Access authentication method and device of power grid dispatching cloud platform, computer device, storage medium and program product

Abstract

The application relates to an access authentication method and device of a power grid dispatching cloud platform, equipment, a storage medium and a program product, and relates to the technical field of information security. The method can reduce the security risks existing when remotely accessing the power grid dispatching cloud platform. The method comprises the following steps: sending an access request of a current user to a configured OTP server, so that the OTP server generates an account password and an OTP dynamic token according to the access request; obtaining a username of the current user, receiving the account password and the OTP dynamic token returned by the OTP server, and sending the username, the account password and the OTP dynamic token to a unified identity authentication platform; the unified identity authentication platform verifies the account password according to the username, and sends the OTP dynamic token to the OTP server under the condition that the account password verification is passed, and the OTP server verifies the OTP dynamic token; the unified identity authentication platform is logged in under the condition that the OTP dynamic token verification is passed, and the power grid dispatching cloud platform is accessed through the unified identity authentication platform.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to an access authentication method, apparatus, computer equipment, computer-readable storage medium, and computer program product for a power grid dispatch cloud platform. Background Technology

[0002] With the expansion of the power grid and the trend of digital transformation in power companies, the demand for access to the power grid dispatch cloud platform anytime and anywhere continues to increase. By using methods such as virtual private networks (VPNs), information channels can be established between personal clients and the power grid dispatch cloud platform over public networks, enabling cloud platform operation and maintenance personnel to conveniently access the platform via the internet.

[0003] However, current methods for accessing important data platforms such as power grid dispatch cloud platforms via virtual private networks have shortcomings such as insufficient authentication factors and unknown login terminal security, resulting in significant security risks when remotely accessing power grid dispatch cloud platforms using current technologies. Summary of the Invention

[0004] Therefore, it is necessary to provide an access authentication method, device, computer equipment, computer-readable storage medium, and computer program product for a power grid dispatch cloud platform to address the aforementioned technical problems.

[0005] Firstly, this application provides an access authentication method for a power grid dispatch cloud platform, including:

[0006] In response to the current user's access request to the power grid dispatch cloud platform, the access request is sent to the configured OTP server (One-Time Password Server, a server system for generating, verifying and managing one-time passwords (OTP, One-Time Password)) so that the OTP server can generate an account password and an OTP (One-Time Password) dynamic token according to the access request.

[0007] Obtain the username of the current user, and receive the account password and OTP dynamic token returned by the OTP server. Package the username, the account password and the OTP dynamic token and send them to the unified identity authentication platform. The unified identity authentication platform verifies the account password based on the username. If the account password is verified, send the OTP dynamic token to the OTP server. The OTP server verifies the OTP dynamic token.

[0008] Log in to the unified identity authentication platform after the OTP dynamic token verification is successful, and access the power grid dispatch cloud platform through the unified identity authentication platform.

[0009] In one embodiment, the response to the current user's access request to the power grid dispatch cloud platform further includes:

[0010] Obtain the user's information and send it to the server to be configured, so that the server to be configured can bind the user information and the imported seed key to obtain the configured OTP server.

[0011] In one embodiment, the OTP server generates an account password and an OTP dynamic token based on the access request, including:

[0012] The OTP server generates a time factor based on the time the access request is received, identifies the current user's information based on the access request, and matches the corresponding target seed key based on the current user's information; the account password and the OTP dynamic token are calculated using the SM3 algorithm based on the time factor and the target seed key.

[0013] In one embodiment, the aforementioned power grid dispatch cloud platform includes an operation and maintenance console and an operation console. Accessing the power grid dispatch cloud platform through the unified identity authentication platform includes:

[0014] In response to the current user's platform selection instruction, the platform to be accessed is determined in the operation and maintenance console and the operation console; the user then logs in to the platform to be accessed via single sign-on using the SAML protocol on the unified identity authentication platform.

[0015] In one embodiment, the method further includes:

[0016] If the account password or the OTP dynamic token verification fails, the access request is rejected and the cumulative number of verification failures for the current user's account within a preset time window is updated; if the cumulative number of verification failures exceeds the threshold, the account login privileges for the account within the preset time window are revoked.

[0017] In one embodiment, the method further includes:

[0018] If the access request is approved, the operation information of this access to the power grid dispatch cloud platform is recorded; the target information entry in the information database is matched according to the username, and the operation information is entered into the target information entry.

[0019] Secondly, this application also provides an access authentication device for a power grid dispatch cloud platform, comprising:

[0020] The request receiving module is used to respond to the current user's access request to the power grid dispatch cloud platform and send the access request to the configured OTP server so that the OTP server can generate an account password and an OTP dynamic token according to the access request.

[0021] The information verification module is used to obtain the username of the current user, receive the account password and the OTP dynamic token returned by the OTP server, package the username, the account password and the OTP dynamic token and send them to the unified identity authentication platform. The unified identity authentication platform verifies the account password based on the username. If the account password is verified, the OTP dynamic token is sent to the OTP server and verified by the OTP server.

[0022] The login access module is used to log in to the unified identity authentication platform and access the power grid dispatch cloud platform through the unified identity authentication platform when the OTP dynamic token verification is successful.

[0023] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0024] In response to the current user's access request to the power grid dispatch cloud platform, the access request is sent to a configured OTP server, which generates an account password and an OTP dynamic token based on the access request. The system obtains the current user's username and receives the account password and OTP dynamic token returned by the OTP server. The system then packages the username, account password, and OTP dynamic token and sends them to a unified identity authentication platform. The unified identity authentication platform verifies the account password based on the username. If the account password verification is successful, the system sends the OTP dynamic token to the OTP server, which verifies the OTP dynamic token. If the OTP dynamic token verification is successful, the system logs into the unified identity authentication platform and accesses the power grid dispatch cloud platform through the unified identity authentication platform.

[0025] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0026] In response to the current user's access request to the power grid dispatch cloud platform, the access request is sent to a configured OTP server, which generates an account password and an OTP dynamic token based on the access request. The system obtains the current user's username and receives the account password and OTP dynamic token returned by the OTP server. The system then packages the username, account password, and OTP dynamic token and sends them to a unified identity authentication platform. The unified identity authentication platform verifies the account password based on the username. If the account password verification is successful, the system sends the OTP dynamic token to the OTP server, which verifies the OTP dynamic token. If the OTP dynamic token verification is successful, the system logs into the unified identity authentication platform and accesses the power grid dispatch cloud platform through the unified identity authentication platform.

[0027] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0028] In response to the current user's access request to the power grid dispatch cloud platform, the access request is sent to a configured OTP server, which generates an account password and an OTP dynamic token based on the access request. The system obtains the current user's username and receives the account password and OTP dynamic token returned by the OTP server. The system then packages the username, account password, and OTP dynamic token and sends them to a unified identity authentication platform. The unified identity authentication platform verifies the account password based on the username. If the account password verification is successful, the system sends the OTP dynamic token to the OTP server, which verifies the OTP dynamic token. If the OTP dynamic token verification is successful, the system logs into the unified identity authentication platform and accesses the power grid dispatch cloud platform through the unified identity authentication platform.

[0029] The aforementioned access authentication method, device, computer equipment, computer-readable storage medium, and computer program product for the power grid dispatch cloud platform obtains the current user's username and receives the account password and OTP dynamic token returned by the OTP server. The username, account password, and OTP dynamic token are packaged and sent to a unified identity authentication platform. The unified identity authentication platform verifies the account password based on the username. If the account password verification is successful, the OTP dynamic token is sent to the OTP server for verification. If the OTP dynamic token verification is successful, the user logs into the unified identity authentication platform and accesses the power grid dispatch cloud platform through the unified identity authentication platform. This application uses an account password + dynamic token authentication mechanism to perform dual verification of the user, accurately verifying whether the user's access behavior is legal and compliant. This overcomes the shortcomings of traditional technologies, such as insufficient authentication factors and unknown login terminal security, thereby improving the authenticity of entity identity verification and the security of network communication, and reducing the security risks associated with remote access to the power grid dispatch cloud platform. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 This is an application environment diagram of the access authentication method of the power grid dispatch cloud platform in one embodiment;

[0032] Figure 2 This is a flowchart illustrating the access authentication method of a power grid dispatch cloud platform in one embodiment;

[0033] Figure 3 This is a flowchart illustrating the access authentication method of a power grid dispatch cloud platform in a specific embodiment;

[0034] Figure 4 This is a structural block diagram of the access authentication device of the power grid dispatch cloud platform in one embodiment;

[0035] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0037] The access authentication method for the power grid dispatch cloud platform provided in this application embodiment can be applied to, for example... Figure 1 The application environment shown illustrates this. The login client can communicate with the OTP server via the network. The data storage system can store the data that the OTP server needs to process. The data storage system can be integrated into the OTP server, or it can be located in the cloud or on other network servers.

[0038] Specifically, the access authentication method for the power grid dispatch cloud platform provided in this application embodiment can be executed by the login terminal.

[0039] For example, in response to the current user's access request to the power grid dispatch cloud platform, the login terminal sends the access request to the configured OTP server, so that the OTP server can generate an account password and an OTP dynamic token based on the access request; the login terminal obtains the current user's username, and receives the account password and OTP dynamic token returned by the OTP server, packages the username, account password, and OTP dynamic token and sends them to the unified identity authentication platform, which verifies the account password based on the username. If the account password is verified, the OTP dynamic token is sent to the OTP server, which verifies the OTP dynamic token; the login terminal logs into the unified identity authentication platform and accesses the power grid dispatch cloud platform through the unified identity authentication platform.

[0040] In such Figure 1 In the application environment shown, the login terminal can be, but is not limited to, various personal computers, laptops, smartphones, and tablets. The OTP server can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0041] In one embodiment, such as Figure 2 As shown, an access authentication method for a power grid dispatch cloud platform is provided, which can be applied to... Figure 1 In the login terminal, the method may include the following steps:

[0042] Step S201: In response to the current user's access request to the power grid dispatch cloud platform, the access request is sent to the configured OTP server so that the OTP server can generate an account password and an OTP dynamic token based on the access request.

[0043] OTP (Optical Time Protocol) tokens are a security measure used for authentication, typically to ensure the security of online transactions, logins, or access to sensitive information. OTP tokens generate one-time passwords that are valid for a short period and change with each login, thus improving system security.

[0044] Account passwords are a method of identity verification used to protect user account security.

[0045] Specifically, in response to the current user's access request to the power grid dispatch cloud platform, the login terminal sends the access request to the configured OTP server, so that the OTP server can generate an account password and an OTP dynamic token based on the access request.

[0046] Step S202: Obtain the current user's username, and receive the account password and OTP dynamic token returned by the OTP server. Package the username, account password, and OTP dynamic token and send them to the unified identity authentication platform. The unified identity authentication platform verifies the account password based on the username. If the account password is verified, the OTP dynamic token is sent to the OTP server, which then verifies the OTP dynamic token.

[0047] The username can refer to a unique name used to identify a user in a system or platform, and it is usually used together with a password for user authentication.

[0048] Among them, the unified identity authentication platform can be IDaaS (Identity as a Service, a solution that provides identity management and authentication services through cloud computing).

[0049] Specifically, the client obtains the current user's username and receives the account password and OTP dynamic token returned by the OTP server. It then packages the username, account password, and OTP dynamic token and sends them to the unified identity authentication platform. The unified identity authentication platform verifies the account password based on the username. If the account password is verified, the platform sends the OTP dynamic token to the OTP server, which then verifies the OTP dynamic token.

[0050] Step S203: Log in to the unified identity authentication platform after the OTP dynamic token verification is successful, and access the power grid dispatch cloud platform through the unified identity authentication platform.

[0051] Specifically, after the OTP dynamic token verification is successful, the client logs into the unified identity authentication platform and then uses the SAML protocol on the unified identity authentication platform to single sign-on to access the power grid dispatch cloud platform.

[0052] In this embodiment, the user's username is obtained, and the account password and OTP dynamic token returned by the OTP server are received. The username, account password, and OTP dynamic token are packaged and sent to the unified identity authentication platform. The unified identity authentication platform verifies the account password based on the username. If the account password verification is successful, the OTP dynamic token is sent to the OTP server for verification. If the OTP dynamic token verification is successful, the user logs into the unified identity authentication platform and accesses the power grid dispatch cloud platform through the unified identity authentication platform. This application uses an account password + dynamic token authentication mechanism to perform dual verification of the user, accurately verifying whether the user's access behavior is legal and compliant. This overcomes the shortcomings of traditional technologies, such as insufficient authentication factors and unknown login terminal security, thereby improving the authenticity of entity identity verification and the security of network communication, and reducing the security risks associated with remote access to the power grid dispatch cloud platform.

[0053] In one embodiment, before responding to the current user's access request for the power grid dispatch cloud platform, the method of this application further includes the following steps:

[0054] Obtain the user's information and send it to the server to be configured. The server will then bind the user information and the imported seed key to obtain the configured OTP server.

[0055] Users can be maintenance and operation personnel of power companies.

[0056] User information typically includes a series of data used to identify and describe users, such as: basic personal information (name and age, etc.), account information (username, account status and level permissions, etc.), and identity verification information (ID card number, driver's license and passport, etc.).

[0057] The seed key is typically an initial value used in encryption, algorithm generation, and random number generation. Its main function is to provide the initial input for generating random numbers or the output of encryption algorithms. The seed key can be injected by the manufacturer during the production of OTP dynamic token hardware.

[0058] Specifically, the client obtains the user's information and sends it to the server to be configured, so that the server can bind the user information and the imported seed key to obtain the configured OTP server, thereby completing the initial user configuration.

[0059] In one embodiment, the OTP server in step S201 generates an account password and an OTP dynamic token based on the access request, which may include the following steps:

[0060] The OTP server generates a time factor based on the time the access request is received, identifies the current user's information based on the access request, and matches the corresponding target seed key based on the current user's information. The account password and OTP dynamic token are calculated using the SM3 algorithm based on the time factor and the target seed key.

[0061] The SM3 algorithm is a hash algorithm released by the State Cryptography Administration of China and is part of the national cryptographic algorithms. It is mainly used in areas such as data integrity protection, digital signatures, and message authentication. The SM3 algorithm is similar in function to international standard hash algorithms (such as SHA-256), both being cryptographic hash functions used to generate fixed-length hash values.

[0062] Specifically, the OTP server generates a time factor based on the time of receiving the cloud platform access request, identifies the current user's information based on the cloud platform access request, and matches the corresponding target seed key based on the current user's information; the account password and OTP dynamic token are calculated using the SM3 algorithm based on the time factor and the target seed key.

[0063] In one embodiment, the power grid dispatch cloud platform includes an operation and maintenance console and an operation console. Step S203, accessing the power grid dispatch cloud platform through a unified identity authentication platform, may include the following steps:

[0064] In response to the current user's platform selection command, the platform to be accessed is determined in the operation and maintenance console and the operation console; the user then uses the SAML (Security Assertion Markup Language) protocol on the unified identity authentication platform to perform single sign-on on the platform to be accessed.

[0065] Among them, the SAML protocol is an open standard based on XML used to exchange identity authentication and authorization data, and is widely used in single sign-on scenarios.

[0066] ASO (Application Service Operation) typically refers to a tool or platform for managing and monitoring systems, primarily used by operations personnel to manage, monitor, troubleshoot, and optimize applications and services. ASCM (Application Service Control Management) typically refers to a tool platform for managing, monitoring, and analyzing product operations, geared towards operations teams, helping enterprises effectively manage and optimize the operation and development of products or services.

[0067] Specifically, in response to the current user's platform selection instruction, the login terminal determines the platform to be accessed in the operation and maintenance console and the management console; and logs in to the platform to be accessed through the SAML protocol on the unified identity authentication platform to access the platform.

[0068] In one embodiment, the method of this application further includes the following steps:

[0069] If the account password or OTP dynamic token verification fails, the access request will be rejected and the cumulative number of verification failures for the current user's account within the preset time window will be updated; if the cumulative number of verification failures exceeds the threshold, the account's login privileges will be revoked within the preset time window.

[0070] Account login permissions refer to the operations and access rights that users have when using an account. These permissions are usually set and assigned by the account administrator or system administrator to ensure that users can only perform the operations they need and to protect the security of the account and the system.

[0071] Specifically, if the login client fails to verify the account password or OTP dynamic token, it rejects the access request and updates the current user's account's cumulative number of verification failures within a preset time window. If the cumulative number of verification failures exceeds the threshold, the account's login privileges are revoked within the preset time window. This effectively identifies abnormal user logins and enhances the security of user authentication.

[0072] In one embodiment, the method of this application further includes the following steps:

[0073] If the access request is approved, record the operation information for this access to the power grid dispatch cloud platform; match the target information entry in the information database according to the username, and enter the operation information into the target information entry.

[0074] Among them, operation information can be related information generated when users perform various operations on the power grid dispatch cloud platform, such as information query, username change, etc.

[0075] Information entries generally refer to short units of information arranged according to certain rules in a book, document, database, or encyclopedia, similar to a title or section.

[0076] Specifically, when the access request is approved, the client records the operation information of this access to the power grid dispatch cloud platform, matches the target information entry in the information database according to the username, and enters the operation information into the target information entry. In this way, each user's username is used as a distinguishing identifier, and the operation information table of each user is entered into the information database in an orderly manner, which is conducive to the efficient storage and utilization of operation information.

[0077] In one embodiment, such as Figure 3 As shown, a specific embodiment of the access authentication method for the power grid dispatch cloud platform is provided, which includes the following steps:

[0078] Step S301: Obtain the user's user information and send the user information to the server to be configured so that the server to be configured can bind the user information and the imported seed key to obtain the configured OTP server.

[0079] Step S302: In response to the current user's access request to the power grid dispatch cloud platform, the access request is sent to the configured OTP server, so that the OTP server can generate a time factor based on the reception time of the access request, identify the current user's user information based on the access request, and match the corresponding target seed key based on the current user's user information; and calculate the account password and OTP dynamic token using the SM3 algorithm based on the time factor and the target seed key.

[0080] Step S303: Obtain the current user's username, and receive the account password and OTP dynamic token returned by the OTP server. Package the username, account password, and OTP dynamic token and send them to the unified identity authentication platform. The unified identity authentication platform verifies the account password based on the username. If the account password is verified, the OTP dynamic token is sent to the OTP server, which then verifies the OTP dynamic token.

[0081] Step S304: Log in to the unified identity authentication platform after the OTP dynamic token verification is successful. In response to the current user's platform selection instruction, determine the platform to be accessed in the operation and maintenance console and the operation console. Log in to the platform to be accessed on the unified identity authentication platform through the SAML protocol to access the platform.

[0082] Step S305: If the access request is approved, record the operation information of this access to the power grid dispatch cloud platform; match the target information entry in the information database according to the username, and enter the operation information into the target information entry.

[0083] The beneficial effects of the above embodiments are as follows:

[0084] By using national cryptographic algorithms and an authentication mechanism combining account passwords and dynamic tokens to perform dual verification on users, the legality and compliance of users' access behavior can be accurately verified. This makes up for the shortcomings of traditional technologies, such as insufficient authentication factors and unknown login security, thereby improving the authenticity of entity identity verification and the security of network communication, and reducing the security risks when remotely accessing the power grid dispatch cloud platform.

[0085] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0086] Based on the same inventive concept, this application also provides an access authentication device for a power grid dispatch cloud platform for implementing the access authentication method of the power grid dispatch cloud platform described above. The solution provided by this device is similar to the implementation described in the above method. Therefore, the specific limitations in one or more embodiments of the access authentication device for a power grid dispatch cloud platform provided below can be found in the limitations of the access authentication method for the power grid dispatch cloud platform described above, and will not be repeated here.

[0087] In one exemplary embodiment, such as Figure 4 As shown, an access authentication device for a power grid dispatch cloud platform is provided, which may include:

[0088] The request receiving module 401 is used to respond to the current user's access request to the power grid dispatch cloud platform and send the access request to the configured OTP server so that the OTP server can generate an account password and an OTP dynamic token according to the access request.

[0089] The information verification module 402 is used to obtain the username of the current user, and receive the account password and OTP dynamic token returned by the OTP server. It packages the username, account password and OTP dynamic token and sends them to the unified identity authentication platform. The unified identity authentication platform verifies the account password based on the username. If the account password is verified, the OTP dynamic token is sent to the OTP server and verified by the OTP server.

[0090] The login access module 403 is used to log in to the unified identity authentication platform after the OTP dynamic token verification is successful, and to access the power grid dispatch cloud platform through the unified identity authentication platform.

[0091] In one embodiment, the device may further include: a user binding module, used to obtain user information of a user and send the user information to a server to be configured, so that the server to be configured can bind the user information and the imported seed key to obtain a configured OTP server.

[0092] In one embodiment, the request receiving module 401 is further configured to: generate a time factor based on the receiving time of the cloud platform access request; identify the user information of the current user based on the cloud platform access request; and match the corresponding target seed key based on the user information of the current user; and calculate the account password and OTP dynamic token using the SM3 algorithm based on the time factor and the target seed key.

[0093] In one embodiment, the power grid dispatch cloud platform includes an operation and maintenance console and an operation console. The login access module 403 is also used to determine the platform to be accessed in the operation and maintenance console and the operation console in response to the current user's platform selection instruction; and to log in to the platform to be accessed on the unified identity authentication platform through the SAML protocol to access the platform.

[0094] In one embodiment, the device may further include: a failure statistics module, used to reject the access request and update the current user's account's cumulative number of verification failures within a preset time window if the account password or OTP dynamic token verification fails; and to cancel the account's login privileges within the preset time window if the cumulative number of verification failures exceeds a threshold.

[0095] In one embodiment, the device may further include: an operation recording module, used to record the operation information of this access to the power grid dispatch cloud platform when the access request is approved; and to match the target information entry in the information database according to the username and enter the operation information into the target information entry.

[0096] The modules in the access authentication device of the aforementioned power grid dispatch cloud platform can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0097] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 5As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements an access authentication method for a power grid dispatch cloud platform. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0098] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0099] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0100] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0101] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0102] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0103] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0104] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0105] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An access authentication method for a power grid dispatch cloud platform, characterized in that, Applied to the login terminal, the method includes: In response to the current user's access request to the power grid dispatch cloud platform, the access request is sent to the configured OTP server, so that the OTP server can generate an account password and an OTP dynamic token based on the access request. Obtain the username of the current user, and receive the account password and OTP dynamic token returned by the OTP server. Package the username, the account password and the OTP dynamic token and send them to the unified identity authentication platform. The unified identity authentication platform verifies the account password based on the username. If the account password is verified, send the OTP dynamic token to the OTP server. The OTP server verifies the OTP dynamic token. Log in to the unified identity authentication platform after the OTP dynamic token verification is successful, and access the power grid dispatch cloud platform through the unified identity authentication platform.

2. The method according to claim 1, characterized in that, The response prior to the current user's access request to the power grid dispatch cloud platform also includes: Obtain the user's information and send it to the server to be configured, so that the server to be configured can bind the user information and the imported seed key to obtain the configured OTP server.

3. The method according to claim 2, characterized in that, The OTP server generates an account password and an OTP dynamic token based on the access request, including: The OTP server generates a time factor based on the time the access request is received, identifies the user information of the current user based on the access request, and matches the corresponding target seed key based on the user information of the current user. The account password and the OTP dynamic token are calculated using the SM3 algorithm based on the time factor and the target seed key.

4. The method according to claim 1, characterized in that, The power grid dispatch cloud platform includes an operation and maintenance console and an operation console. Accessing the power grid dispatch cloud platform through the unified identity authentication platform includes: In response to the current user's platform selection instruction, the platform to be accessed is determined in the maintenance console and the operation console; On the unified identity authentication platform, single sign-on via the SAML protocol is used to access the platform to be accessed.

5. The method according to claim 1, characterized in that, The method further includes: If the account password or the OTP dynamic token verification fails, the access request will be rejected and the cumulative number of verification failures for the current user's account within a preset time window will be updated. If the cumulative number of verification failures exceeds a threshold, the account's login privileges will be revoked within the preset time window.

6. The method according to any one of claims 1 to 5, characterized in that, The method further includes: If the access request is approved, record the operation information for this access to the power grid dispatch cloud platform; The target information entry is matched with the username in the database, and the operation information is entered into the target information entry.

7. An access authentication device for a power grid dispatch cloud platform, characterized in that, The device includes: The request receiving module is used to respond to the current user's access request to the power grid dispatch cloud platform and send the access request to the configured OTP server so that the OTP server can generate an account password and an OTP dynamic token according to the access request. The information verification module is used to obtain the username of the current user, receive the account password and the OTP dynamic token returned by the OTP server, package the username, the account password and the OTP dynamic token and send them to the unified identity authentication platform. The unified identity authentication platform verifies the account password based on the username. If the account password is verified, the OTP dynamic token is sent to the OTP server and verified by the OTP server. The login access module is used to log in to the unified identity authentication platform and access the power grid dispatch cloud platform through the unified identity authentication platform when the OTP dynamic token verification is successful.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images