherein each role is assigned a 3-bit binary code;

[0019] S403. Create a mapping field mapping for each role in the smart substation system, map the role to the permission, and generate a mapping code MCode corresponding to the role through the smart substation system. The mapping code MCode is used to store the 3-digit number corresponding to the role in the role permission code;

[0020] S404: According to the processing results of step S401 to step S403, the comprehensive authority of the user in the configuration description file SCD is obtained.

[0021] The beneficial effect of the above-mentioned further solution is that the present invention ensures a close correspondence between roles and responsibilities by clearly defining the permissions of each role, thereby reducing the risk of over-allocation of permissions. By generating a permission code PCode for each section of the configuration description file (SCD), indicating each role's access control permissions for that section, and creating a mapping field for each role, a clear mapping relationship between roles and access control permissions is defined, allowing the system to make quick and accurate decisions when processing permission requests, and making permission verification more efficient.

[0022] Furthermore, the expression of the permission code PCode is as follows:

[0023] PCode=b 3(1-1)+1 b 3(1-1)+2 b 3(1-1)+3 b 3(2-1)+1 b 3(2-1)+2 b 3(2-1)+3 ,…,b 3(k-1)+1 b 3(k-1)+2 b 3(k-1)+3

[0024] Among them, b 3(i-1)+j (j=1, 2, 3) represents the j-th binary code of the i-th character.

[0025] The beneficial effect of the above further solution is that, by defining permission codes (PCodes), the system can more flexibly handle permission allocation. Each role's permission code can be independent of other roles, making permission management more modular and scalable. This coding method also facilitates searching and comparing permissions within the system, improving the efficiency of permission management.

[0026] Furthermore, the expression of the mapping code MCode corresponding to the role is as follows:

[0027] MCode=000000,…,b 3(i-1)+1 b 3(i-1)+2 b 3(i-1)+3 ,…,000

[0028] b 3(i-1)+1 b 3(i-1)+2 b 3(i-1)+3 =111

[0029] Among them, b 3(i-1)+j (j=1, 2, 3) represents the j-th binary code of the i-th character.

[0030] The beneficial effect of the above further solution is: by defining the MCode code to create a mapping field for each role, the role is matched with the permission code, so that the system can quickly match and verify when processing permission requests.

[0031] Furthermore, the S5 includes the following steps:

[0032] S501. When a user accesses the configuration description file SCD, the smart substation system checks the user's corresponding role based on the user's comprehensive permissions in the configuration description file SCD and obtains a mapping field mapping of the corresponding role.

[0033] S502: Perform an AND operation on the obtained mapping code MCode value of the mapping field mapping and the permission code PCode value of the permission field permissions of the accessed configuration description file SCD;

[0034] S503, when the results of the AND operation are all 0, it means that the access is denied, otherwise, take out b 3(i-1)+1 b 3(i-1)+ 2b 3(i-1)+3 These three bits are matched with the configuration description file SCD execution action to determine the operation permissions, where b 3(i-1)+ 1b 3(i-1)+2 b 3(i-1)+3 Indicates the permission code of role i;

[0035] S504: For a user assigned multiple roles, perform an OR operation on the mapping field mapping of each role to obtain the mapping code MCode value;

[0036] S505, perform an AND operation on the mapping code MCode value obtained in step S504 and the permission code PCode value of the permission field permissions of the accessed configuration description file SCD, and extract b 3(j-1)+1 b 3(j-1)+2 b 3(j-1)+3 Perform an OR operation to obtain 3 binary bits, where b 3(j-1)+1 b 3(j-1)+2 b 3(j-1)+3 Indicates the permission code of role j;

[0037] S506 : Match the obtained 3-bit binary with the execution action of the configuration description file SCD to determine the operation authority, thereby completing the implementation of access control.

[0038] The beneficial effect of the above further scheme is: the present invention ensures that users can only perform operations allowed by their roles through a precise role and access permission matching mechanism, simplifies the permission checking logic, enables the system to quickly verify whether the user has the permission to perform specific operations, and improves the efficiency of permission verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Figure 1 Flow chart of the method of the present invention.

[0040] Figure 2 The SCD structure diagram of the smart substation configuration description file. DETAILED DESCRIPTION

[0041] The specific embodiments of the present invention are described below to facilitate understanding of the present invention by those skilled in the art. However, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the appended claims, these changes are obvious, and all inventions and creations utilizing the concepts of the present invention are protected.

[0042] Example

[0043] Before describing the present invention, the configuration description file SCD and RBAC access control model involved in the present invention are introduced:

[0044] The Substation Configuration Description (SCD) file of a smart substation is a standardized file format that describes the substation configuration and communication settings.

[0045] like Figure 2 As shown, the basic structure of the configuration description file SCD usually includes the following main parts:

[0046] Header: Contains information such as the configuration description file SCD identifier, file version, configuration tool, and file modification history.

[0047] Substation: Describes the functional structure of the substation, identifies the primary equipment and their electrical connections.

[0048] Communication: describes the address information of the SV control block and GOOSE control block of each intelligent electronic device (IED).

[0049] IED: Describes the specific configuration of intelligent electronic devices.

[0050] DataTypeTemplates: defines data type templates such as logical node types, data object types, and data attribute types.

[0051] RBAC (Role-Based Access Control) is a common access control model that manages user access rights to system resources through roles. The core concept of the RBAC access control model is to assign permissions to roles rather than directly to users, thereby simplifying permission management and improving system security. The following are the main components of the RBAC access control model:

[0052] User: A user is an entity in the system, usually an operator or visitor in the system.

[0053] Role: A role is a collection of permissions that defines the tasks that can be performed in a specific context. A role can represent a job title, responsibility, or a similar set of permissions. For example, a company might have an "Accountant" role with permissions to view financial statements, create invoices, and so on.

[0054] Target (Object): The target is the resource that needs to be protected in the system, which refers to the configuration description file SCD in this patent.

[0055] Operation: An operation is an action that can be performed on a target, such as read, write, modify, etc. Operations are often closely related to permissions, as permissions define which operations can be performed on a target.

[0056] Permission: A permission is an authorization that allows a specific action to be performed. In the RBAC access control model, permissions are usually associated with roles rather than directly with users.

[0057] Constraints: Constraints are rules in the RBAC access control model that further restrict the use of roles and permissions. Constraints can be cardinality constraints (which can limit the number of users that can be assigned to certain roles).

[0058] For example, there may be regulations that there can be only one "system administrator" role in the system), role exclusivity (a user cannot be assigned to two mutually exclusive roles at the same time. For example, a user cannot be an approver and an auditor at the same time because this may lead to a conflict of interest.) or other business rules.

[0059] like Figure 1 As shown, the present invention provides an access control implementation method for the configuration description file of the smart substation system, and the implementation method is as follows:

[0060] S1. Analyze the business processes of the smart substation system and determine the various roles that need to access the configuration description file SCD;

[0061] In this embodiment, the business process of the smart substation system is analyzed to clarify the definitions of various roles and their access requirements to the configuration description file SCD.

[0062] S2. Based on the analysis results, define the roles required in the smart substation system and define the responsibilities and permissions for each role;

[0063] In this embodiment, the analysis results define the roles required in the system R = {r1, r2, ..., r k}, define clear responsibilities and authority scope for each role, and provide each role with permissions including read, write, modify and other operations to ensure that the role's access rights are reasonable and in compliance with regulations.

[0064] S3. Define responsibilities and permissions for each role, determine mutually exclusive roles, and set cardinality constraints. Specifically:

[0065] Define responsibilities and permissions for each role, identify mutually exclusive roles, and implement logic in the smart substation system to ensure role mutual exclusion;

[0066] Set cardinality constraints to limit the number of users that can be assigned to each role and the number of roles each user can have.

[0067] In this embodiment, role mutual exclusion is implemented. When defining role permissions, mutual exclusion rules between roles are set to ensure that the same user does not have mutually exclusive role permissions at the same time. In other words, logic is implemented in the smart substation system (when a user registers, multiple mutually exclusive roles cannot be selected at the same time) to ensure role mutual exclusion.

[0068] In this embodiment, a cardinality constraint is set to limit the number of users that can be assigned to each role, as well as the number of roles each user can have. For users who need multiple roles, the permission cardinality that meets the conditions is allocated according to the actual situation.

[0069] S4. According to the result of step S3, the required permissions of the configuration description file SCD node are determined, and the permission code PCode is formed. The permission code PCode is inserted into each node as a field, and the mapping code MCode corresponding to the role is generated by the smart substation system to obtain the user's comprehensive permissions in the configuration description file SCD. The implementation method is as follows:

[0070] S401. Based on the determination result of step S3, define the actions to be performed on the configuration description file SCD as read, write, and modify, and assign corresponding permissions to each role;

[0071] S402: Generate a permission code PCode corresponding to each role permission, add a permission field permissions in each component of each configuration description file SCD, and insert the permission code PCode into the permission field permissions of the configuration description file SCD, wherein each role is assigned a 3-bit binary code;

[0072] S403. Create a mapping field mapping for each role in the smart substation system, map the role to the permission, and generate a mapping code MCode corresponding to the role through the smart substation system. The mapping code MCode is used to store the 3-digit number corresponding to the role in the role permission code;

[0073] S404: According to the processing results of step S401 to step S403, the comprehensive authority of the user in the configuration description file SCD is obtained.

[0074] In this embodiment, corresponding permission requirements are generated based on defined roles. The smart substation system maps role permissions to specific operations, ensuring that each role has an appropriate range of permissions. The operations that can be performed on the configuration description file (SCD) are clearly defined as read (R), write (W), and modify (M), and each permission is represented using a three-digit binary code. A read operation is represented by 001, a write operation by 010, and a modify operation by 100. When a user has multiple operation permissions, the system combines the corresponding binary codes using an "OR" operation. For example, 001 clearly indicates that the user has read permission, 011 indicates that the user has read and write permission, and 111 indicates that the user has read, write, and modify permissions. This encoding method accurately reflects the user's operation permissions in the configuration description file (SCD), assigning corresponding permissions to each role. The permissions are detailed enough to allow access to specific sections of the configuration description file (SCD), such as the Header, Substation, IED (Intelligent Electronic Device), Communication, and DataTypeTemplate.

[0075] In this embodiment, a permission code PCode corresponding to each role permission is generated, and a permission field permissions is added to each component of the configuration description file SCD (Header, Substation, IED, Communication, DataTypeTemplate), and the permission code PCode is inserted into the permission field permissions of the configuration description file SCD. The permission code PCode is a unique identifier used by the smart substation system to identify each role permission, ensuring the accuracy of permission allocation. Each role r i (i=1,2,3) is assigned a 3-bit binary code, represented as:

[0076] PCode=b 3(1-1)+1 b 3(1-1)+2 b 3(1-1)+3 b 3(2-1)+1 b 3(2-1)+2 b 3(2-1)+3 ,…,b 3(k-1)+1 b 3(k-1)+2 b 3(k-1)+3

[0077] Among them, b 3(i-1)+j (j=1, 2, 3) represents the j-th binary code of the i-th character.

[0078] In this embodiment, in the smart substation system, each role r iCreate a mapping field mapping to match roles with permissions. At the same time, the system generates a mapping code MCode to store the 3-digit number corresponding to the role in the role permission code. Set all 3 bits to 1 and the rest to 0 to facilitate subsequent permission verification and matching. i The corresponding mapping code MCode:

[0079] MCode=000000,…,b 3(i-1)+1 b 3(i-1)+2 b 3(i-1)+3 ,…,000

[0080] b 3(i-1)+1 b 3(i-1)+2 b 3(i-1)+3 =111

[0081] Among them, b 3(i-1)+j (j=1, 2, 3) represents the j-th binary code of the i-th character.

[0082] In this embodiment, when a user accesses an SCD node, the smart substation system automatically checks the user's role and determines whether the user has multiple roles. If the user has multiple roles, the mapping codes MCode for all roles are ORed together to combine all the user's role permissions and generate the final mapping code MCode. If the user has only one role, the mapping code MCode recorded in the mapping field is directly used as the user's final mapping code MCode to ensure the accuracy of permission verification.

[0083] In this embodiment, a permissions field is added to each component of the configuration description file SCD (Header, Substation, IED, Communication, DataTypeTemplate). Using the defined role permission encoding PCode rules, the permissions field of each component of the configuration description file SCD stores each role's access rights to that component.

[0084] S5. Based on the user's comprehensive permissions on the configuration description file SCD, determine whether the role has the permission to read, write, modify, or manage the configuration description file SCD, and implement access control. The implementation method is as follows:

[0085] S501. When a user accesses the configuration description file SCD, the smart substation system checks the user's corresponding role based on the user's comprehensive permissions in the configuration description file SCD and obtains a mapping field mapping of the corresponding role.

[0086] S502: Perform an AND operation on the obtained mapping code MCode value of the mapping field mapping and the permission code PCode value of the permission field permissions of the accessed configuration description file SCD;

[0087] S503, when the results of the AND operation are all 0, it means that the access is denied, otherwise, take out b 3(i-1)+1 b 3(i-1)+ 2b 3(i-1)+3 These three bits are matched with the configuration description file SCD execution action to determine the operation permissions, where b 3(i-1)+ 1b 3(i-1)+2 b 3(i-1)+3 Indicates the permission code of role i;

[0088] S504: For a user assigned multiple roles, perform an OR operation on the mapping field mapping of each role to obtain the mapping code MCode value;

[0089] S505, perform an AND operation on the mapping code MCode value obtained in step S504 and the permission code PCode value of the permission field permissions of the accessed configuration description file SCD, and extract b 3(j-1)+1 b 3(j-1)+2 b 3(j-1)+3 Perform an OR operation to obtain 3 binary bits, where b 3(j-1)+1 b 3(j-1)+2 b 3(j-1)+3 Indicates the permission code of role j;

[0090] S506 : Match the obtained 3-bit binary with the execution action of the configuration description file SCD to determine the operation authority, thereby completing the implementation of access control.

[0091] In this embodiment, access control logic is implemented. When a user attempts to access a certain part of the configuration description file SCD, the smart substation system will first check the user's corresponding role r i , and get the mapping field mapping of the corresponding role, then do AND operation (AND) with the mapping code MCode value and the permission code PCode value of the permission field permissions of a certain part of the access configuration description file SCD. If the result is all 0, it means access is denied, otherwise take out b 3(i-1)+1 b 3(i-1)+2 b 3(i-1)+3 These 3 bits match the defined operation code to determine its operation permissions;

[0092] If a user is assigned multiple roles m1 ,r m2 ,...,r mn(n≤k, n represents the number of roles assigned to the user, k represents the number of roles in the system) mn The mapping field mapping is performed OR operation (OR) to obtain the final MCode value, and then the obtained mapping code MCode is performed AND operation (AND) with the permission code PCode value of the permission field permissions of a certain part of the access configuration description file SCD, and the b in the result is taken out respectively. 3(j-1)+1 b 3(j-1)+2 b 3(j-1)+3 (j=m1,m2,...,m n , j represents the jth role in the permission code PCode, m n The label representing the role assigned to the user) is ORed to obtain a 3-bit binary number, which is matched with the operation code defined in 5 to determine the operation permission.

[0093] In summary, this paper proposes a RBAC implementation method for the smart substation configuration description file (SCD), which effectively controls access to the SCD. This method ensures that only authorized users can access important substation files and sensitive data, while also improving the system's flexibility and maintainability. Through refined role permission encoding and field mapping, precise access control is achieved for each component of the SCD, enhancing system security.

Claims

1. A method for implementing access control of configuration description files for a smart substation system, characterized in that: The following steps are involved: S1. Analyze the business processes of the smart substation system and determine the various roles that need to access the configuration description file SCD; S2. Based on the analysis results, define the roles required in the smart substation system and define the responsibilities and permissions for each role; S3. Define responsibilities and permissions for each role, identify mutually exclusive roles, and set cardinality constraints. S4. According to the result of step S3, the required permissions of the configuration description file SCD node are determined, and the permission code PCode is formed. The permission code PCode formed is inserted into each node as a field, and the mapping code MCode corresponding to the role is generated by the smart substation system to obtain the user's comprehensive permissions in the configuration description file SCD; S5. Based on the user's comprehensive permissions on the configuration description file SCD, determine whether the role has the permission to read, write, modify, or manage the configuration description file SCD, and implement access control, which is specifically as follows: S501. When a user accesses the configuration description file SCD, the smart substation system checks the user's corresponding role based on the user's comprehensive permissions in the configuration description file SCD and obtains a mapping field mapping of the corresponding role. S502: Perform an AND operation on the obtained mapping code MCode value of the mapping field mapping and the permission code PCode value of the permission field permissions of the accessed configuration description file SCD; The expression of the permission code PCode is as follows: in, Indicates the The first character Bit binary encoding; S503, when the results of the AND operation are all 0, it means that the access is denied, otherwise, take out These three bits are matched with the configuration description file SCD execution action to determine the operation permissions, among which, Representing a role i The permission code; S504: For a user assigned multiple roles, perform an OR operation on the mapping field mapping of each role to obtain the mapping code MCode value; The expression of the mapping code MCode corresponding to the role is as follows: in, Indicates the The first character Bit binary encoding; S505, perform an AND operation on the mapping code MCode value obtained in step S504 and the permission code PCode value of the permission field permissions of the accessed configuration description file SCD, and extract the result Perform an OR operation to obtain 3 binary bits, where Representing a role j The permission code, , j Indicates the first j A role, A label indicating the role assigned to the user; S506 : Match the obtained 3-bit binary with the execution action of the configuration description file SCD to determine the operation authority, thereby completing the implementation of access control.

2. The method for implementing access control for a configuration description file of a smart substation system according to claim 1, characterized in that: The specific steps of determining mutually exclusive roles and setting cardinality constraints are as follows: Define responsibilities and permissions for each role, identify mutually exclusive roles, and implement logic in the smart substation system to ensure role mutual exclusion; Set cardinality constraints to limit the number of users that can be assigned to each role and the number of roles each user can have.

3. The method for implementing access control for configuration description files of smart substation systems according to claim 1, characterized in that: The step S4 comprises the following steps: S401. Based on the determination result of step S3, define the actions to be performed on the configuration description file SCD as read, write, and modify, and assign corresponding permissions to each role; S402: Generate a permission code PCode corresponding to each role permission, add a permission field permissions in each component of each configuration description file SCD, and insert the permission code PCode into the permission field permissions of the configuration description file SCD, wherein each role is assigned a 3-bit binary code; S403. Create a mapping field mapping for each role in the smart substation system, map the role to the permission, and generate a mapping code MCode corresponding to the role through the smart substation system. The mapping code MCode is used to store the 3-digit number corresponding to the role in the role permission code; S404: According to the processing results of step S401 to step S403, the comprehensive authority of the user in the configuration description file SCD is obtained.

Images