A method and system for monitoring power data security based on cloud computing

Abstract

The present application discloses a method and system for secure monitoring of electric power data based on cloud computing. By implementing multiple identity authentication and permission level control, it is possible to perform multi-level security checks when users access different data, thereby reducing the risk of unauthorized access to data. The method includes: when it is detected that a user initiates a login instruction based on an access device, determining an identity authentication method, and performing a first identity authentication on the user according to the identity authentication method; when a first authentication result corresponding to the first identity authentication indicates a pass, displaying a data page of a cloud server or a network database based on the access device; in response to a data browsing instruction initiated by the user, determining a data identifier of the data to be browsed, and a first permission level corresponding to the data identifier; performing a second identity authentication on the user according to the first permission level, and when a second authentication result corresponding to the second identity authentication indicates a pass, displaying the data to be browsed based on the access device.

Description

Technical Field

[0001] The present application relates to the field of cloud computing technology, and in particular to a method and system for securely monitoring power data based on cloud computing. Background Art

[0002] Cloud computing is an emerging computing service mode, which has rapidly emerged in various industry applications due to its convenience, economy, high scalability and other advantages. Users can greatly reduce the burden of computing and storage by entrusting computing tasks and data to cloud service providers. Its basic principle is: by distributing computing on a large number of distributed computing nodes, not local computers or remote servers, the operation of enterprise data centers will be more similar to the Internet. This enables enterprises to switch resources to the required applications and access computers and storage systems according to demand.

[0003] In the related technology, when personnel need to access the cloud system of power data, they only need to enter the correct password to obtain access rights. Although this method is convenient and fast, it has certain security risks.

[0004] In the process of implementing this application, the applicant found that the related technology has at least the following problems:

[0005] The existing authentication security factor is low. Once the password is leaked, it may lead to unauthorized access, resulting in data leakage. Summary of the invention

[0006] In view of this, the present application provides a cloud computing-based power data security monitoring method and system, the main purpose of which is to solve the problem that the current verification security factor is low. Once the password is leaked, it may lead to unauthorized access, thereby causing data leakage.

[0007] According to the first aspect of the present application, a method for power data security monitoring based on cloud computing is provided, the method comprising:

[0008] When it is detected that the user initiates a login instruction based on the access device, an identity authentication method is determined according to the device type of the access device, and the user is authenticated for the first time according to the identity authentication method;

[0009] When the first verification result corresponding to the first identity authentication indicates a pass, displaying a data page of a cloud server or a network database based on the access device;

[0010] In response to a data browsing instruction initiated by a user, determining a data identifier of the data to be browsed and a first permission level corresponding to the data identifier;

[0011] Performing a second identity authentication on the user according to the first permission level, and displaying the to-be-browsed data based on the access device when a second authentication result corresponding to the second identity authentication indicates a pass.

[0012] Optionally, when it is detected that the user initiates a login instruction based on the access device, determining an identity authentication method according to the device type of the access device, and performing a first identity authentication on the user according to the identity authentication method, includes:

[0013] When it is detected that the user initiates a login instruction based on the access device, reading the access device information carried in the login instruction, wherein the access device information records the device type of the access device;

[0014] If the device type is a mobile device, determining that the identity authentication method is a first authentication method, and performing a first identity authentication on the user according to the first authentication method;

[0015] If the device type is a PC device, the identity authentication method is determined to be the second authentication method, and the user is authenticated for the first time according to the second authentication method.

[0016] Optionally, performing a first identity authentication on the user according to the first authentication method includes:

[0017] Determine the first identity information of the user based on the login instruction, and perform verification according to the first identity information, where the first identity information includes an account number and a password;

[0018] If the verification is successful, the facial features of the user are collected in real time for feature verification, and when the verification result indicates a pass, a first verification result indicating a pass is generated; when the verification result indicates an inconsistency, a first verification result indicating a fail is generated;

[0019] If the verification fails, a first verification result indicating failure is generated.

[0020] Optionally, performing a first identity authentication on the user according to the second authentication method includes:

[0021] Determine first identity information of the user based on the login instruction, where the first identity information includes a user address identifier;

[0022] Sending a random key to the user according to the user address identifier, obtaining key data uploaded by the user, and comparing the key data with the random key;

[0023] If the comparison result indicates consistency, a first verification result indicating pass is generated;

[0024] If the comparison result indicates inconsistency, a first verification result indicating failure is generated.

[0025] Optionally, in response to a data browsing instruction initiated by a user, determining a data identifier of the data to be browsed and a first permission level corresponding to the data identifier includes:

[0026] In response to the user initiating the data browsing instruction, obtaining the data identifier of the to-be-browsed data carried in the data browsing instruction, and determining the data sensitivity level associated with the data identifier;

[0027] The permission level that matches the data sensitivity level is determined in the preset access permission levels to obtain the first permission level, where the first permission level is used to indicate the lowest permission level for reading the data to be browsed.

[0028] Optionally, performing a second identity authentication on the user according to the first permission level includes:

[0029] Based on the data browsing instruction, determine the second identity information of the user, and determine the second permission level associated with the second identity information, where the second permission level is used to indicate the permission level corresponding to the user;

[0030] comparing the second permission level with the first permission level;

[0031] If the second authority level is higher than or equal to the first authority level, generating a second verification result indicating a pass;

[0032] If the second authority level is lower than the first authority level, a second verification result indicating failure is generated.

[0033] Optionally, when it is detected that the user initiates a login instruction based on the access device, before determining the identity authentication method according to the device type of the access device, the method further includes:

[0034] Collecting power data based on a data acquisition and monitoring device, and determining a sensitivity level corresponding to the power data;

[0035] Determine a target storage area corresponding to the sensitivity level, the target storage area including a first storage area corresponding to the cloud server, a second storage area corresponding to the network database, and a third storage area corresponding to the backup database;

[0036] The power data is encrypted and transmitted to the corresponding target storage area based on the communication network module, wherein the communication network module and the cloud server use SSL / TLS encryption method, and an encrypted channel is established between the client and the cloud server to transmit the power data to the first storage area. The communication network module and the network database use VPN encryption method, and an encrypted channel is established through a public network to transmit the power data to the second storage area. The communication network module and the backup database use a physical method, and optical fiber transmits the power data to the third storage area.

[0037] Optionally, the method further comprises:

[0038] Based on security monitoring equipment and security monitoring software, periodic security detection is performed on network traffic, system logs, and access behaviors to obtain security detection results;

[0039] When the security detection result indicates the presence of an abnormal event, a warning message is generated and sent to the monitoring terminal for display. The warning message includes but is not limited to the abnormal event details, risk level and response suggestions.

[0040] Optionally, the method further comprises:

[0041] Acquire power data to be shared, and use multiple cryptographic encryption technologies to encode sensitive data in the power data to be shared to obtain desensitized power data to be shared;

[0042] In response to an instruction to obtain the power data to be shared, the desensitized power data to be shared is sent to a display terminal indicated by the instruction to be shared for display.

[0043] According to the second aspect of the present application, there is provided a power data security monitoring system based on cloud computing, the system comprising:

[0044] The cloud computing platform layer is used to determine the identity authentication method according to the device type of the access device when detecting that the user initiates a login instruction based on the access device;

[0045] The cloud computing platform layer is used to perform a first identity authentication on the first identity information carried in the login instruction using the identity authentication method, obtain a first authentication result, and display a data page of the cloud server or network database based on the access device when the first authentication result indicates a pass;

[0046] The cloud computing platform layer is used to respond to a data browsing instruction initiated by a user, obtain a data identifier of the data to be browsed carried in the data browsing instruction, and determine a first access permission corresponding to the data identifier;

[0047] The cloud computing platform layer is used to perform a second identity authentication according to the second identity information carried by the data browsing instruction and the first access permission, obtain a second verification result, and display the data to be browsed based on the access device when the second verification result indicates a pass.

[0048] By means of the above technical scheme, the present application provides a method and system for secure monitoring of electric power data based on cloud computing. In the present application, when the system detects that a user initiates a login instruction based on an access device, the authentication method is determined according to the device type of the access device, and the user is authenticated for the first time according to the authentication method. Subsequently, when the first authentication result corresponding to the first authentication indicates a pass, the data page of the cloud server or network database is displayed based on the access device. Next, in response to the user initiating a data browsing instruction, the data identifier of the data to be browsed and the first permission level corresponding to the data identifier are determined. Finally, the user is authenticated for the second time according to the first permission level, and when the second authentication result corresponding to the second authentication indicates a pass, the data to be browsed is displayed based on the access device. By implementing multiple authentications and permission level control, multi-level security checks can be performed when users access data of different sensitivity levels, reducing the risk of unauthorized access to data. At the same time, the second authentication when browsing data reduces the risk of data leakage due to leakage of login passwords and improves data security.

[0049] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present application. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0051] Figure 1 A schematic diagram of a method for securely monitoring power data based on cloud computing provided in an embodiment of the present application is shown;

[0052] Figure 2 A schematic diagram of a method for securely monitoring power data based on cloud computing provided in an embodiment of the present application is shown;

[0053] Figure 3 It is a structural diagram of data acquisition and monitoring in a power data security monitoring method based on cloud computing provided by the present application;

[0054] Figure 4 It is a structural diagram of access rights management in a power data security monitoring method based on cloud computing provided by the present application;

[0055] Figure 5 It is a structural diagram of safety detection and risk warning in a cloud computing-based power data safety monitoring method provided by the present application;

[0056] Figure 6 It is a structural diagram of a cloud computing-based power data security monitoring system provided in this application. DETAILED DESCRIPTION

[0057] The exemplary embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present application and to fully convey the scope of the present application to those skilled in the art.

[0058] Cloud computing is an emerging computing service mode, which has rapidly emerged in various industry applications due to its convenience, economy, high scalability and other advantages. By entrusting computing tasks and data to cloud service providers, users can greatly reduce the burden of computing and storage. The basic principle is: by distributing computing on a large number of distributed computing nodes, non-local computers or remote servers, the operation of enterprise data centers will be more similar to the Internet. This enables enterprises to switch resources to the required applications and access computers and storage systems as needed. In the related technology, when personnel need to access the cloud system of power data, they only need to enter the correct password to obtain access rights. Although this method is convenient and fast, it has certain security risks. The applicant recognizes that the existing verification security factor is low. Once the password is leaked, it may lead to unauthorized access, resulting in data leakage.

[0059] The present application embodiment provides a method for securely monitoring power data based on cloud computing, such as Figure 1 As shown, the method includes:

[0060] 101. When it is detected that a user initiates a login instruction based on an access device, an identity authentication method is determined according to a device type of the access device, and the user is authenticated for the first time according to the identity authentication method.

[0061] The authentication method refers to the authentication method selected by the system based on the device type of the user's access device when the user logs in. The device type of the access device refers to the type of hardware device used by the user to access the system, such as a computer, mobile phone, tablet, etc.

[0062] Specifically, the system first identifies the type of device the user uses to log in. This process involves collecting the User-Agent information of the access device, the operating system and model of the access device, etc. Based on the device type, the system will select an appropriate authentication method. For example, on a mobile device, facial recognition may be used, and on a computer, password authentication may be used. Based on the selected authentication method, the system will prompt the user to verify. After successful verification, the system records the verification result and allows the user to proceed to the next step.

[0063] 102. When a first verification result corresponding to the first identity verification indicates a pass, a data page of the cloud server or network database is displayed based on the access device.

[0064] Specifically, after the user passes the first identity authentication, the system will authorize the user to access the cloud server or network database based on the verification result, and display the basic information of the data, operation options, etc. on the terminal of the access device.

[0065] 103. In response to a data browsing instruction initiated by a user, determine a data identifier of the data to be browsed and a first permission level corresponding to the data identifier.

[0066] When a user initiates an instruction to browse data, the system needs to identify the data identifier of the data to be browsed requested by the user, and then based on the data identifier, the system will query and determine the first permission level of the data item to be browsed. In the present application embodiment, the first permission level is used to indicate the viewing permission level. In the actual operation process, the data identifier can also be associated with the editing permission level and the deletion permission level, etc.

[0067] 104. Perform a second identity authentication on the user according to the first permission level, and when a second authentication result corresponding to the second identity authentication indicates a pass, display the data to be browsed based on the access device.

[0068] Among them, if the user passes the second identity authentication, it proves that the user's authority level is higher than or equal to the associated authority level of the data to be browsed, that is, the user can view the data to be browsed. At this time, the system can display the specific data content of the data to be browsed based on the access device, thereby ensuring the security of data access.

[0069] The present embodiment provides a method for secure monitoring of electric power data based on cloud computing. When the system detects that a user initiates a login instruction based on an access device, the authentication method is determined according to the device type of the access device, and the user is authenticated for the first time according to the authentication method. Subsequently, when the first verification result corresponding to the first authentication indicates a pass, the data page of the cloud server or network database is displayed based on the access device. Next, in response to the user initiating a data browsing instruction, the data identifier of the data to be browsed and the first permission level corresponding to the data identifier are determined. Finally, the user is authenticated for the second time according to the first permission level, and when the second verification result corresponding to the second authentication indicates a pass, the data to be browsed is displayed based on the access device. By implementing multiple identity authentications and permission level control, multi-level security checks can be performed when users access data of different sensitivity levels, reducing the risk of unauthorized access to data. At the same time, the second identity authentication when browsing data reduces the risk of data leakage due to leakage of login passwords and improves data security.

[0070] Further, as a refinement and extension of the specific implementation of the above embodiment, in order to fully illustrate the implementation process of this embodiment, the embodiment of the present application provides a power data security monitoring method based on cloud computing, such as Figure 2 As shown, the method includes:

[0071] 201. Data collection and monitoring.

[0072] Cloud computing is an emerging computing service mode, which has rapidly emerged in various industry applications with its advantages such as convenience, economy and high scalability. By entrusting computing tasks and data to cloud service providers, users can greatly reduce the burden of computing and storage. The basic principle is that by distributing computing on a large number of distributed computing nodes, not local computers or remote servers, the operation of enterprise data centers will be more similar to the Internet. This enables enterprises to switch resources to the required applications and access computers and storage systems according to needs. In the related art, when personnel need to access the cloud system of power data, they only need to enter the correct password to obtain access rights. Although this method is convenient and fast, it has certain security risks. The applicant recognizes that the existing verification security factor is low. Once the password is leaked, it may lead to unauthorized access, thereby causing data leakage. Therefore, the present application provides a power data security monitoring method based on cloud computing. When the system detects that the user initiates a login instruction based on an access device, the authentication method is determined according to the device type of the access device, and the user is authenticated for the first time according to the authentication method. Subsequently, when the first authentication result corresponding to the first authentication indicates that it passes, the data page of the cloud server or network database is displayed based on the access device. Next, in response to the user initiating a data browsing instruction, the data identifier of the data to be browsed and the first permission level corresponding to the data identifier are determined. Finally, the user is authenticated for a second time according to the first permission level, and when the second authentication result corresponding to the second authentication indicates a pass, the data to be browsed is displayed based on the access device. By implementing multiple identity authentication and permission level control, multi-level security checks can be performed when users access data of different sensitivity levels, reducing the risk of unauthorized access to data. At the same time, the second identity authentication when browsing data reduces the risk of data leakage due to leakage of login passwords and improves data security.

[0073] In the embodiments of the present application, Figure 3As shown, based on the data acquisition and monitoring equipment, power data is collected, and a data acquisition and monitoring mechanism is established to ensure the compliance and stability of the data acquisition process. Specifically, by deploying data acquisition and monitoring equipment to collect power data, the activities of data collection points are monitored in real time to prevent illegal collection and tampering of data. At the same time, the collected data is preliminarily verified and filtered to ensure the accuracy and integrity of the data. In the actual operation process, the data acquisition and monitoring equipment is a plurality of sensors. It should be noted that the data acquisition and monitoring equipment is connected to a lower machine module for data transmission and an upper machine module for data reception, and the upper machine module is connected to a communication network module for data transmission. Among them, the lower machine module is a remote terminal unit (RTU), which is the hardware layer of intelligent data acquisition, including various data acquisition and monitoring equipment, such as PLC (programmable logic controller), PAC (programmable automation controller), intelligent control module and board, intelligent instrument and other sensors of acquisition and monitoring equipment, the data acquisition and monitoring equipment is responsible for collecting various parameters and states of field equipment, and converting this information into digital signals, and transmitting it to the upper machine module through the communication network. Among them, the upper computer module is responsible for receiving data from the lower computer and presenting the information to the power data monitoring system operation and management personnel in an appropriate form (such as sound, graphics, images, parameter status, reports, etc.) through the human-machine interface (HMI) to monitor and manage the on-site production equipment. The communication network module is used to connect the lower computer system and the upper computer system, and is responsible for data transmission and command issuance.

[0074] In this step, comprehensive monitoring and verification are performed to ensure that the collected data will not be lost or tampered with during transmission and storage, and the integrity of the data is maintained. In addition, the host computer module displays the data to the system operation and management personnel in an appropriate form (such as sound, graphics, images, parameter status, reports, etc.) through the human-machine interface (HMI), so that the system operation and management personnel can more conveniently perform system diagnosis and maintenance work and improve work efficiency.

[0075] 202. Data transmission encryption and storage security protection.

[0076] In the embodiment of the present application, encryption technology is used in the power data collection and transmission to protect the data from unauthorized access and theft, ensuring the confidentiality and integrity of the data during transmission. For critical or sensitive data, end-to-end encryption can be used to ensure the encryption protection of the data from the source to the destination. At the same time, secure storage devices and storage technologies are used to ensure the security and reliability of data during storage, and data classification storage strategies are implemented to store data of different sensitivity levels in corresponding security areas. At the same time, storage devices are regularly inspected and maintained to prevent data loss or leakage caused by hardware failures. Storage security protection specifically stores data in three parts, in which the cloud server and network database are synchronized, while the backup database is in offline mode and can only be accessed in physical form between devices.

[0077] Specifically, Figure 3 As shown, the sensitivity level corresponding to the collected power data is determined, and the target storage area corresponding to the sensitivity level is determined, and the target storage area includes a first storage area corresponding to the cloud server, a second storage area corresponding to the network database, and a third storage area corresponding to the backup database. The power data is encrypted and transmitted to the corresponding target storage area based on the communication network module, wherein the communication network module and the cloud server adopt SSL / TLS encryption, and an encrypted channel is established between the client and the cloud server to transmit the power data to the first storage area, the communication network module and the network database adopt VPN encryption, and an encrypted channel is established through the public network to transmit the power data to the second storage area, and the communication network module and the backup database adopt a physical method, and the optical fiber transmits the power data to the third storage area.

[0078] This step stores data in different areas (such as cloud servers, network databases, and backup databases) according to the sensitivity level of the data, which can implement targeted data protection strategies and improve the flexibility and security of data management.

[0079] 203. Access permission management.

[0080] In the embodiments of the present application, Figure 4 As shown in the figure, by establishing a strict access rights management system, we can ensure that only authorized users or systems can access power data. Specifically, we adopt strategies such as role-based access control (RBAC) or attribute-based access control (ABAC), assign corresponding data access rights according to user responsibilities and permissions, and implement a multi-factor authentication mechanism to improve the security of user identity authentication. Access rights management mainly involves entering personnel access rights information and classifying access rights according to the level of management personnel.

[0081] First, when it is detected that the user initiates a login instruction based on the access device, the identity authentication method is determined according to the device type of the access device, and the user is authenticated for the first time according to the identity authentication method. When the first verification result corresponding to the first identity authentication indicates passing, the data page of the cloud server or network database is displayed based on the access device. Specifically, when it is detected that the user initiates a login instruction based on the access device, the access device information carried by the login instruction is read, and the device type of the access device is recorded in the access device information. If the device type is a mobile device, the identity authentication method is determined to be the first verification method, and the user is authenticated for the first time according to the first verification method. If the device type is a PC device, the identity authentication method is determined to be the second verification method, and the user is authenticated for the first time according to the second verification method. Among them, the specific operation process of performing the first identity authentication on the user according to the first verification method is to determine the first identity information of the user based on the login instruction, and perform verification according to the first identity information, and the first identity information includes an account number and a password. If the verification passes, the user's facial features are collected in real time for feature verification, and when the verification result indicates passing, a first verification result indicating passing is generated; when the verification result indicates inconsistency, a first verification result indicating failing is generated. If the verification fails, a first verification result indicating failing is generated. The specific operation process of performing the first identity authentication for the user according to the second verification method is to determine the first identity information of the user based on the login instruction, and the first identity information includes the user address identifier. A random key is sent to the user according to the user address identifier, and the key data uploaded by the user is obtained, and the key data is compared with the random key. If the comparison result indicates consistency, a first verification result indicating pass is generated. If the comparison result indicates inconsistency, a first verification result indicating fail is generated.

[0082] For example, when a PC device accesses, the user logs in to the cloud server or network database page, logs in according to the information account entered, and verifies the account password. The user enters the mobile phone number, and the power data security monitoring sends a random key to the mobile phone number. The visitor enters the random key to enter the cloud server or network database. When a mobile device accesses, the user logs in to the cloud server or network database page, logs in according to the information account entered, and verifies the account password. After the page authorizes the camera interface, the face recognition verification begins. During the face recognition verification, the screen displays red, yellow, and blue colors to map the face, which is a real-time verification. In the actual operation process, face recognition needs to verify random actions such as blinking 3, 4, or 5 times or nodding, shaking the head, etc., for face recognition verification. After the face recognition is passed, you can enter the cloud server or network database.

[0083] Next, in response to the user initiating a data browsing instruction, the data identifier of the data to be browsed and the first permission level corresponding to the data identifier are determined. Specifically, in response to the user initiating a data browsing instruction, the data identifier of the data to be browsed carried by the data browsing instruction is obtained, and the data sensitivity level associated with the data identifier is determined. The permission level matching the data sensitivity level is determined in the preset access permission levels to obtain the first permission level, which is used to indicate the minimum permission level for reading the data to be browsed.

[0084] Finally, the user is authenticated for a second time according to the first permission level, and when the second verification result corresponding to the second identity verification indicates a pass, the data to be browsed is displayed based on the access device. Specifically, based on the data browsing instruction, the second identity information of the user is determined, and the second permission level associated with the second identity information is determined, and the second permission level is used to indicate the permission level corresponding to the user. The second permission level is compared with the first permission level. If the second permission level is higher than or equal to the first permission level, a second verification result indicating a pass is generated. If the second permission level is lower than the first permission level, a second verification result indicating a fail is generated.

[0085] For example, when browsing data information with a PC device, the encryption key proposed by the power data security control system must be entered again, and the data information can be accessed after verification. When browsing data information with a mobile device, the encryption key proposed by the power data security control system must be entered again, and the data information can be accessed after verification. It should be noted that if each of the above verification processes fails three times, the login IP and its login account will be automatically frozen and need to be unfrozen by the administrator, and can only be accessed after verification is successful.

[0086] 204. Safety testing and risk warning.

[0087] In this embodiment, if Figure 5As shown, based on security monitoring equipment and security monitoring software, periodic security detection is performed on network traffic, system logs, and access behaviors to obtain security detection results. When the security detection results indicate that there is an abnormal event, an early warning message is generated and sent to the monitoring terminal for display. The early warning information includes but is not limited to the details of the abnormal event, the risk level, and the response suggestions. Specifically, the security status of power data is regularly evaluated, potential security risks and vulnerabilities are identified, risk assessment models and methods are used to quantify and sort risks, determine the priority risk items, establish a risk early warning mechanism, and when potential security threats are found, issue early warning signals in a timely manner to remind relevant personnel to take response measures. In the actual operation process, monitoring indicators can be set, and early warning thresholds can be set according to the monitoring indicators. When the indicator value exceeds or falls below the threshold, an early warning is triggered. When the early warning system issues an alarm, the early warning information is promptly transmitted to relevant personnel or departments, and the corresponding emergency plan or response procedure is initiated.

[0088] 205. Data desensitization.

[0089] In the embodiment of the present application, the power data to be shared is desensitized, and specifically, multiple password encryption technology is used to encode the sensitive data in the power data to be shared, so as to obtain the desensitized power data to be shared. Then, in response to the acquisition instruction of the power data to be shared, the desensitized power data to be shared is sent to the display terminal indicated by the acquisition instruction for display.

[0090] Specifically, Figure 5 As shown in the figure, for power data that needs to be shared or used externally, desensitization is performed to protect sensitive information. The sensitivity of the data is reduced by deletion, replacement or obfuscation to ensure that sensitive information will not be leaked during data sharing and use. At the same time, data desensitization processing specifications and processes are established to ensure the consistency and effectiveness of desensitization processing. Data desensitization uses encryption methods and multiple password encryption, such as AES symmetric encryption algorithm or RSA asymmetric encryption, to encode sensitive data so that it cannot be interpreted without authorization. By desensitizing shared power data, sensitive information can be effectively protected to prevent the leakage of user privacy or commercial secrets when sharing or using it externally.

[0091] 206. Emergency response and recovery.

[0092] In this step, it is necessary to establish a sound emergency response and recovery mechanism to deal with emergencies such as sudden security incidents and data leaks, formulate detailed emergency plans and operating procedures, clarify the organizational structure, division of responsibilities and disposal measures for emergency response, organize emergency drills and training activities regularly, improve the practical ability and efficiency of emergency response, and quickly activate emergency plans when security incidents occur, take effective measures to control the development of the situation and restore data services. Emergency response and recovery is a series of actions and measures taken by organizations in the face of emergencies, security accidents, natural disasters, cyber attacks and other critical situations, aiming to minimize potential negative impacts, protect personnel, assets and the environment, and resume normal operations as soon as possible.

[0093] First, if Figure 5 As shown in the figure, it is necessary to quickly conduct a preliminary assessment of the nature, scale, and scope of the incident to determine the level of emergency response and the required resources. According to the assessment results, the pre-established emergency plan or process is quickly launched to clarify the responsibilities and tasks of each participant. Subsequently, physical isolation, system shutdown, and personnel evacuation are taken to control the further development of the situation, prevent the expansion of harm, organize a collaborative mechanism, share information, and coordinate resources to respond to emergencies. During emergency recovery, a detailed recovery plan is formulated to clarify the recovery goals, timetables, resource requirements, and responsible persons. According to the recovery plan, various recovery measures are gradually implemented, including repairing damaged facilities, restoring system operation, and recovering data based on the physical database. The data backup strategy ensures the integrity and availability of key data in the power data monitoring system. Data backup includes two methods: regular backup and real-time backup. Regular backup is usually performed during periods of low system load to reduce the impact on system performance; while real-time backup uses continuous data protection (CDP) technology to ensure that data is backed up at the moment of change, thereby minimizing the risk of data loss. The backup data is stored on dedicated backup servers that have high reliability and fault tolerance to ensure that the backup data remains safe and reliable in the event of hardware failure or catastrophic events. The backup strategy also includes off-site backup of data, copying the data to a remote data center to cope with possible regional disasters.

[0094] The method provided in the embodiment of the present application is that when the system detects that a user initiates a login instruction based on an access device, the identity authentication method is determined according to the device type of the access device, and the user is authenticated for the first time according to the identity authentication method. Subsequently, when the first verification result corresponding to the first identity authentication indicates a pass, the data page of the cloud server or network database is displayed based on the access device. Next, in response to the user initiating a data browsing instruction, the data identifier of the data to be browsed and the first permission level corresponding to the data identifier are determined. Finally, the user is authenticated for the second time according to the first permission level, and when the second verification result corresponding to the second identity authentication indicates a pass, the data to be browsed is displayed based on the access device. By implementing multiple identity authentications and permission level control, multi-level security checks can be performed when users access data of different sensitivity levels, reducing the risk of unauthorized access to data. At the same time, the second identity authentication when browsing data reduces the risk of data leakage due to leakage of login passwords, and improves data security.

[0095] Further, as Figure 1 The specific implementation of the method, the embodiment of the present application provides a power data security monitoring system based on cloud computing, such as Figure 6 As shown, the system comprises:

[0096] Physical data statistics layer for data collection and monitoring;

[0097] Data collection layer for multi-level encryption of data;

[0098] Data transmission layer for multi-stage data transmission;

[0099] Cloud computing platform layer for data storage security protection and access rights management;

[0100] Data application layer used for security auditing and monitoring, risk assessment and early warning, data desensitization, and emergency response and recovery.

[0101] The cloud computing platform layer is used to determine the identity authentication method according to the device type of the access device when detecting that the user initiates a login instruction based on the access device;

[0102] The cloud computing platform layer is used to perform a first identity authentication on the first identity information carried in the login instruction using the identity authentication method, obtain a first authentication result, and display a data page of the cloud server or network database based on the access device when the first authentication result indicates a pass;

[0103] The cloud computing platform layer is used to respond to a data browsing instruction initiated by a user, obtain a data identifier of the data to be browsed carried in the data browsing instruction, and determine a first access permission corresponding to the data identifier;

[0104] The cloud computing platform layer is used to perform a second identity authentication according to the second identity information carried by the data browsing instruction and the first access permission, obtain a second verification result, and display the data to be browsed based on the access device when the second verification result indicates a pass.

[0105] Physical data statistics also integrate intelligent sensors and remote monitoring devices to monitor the operating status of the power system in real time. These devices can detect key parameters such as voltage, current, temperature, etc., and transmit data to the data acquisition layer through wireless or wired networks.

[0106] In order to ensure the security of data during the collection process, the data eraser layer adopts multi-level encryption technology. First, the data is initially encrypted at the collection point, then encrypted twice during the transmission process, and finally encrypted a third time before storage. This layered encryption strategy ensures the security of data at every stage.

[0107] In order to cope with network failures and attacks, the data transmission layer adopts a redundant design. Through multiple transmission paths and backup channels, it ensures that data will not be interrupted due to single point failure during transmission. In addition, the transport layer also supports load balancing and flow control to optimize network performance.

[0108] The cloud computing platform layer has elastic expansion capabilities and can dynamically adjust resource allocation according to changes in the amount of data in the power system. Through virtualization technology, this layer can quickly increase or decrease computing resources and storage resources to meet data processing needs in different time periods.

[0109] The data application layer not only includes security audit and monitoring, risk assessment and early warning, data desensitization processing, and emergency response and recovery, but also integrates big data analysis and artificial intelligence algorithms. By analyzing historical data and real-time data, the system can predict potential risks in the power system and provide intelligent decision support, thereby improving the stability and reliability of the power system.

[0110] The system provided in the embodiment of the present application can determine the identity authentication method according to the device type of the access device when the system detects that the user initiates a login instruction based on the access device, and perform the first identity authentication on the user according to the identity authentication method. Subsequently, when the first verification result corresponding to the first identity authentication indicates a pass, the data page of the cloud server or network database is displayed based on the access device. Next, in response to the user initiating a data browsing instruction, the data identifier of the data to be browsed and the first permission level corresponding to the data identifier are determined. Finally, the user is authenticated for a second time according to the first permission level, and when the second verification result corresponding to the second identity authentication indicates a pass, the data to be browsed is displayed based on the access device. By implementing multiple identity authentications and permission level control, multi-level security checks can be performed when users access data of different sensitivity levels, reducing the risk of unauthorized access to data. At the same time, the second identity authentication when browsing data reduces the risk of data leakage due to leakage of login passwords, and improves data security.

[0111] Based on this understanding, the technical solution of the present application can be embodied in the form of a software product. The software product to be identified can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.), including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each implementation scenario of the present application.

[0112] Through the description of the above implementation methods, the technicians in this field can clearly understand that the present application can be implemented by means of software plus the necessary general hardware platform, or by hardware. By applying the technical solution of the present application, when the system detects that the user initiates a login instruction based on the access device, the identity authentication method is determined according to the device type of the access device, and the user is authenticated for the first time according to the identity authentication method. Subsequently, when the first verification result corresponding to the first identity authentication indicates passing, the data page of the cloud server or network database is displayed based on the access device. Next, in response to the user initiating a data browsing instruction, the data identifier of the data to be browsed and the first permission level corresponding to the data identifier are determined. Finally, the user is authenticated for the second time according to the first permission level, and when the second verification result corresponding to the second identity authentication indicates passing, the data to be browsed is displayed based on the access device. Compared with the prior art, by implementing multiple identity authentication and permission level control, it is possible to perform multi-level security checks when the user accesses data of different sensitivity levels, reducing the risk of unauthorized access to the data. At the same time, the second identity authentication when browsing data reduces the risk of data leakage caused by leakage of the login password and improves data security.

[0113] Those skilled in the art will appreciate that the accompanying drawings are merely schematic diagrams of a preferred implementation scenario, and the modules or processes in the accompanying drawings are not necessarily required for implementing the present application.

[0114] Those skilled in the art will appreciate that the modules in the device in the implementation scenario can be distributed in the device in the implementation scenario according to the implementation scenario description, or can be changed accordingly and located in one or more devices different from the implementation scenario. The modules in the above implementation scenario can be combined into one module, or can be further split into multiple sub-modules.

[0115] The above application serial numbers are for description only and do not represent the advantages or disadvantages of the implementation scenarios.

[0116] The above disclosure only discloses several specific implementation scenarios of the present application. However, the present application is not limited thereto, and any changes that can be conceived by technicians in this field should fall within the protection scope of the present application.

Claims

1. A method for secure monitoring of power data based on cloud computing, characterized in that: include: When it is detected that the user initiates a login instruction based on the access device, an identity authentication method is determined according to the device type of the access device, and the user is authenticated for the first time according to the identity authentication method; When the first verification result corresponding to the first identity authentication indicates a pass, displaying a data page of a cloud server or a network database based on the access device; In response to a data browsing instruction initiated by a user, determining a data identifier of the data to be browsed and a first permission level corresponding to the data identifier; Performing a second identity authentication on the user according to the first permission level, and displaying the to-be-browsed data based on the access device when a second authentication result corresponding to the second identity authentication indicates a pass.

2. The method according to claim 1, characterized in that When it is detected that the user initiates a login instruction based on the access device, an identity authentication method is determined according to the device type of the access device, and the user is authenticated for the first time according to the identity authentication method, including: When it is detected that the user initiates a login instruction based on the access device, reading the access device information carried in the login instruction, wherein the access device information records the device type of the access device; If the device type is a mobile device, determining that the identity authentication method is a first authentication method, and performing a first identity authentication on the user according to the first authentication method; If the device type is a PC device, the identity authentication method is determined to be the second authentication method, and the user is authenticated for the first time according to the second authentication method.

3. The method according to claim 2, characterized in that The performing a first identity authentication on the user according to the first authentication method includes: Determine the first identity information of the user based on the login instruction, and perform verification according to the first identity information, where the first identity information includes an account number and a password; If the verification is successful, the facial features of the user are collected in real time for feature verification, and when the verification result indicates a pass, a first verification result indicating a pass is generated; when the verification result indicates an inconsistency, a first verification result indicating a fail is generated; If the verification fails, a first verification result indicating failure is generated.

4. The method according to claim 2, characterized in that: The first identity authentication of the user according to the second authentication method includes: Determine first identity information of the user based on the login instruction, where the first identity information includes a user address identifier; Sending a random key to the user according to the user address identifier, obtaining key data uploaded by the user, and comparing the key data with the random key; If the comparison result indicates consistency, a first verification result indicating pass is generated; If the comparison result indicates inconsistency, a first verification result indicating failure is generated.

5. The method according to claim 1, characterized in that The step of determining the data identifier of the data to be browsed and the first permission level corresponding to the data identifier in response to the user initiating the data browsing instruction includes: In response to the user initiating the data browsing instruction, obtaining the data identifier of the to-be-browsed data carried in the data browsing instruction, and determining the data sensitivity level associated with the data identifier; The permission level that matches the data sensitivity level is determined in the preset access permission levels to obtain the first permission level, where the first permission level is used to indicate the lowest permission level for reading the data to be browsed.

6. The method according to claim 1, characterized in that The performing a second identity authentication on the user according to the first permission level includes: Based on the data browsing instruction, determine the second identity information of the user, and determine the second permission level associated with the second identity information, where the second permission level is used to indicate the permission level corresponding to the user; comparing the second permission level with the first permission level; If the second authority level is higher than or equal to the first authority level, generating a second verification result indicating a pass; If the second authority level is lower than the first authority level, a second verification result indicating failure is generated.

7. The method according to claim 1, characterized in that When it is detected that the user initiates a login instruction based on the access device, before determining the identity authentication method according to the device type of the access device, the method further includes: Collecting power data based on a data acquisition and monitoring device, and determining a sensitivity level corresponding to the power data; Determine a target storage area corresponding to the sensitivity level, the target storage area including a first storage area corresponding to the cloud server, a second storage area corresponding to the network database, and a third storage area corresponding to the backup database; The power data is encrypted and transmitted to the corresponding target storage area based on the communication network module, wherein the communication network module and the cloud server use SSL / TLS encryption method, and an encrypted channel is established between the client and the cloud server to transmit the power data to the first storage area. The communication network module and the network database use VPN encryption method, and an encrypted channel is established through a public network to transmit the power data to the second storage area. The communication network module and the backup database use a physical method, and optical fiber transmits the power data to the third storage area.

8. The method according to claim 1, characterized in that The method further comprises: Based on security monitoring equipment and security monitoring software, periodic security detection is performed on network traffic, system logs, and access behaviors to obtain security detection results; When the security detection result indicates the presence of an abnormal event, a warning message is generated and sent to the monitoring terminal for display. The warning message includes but is not limited to the abnormal event details, risk level and response suggestions.

9. The method according to claim 1, characterized in that: The method further comprises: Acquire power data to be shared, and use multiple cryptographic encryption technologies to encode sensitive data in the power data to be shared to obtain desensitized power data to be shared; In response to an instruction to obtain the power data to be shared, the desensitized power data to be shared is sent to a display terminal indicated by the instruction to be shared for display.

10. A power data security monitoring system based on cloud computing, characterized in that: include: The cloud computing platform layer is used to determine the identity authentication method according to the device type of the access device when detecting that the user initiates a login instruction based on the access device; The cloud computing platform layer is used to perform a first identity authentication on the first identity information carried in the login instruction using the identity authentication method, obtain a first authentication result, and display a data page of the cloud server or network database based on the access device when the first authentication result indicates a pass; The cloud computing platform layer is used to respond to a data browsing instruction initiated by a user, obtain a data identifier of the data to be browsed carried in the data browsing instruction, and determine a first access permission corresponding to the data identifier; The cloud computing platform layer is used to perform a second identity authentication according to the second identity information carried by the data browsing instruction and the first access permission, obtain a second verification result, and display the data to be browsed based on the access device when the second verification result indicates a pass.

Images