Power grid dispatching cloud platform access authentication method and device based on a bastion host, equipment, storage medium and program product

Abstract

The application relates to a bastion machine-based power grid dispatching cloud platform access authentication method and device, equipment, a storage medium and a program product, and relates to the technical field of information security. The method can reduce the security risks existing when remotely accessing the power grid dispatching cloud platform, and efficiently stores operation information. The method comprises the following steps: sending an access request of a current user to a configured OTP server, so that the OTP server generates a password password and a detection token according to the access request; obtaining a username of the current user, and receiving the password password and the detection token returned by the OTP server; the username, the password password and the detection token are packaged and sent to a bastion machine, the bastion machine verifies the detection token according to the username, in the case that the detection token verification is passed, the bastion machine sends the password password to the OTP server, and the OTP server verifies the password password; in the case that the password password verification is passed, the bastion machine is logged in, and the power grid dispatching cloud platform is accessed through the bastion machine.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to an access authentication method, device, computer equipment, computer-readable storage medium, and computer program product for a power grid dispatch cloud platform based on a bastion host. Background Technology

[0002] With the expansion of the power grid and the trend of digital transformation in power companies, the demand for anytime, anywhere access to the power grid dispatch cloud platform continues to increase. By using methods such as bastion hosts, information channels can be established between personal clients and the power grid dispatch cloud platform on public networks, enabling cloud platform operation and maintenance personnel to conveniently access the platform.

[0003] However, current methods for accessing important data platforms such as power grid dispatch cloud platforms through bastion hosts have shortcomings such as insufficient authentication factors and unknown login terminal security, resulting in significant security risks when remotely accessing power grid dispatch cloud platforms using current technologies. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, device, computer equipment, computer-readable storage medium, and computer program product for access authentication of a power grid dispatch cloud platform based on a bastion host, in order to address the above-mentioned technical problems.

[0005] Firstly, this application provides an access authentication method for a power grid dispatch cloud platform based on a bastion host, including:

[0006] In response to the current user's access request to the power grid dispatch cloud platform, the access request is sent to the configured OTP server, so that the OTP server can generate a password and a detection token according to the access request and hash algorithm, and return the password and the detection token to the operation and maintenance terminal.

[0007] The current user's username, password, and detection token are packaged and sent to the bastion host. The bastion host verifies the detection token based on the username. If the detection token is verified, the bastion host sends the password to the OTP server, which then verifies the password.

[0008] Log in to the bastion host after the password verification is successful, and access the platform to be accessed in the power grid dispatch cloud platform through the bastion host;

[0009] If the access request is approved, the operation information of this access to the power grid dispatch cloud platform is recorded, the target information entry in the information database is matched according to the username, and the operation information is entered into the target information entry.

[0010] In one embodiment, the response to the current user's access request to the power grid dispatch cloud platform further includes:

[0011] Obtain the user's information and send it to the server to be configured, so that the server to be configured can bind the user information and the imported seed key to obtain the configured OTP server.

[0012] In one embodiment, the OTP server generates a password and a detection token based on the access request and a hash algorithm, including:

[0013] The OTP server generates a time factor based on the time of receiving the access request, identifies the user information of the current user based on the access request, and matches the corresponding target seed key based on the user information of the current user; the password and the detection token are calculated using the SM3 algorithm based on the time factor and the target seed key.

[0014] In one embodiment, the power grid dispatch cloud platform includes a cloud platform deployment server, a cloud platform database, and a cloud platform log server. Accessing the platform to be accessed within the power grid dispatch cloud platform via the bastion host includes:

[0015] In response to the current user's platform selection instruction, the platform to be accessed is determined from the platform deployment server, the cloud platform database, and the cloud platform log server; the user then logs in to the platform to be accessed via SSH on the bastion host.

[0016] In one embodiment, the method further includes:

[0017] If the password or OTP detection token verification fails, the access request is rejected and the current user's account is updated with the cumulative number of verification failures within a preset time window; if the cumulative number of verification failures exceeds the threshold, the account's login privileges within the preset time window are revoked.

[0018] In one embodiment, before sending the current user's username, password, and detection token to the bastion host, the method further includes:

[0019] Obtain the username of the current user, and receive the password and detection token returned by the OTP server.

[0020] Secondly, this application also provides an access authentication device for a power grid dispatch cloud platform based on a bastion host, comprising:

[0021] The request receiving module is used to respond to the current user's access request for the power grid dispatch cloud platform, send the access request to the configured OTP server, so that the OTP server can generate a password and a detection token according to the access request and a hash algorithm, and return the password and the detection token to the operation and maintenance terminal.

[0022] The information verification module is used to package the current user's username, password, and detection token and send them to the bastion host. The bastion host verifies the detection token based on the username. If the detection token is verified, the bastion host sends the password to the OTP server, and the OTP server verifies the password.

[0023] The login access module is used to log in to the bastion host when the password verification is successful, and to access the platform to be accessed in the power grid dispatch cloud platform through the bastion host.

[0024] The operation recording module is used to record the operation information of this access to the power grid dispatch cloud platform when the access request is approved, match the target information entry in the information database according to the username, and enter the operation information into the target information entry.

[0025] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0026] In response to the current user's access request to the power grid dispatch cloud platform, the access request is sent to a configured OTP server. The OTP server generates a password and a detection token based on the access request and a hash algorithm, and returns the password and the detection token to the operation and maintenance terminal. The current user's username, the password, and the detection token are packaged and sent to a bastion host. The bastion host verifies the detection token based on the username. If the detection token is verified, the bastion host sends the password to the OTP server, which verifies the password. If the password is verified, the user logs into the bastion host and accesses the platform to be accessed in the power grid dispatch cloud platform through the bastion host. If the access request is successful, the operation information of this access to the power grid dispatch cloud platform is recorded. The target information entry in the information database is matched according to the username, and the operation information is entered into the target information entry.

[0027] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0028] In response to the current user's access request to the power grid dispatch cloud platform, the access request is sent to a configured OTP server. The OTP server generates a password and a detection token based on the access request and a hash algorithm, and returns the password and the detection token to the operation and maintenance terminal. The current user's username, the password, and the detection token are packaged and sent to a bastion host. The bastion host verifies the detection token based on the username. If the detection token is verified, the bastion host sends the password to the OTP server, which verifies the password. If the password is verified, the user logs into the bastion host and accesses the platform to be accessed in the power grid dispatch cloud platform through the bastion host. If the access request is successful, the operation information of this access to the power grid dispatch cloud platform is recorded. The target information entry in the information database is matched according to the username, and the operation information is entered into the target information entry.

[0029] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0030] In response to the current user's access request to the power grid dispatch cloud platform, the access request is sent to a configured OTP server. The OTP server generates a password and a detection token based on the access request and a hash algorithm, and returns the password and the detection token to the operation and maintenance terminal. The current user's username, the password, and the detection token are packaged and sent to a bastion host. The bastion host verifies the detection token based on the username. If the detection token is verified, the bastion host sends the password to the OTP server, which verifies the password. If the password is verified, the user logs into the bastion host and accesses the platform to be accessed in the power grid dispatch cloud platform through the bastion host. If the access request is successful, the operation information of this access to the power grid dispatch cloud platform is recorded. The target information entry in the information database is matched according to the username, and the operation information is entered into the target information entry.

[0031] The aforementioned bastion host-based power grid dispatch cloud platform access authentication method, device, computer equipment, computer-readable storage medium, and computer program product receive a password and detection token generated by an OTP server, package the current user's username, password, and detection token, and send them to the bastion host. The bastion host verifies the detection token based on the username. If the detection token is verified, the password is sent to the OTP server for verification. If the password is verified, the user logs into the bastion host and accesses the power grid dispatch cloud platform through the bastion host. Simultaneously, the operation information for this power grid dispatch cloud platform access is recorded and entered into the corresponding target information entry in the information database. This application employs a dual authentication mechanism combining password and verification tokens to accurately verify the legality and compliance of user access behavior, overcoming the shortcomings of traditional technologies such as insufficient authentication factors and unknown login terminal security. After logging into the bastion host through dual authentication, the user then connects to the power grid dispatch cloud platform through the bastion host. All operations in this way are strictly controlled and audited by the bastion host, thereby improving the authenticity of entity authentication and the security of network communication, and reducing the security risks associated with remote access to the power grid dispatch cloud platform. Furthermore, this application can record the operation information of the power grid dispatch cloud platform access when the access request is approved. It matches the target information entry in the database based on the username and enters the operation information into the target information entry. This uses each user's username as a identifier and systematically records each user's operation information into the database, facilitating efficient storage and subsequent use of operation information. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 This is an application environment diagram of a power grid dispatch cloud platform access authentication method based on a bastion host in one embodiment;

[0034] Figure 2 This is a flowchart illustrating an access authentication method for a power grid dispatch cloud platform based on a bastion host in one embodiment.

[0035] Figure 3 This is a flowchart illustrating an access authentication method for a power grid dispatch cloud platform based on a bastion host, as shown in a specific embodiment.

[0036] Figure 4This is a structural block diagram of an access authentication device for a power grid dispatch cloud platform based on a bastion host, as shown in one embodiment.

[0037] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0038] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0039] The bastion host-based power grid dispatch cloud platform access authentication method provided in this application embodiment can be applied to, for example... Figure 1 The application environment shown is as follows. In this environment, the maintenance terminal can communicate with the bastion host via the network, the bastion host communicates with the power grid dispatching platform, and the OTP server communicates with both the bastion host and the maintenance terminal.

[0040] Specifically, the power grid dispatch cloud platform access authentication method based on a bastion host provided in this application embodiment can be executed by the operation and maintenance terminal.

[0041] For example, in response to a current user's access request to the power grid dispatch cloud platform, the operation and maintenance terminal sends the access request to a configured OTP server. The OTP server generates a password and a verification token based on the access request and a hash algorithm, and returns the password and verification token to the operation and maintenance terminal. The operation and maintenance terminal packages the current user's username, password, and verification token and sends them to the bastion host. The bastion host verifies the verification token based on the username. If the verification token is successful, the bastion host sends the password to the OTP server, which verifies the password. If the password is successfully verified, the operation and maintenance terminal logs into the bastion host and accesses the platform to be accessed in the power grid dispatch cloud platform through the bastion host. If the access request is successful, the operation and maintenance terminal records the operation information of this access to the power grid dispatch cloud platform, matches the target information entry in the information database according to the username, and enters the operation information into the target information entry.

[0042] In such Figure 1 In the application environment shown, the operation and maintenance terminal can be, but is not limited to, various personal computers, laptops, smartphones, and tablets. An OTP server can be implemented using a standalone OTP server or an OTP server cluster composed of multiple OTP servers. A bastion host is a special server used to enhance network security, typically for protecting internal networks and granting administrative privileges. The power grid dispatching cloud platform consists of a cloud platform deployment server, a cloud platform database, and a cloud platform log server.

[0043] In one embodiment, such as Figure 2 As shown, a bastion host-based access authentication method for a power grid dispatch cloud platform is provided. This method can be applied to... Figure 1 The method may include the following steps:

[0044] Step S201: In response to the current user's access request to the power grid dispatch cloud platform, the access request is sent to the configured OTP server, so that the OTP server can generate a password and a detection token according to the access request and hash algorithm, and return the password and detection token to the operation and maintenance terminal.

[0045] An authentication token, also known as an OTP authentication token, is a security measure used for identity verification. It is typically used to ensure the security of online transactions, logins, or access to sensitive information. OTP authentication tokens generate one-time passwords that are valid for a short period and change with each login, thus enhancing system security.

[0046] Passwords are a method of identity verification used to protect user account security.

[0047] Specifically, in response to the current user's access request to the power grid dispatch cloud platform, the operation and maintenance terminal sends the access request to the configured OTP server, so that the OTP server can generate a password and a detection token based on the access request and hash algorithm, and return the password and detection token to the operation and maintenance terminal.

[0048] Step S202: The current user's username, password, and detection token are packaged and sent to the bastion host. The bastion host verifies the detection token based on the username. If the detection token is verified, the bastion host sends the password to the OTP server, which then verifies the password.

[0049] The username can refer to a unique name used to identify a user in a system or platform, and it is usually used together with a password for user authentication.

[0050] A bastion host is an important component of a network, primarily used to securely manage access to other computers or servers on the network. It acts like a "stepping stone," allowing secure access to servers located within firewalls or intranets, avoiding direct exposure of sensitive systems.

[0051] Specifically, the operation and maintenance terminal packages the current user's username, password, and detection token and sends them to the bastion host. The bastion host then verifies the detection token based on the username. If the detection token is verified, the bastion host sends the password to the OTP server, which then verifies the password.

[0052] Step S203: Log in to the bastion host after the password verification is successful, and access the platform to be accessed in the power grid dispatch cloud platform through the bastion host.

[0053] Specifically, after the operation and maintenance terminal recognizes that the password verification is successful, it logs into the bastion host via the HTTPS protocol (HyperText Transfer Protocol Secure) and accesses the platform to be accessed in the power grid dispatch cloud platform through the bastion host.

[0054] HTTPS is a security protocol based on HTTP (Hypertext Transfer Protocol) used to securely transmit data over the Internet. It combines SSL / TLS (Secure Sockets Layer / Transport Layer Security) encryption protocols to ensure the confidentiality and integrity of data transmitted between clients and servers.

[0055] Step S204: If the access request is approved, record the operation information of this access to the power grid dispatch cloud platform, match the target information entry in the information database according to the username, and enter the operation information into the target information entry.

[0056] Among them, operation information can be related information generated when users perform various operations on the power grid dispatch cloud platform, such as information query, username change, etc.

[0057] Information entries generally refer to short units of information arranged according to certain rules in a book, document, database, or encyclopedia, similar to a title or section.

[0058] Specifically, when the access request is approved, the operation and maintenance terminal records the operation information of this access to the power grid dispatch cloud platform. It matches the target information entry in the information database according to the username and enters the operation information into the target information entry. In this way, each user's username is used as a identifier, and the operation information table of each user is entered into the information database in an orderly manner, which is conducive to the efficient storage and utilization of operation information.

[0059] In this embodiment, the user's username, password, and detection token are packaged and sent to the bastion host upon receiving the password and detection token generated by the OTP server. The bastion host verifies the detection token based on the username. If the detection token is verified, the password is sent to the OTP server for verification. Upon successful password verification, the user logs into the bastion host and accesses the power grid dispatch cloud platform. Simultaneously, the operation information for this access to the power grid dispatch cloud platform is recorded and entered into the corresponding target information entry in the database. This application employs a password + detection token authentication mechanism for dual verification of the user, accurately verifying the legality and compliance of the user's access behavior. This overcomes the shortcomings of traditional technologies, such as insufficient authentication factors and unknown login terminal security. After logging into the bastion host through dual verification, the user then connects to the power grid dispatch cloud platform through the bastion host. All operations are strictly controlled and audited by the bastion host, thereby improving the authenticity of entity authentication and the security of network communication, and reducing the security risks associated with remote access to the power grid dispatch cloud platform. In addition, this application can also record the operation information of this access to the power grid dispatch cloud platform when the access request is approved, match the target information entry in the information database according to the username, and enter the operation information into the target information entry. In this way, the user's username is used as a distinguishing identifier, and the operation information table of each user is entered into the information database in an orderly manner, which is conducive to the efficient storage and utilization of operation information.

[0060] In one embodiment, before responding to the current user's access request for the power grid dispatch cloud platform, the method of this application further includes the following steps:

[0061] Obtain the user's information and send it to the server to be configured. The server will then bind the user information and the imported seed key to obtain the configured OTP server.

[0062] Users can be maintenance and operation personnel of power companies.

[0063] User information typically includes a series of data used to identify and describe users, such as: basic personal information (name and age, etc.), account information (username, account status and level permissions, etc.), and identity verification information (ID card number, facial information and fingerprint information, etc.).

[0064] The seed key is typically an initial value used in encryption, algorithm generation, and random number generation. Its main function is to provide the initial input for generating random numbers or the output of encryption algorithms. The seed key can be injected by the manufacturer during the production of OTP detection token hardware.

[0065] Specifically, the operation and maintenance terminal obtains the user's user information and sends it to the server to be configured, so that the server to be configured can bind the user information and the imported seed key to obtain the configured OTP server, thereby completing the initial user configuration.

[0066] In one embodiment, the OTP server in step S201 generates a password and a verification token based on the access request and a hash algorithm, which may include the following steps:

[0067] The OTP server generates a time factor based on the time the access request is received, identifies the current user's information based on the access request, and matches the corresponding target seed key based on the current user's information. The password and detection token are calculated using the SM3 algorithm based on the time factor and the target seed key.

[0068] The SM3 algorithm is a hash algorithm, part of China's national cryptographic algorithms, and is mainly used for data integrity protection, digital signatures, and message authentication. The SM3 algorithm is similar in function to international standard hash algorithms (such as SHA-256), both being cryptographic hash functions used to generate fixed-length hash values.

[0069] Specifically, the OTP server generates a time factor based on the time of receiving the cloud platform access request, identifies the current user's information based on the cloud platform access request, and matches the corresponding target seed key based on the current user's information; the password and OTP detection token are calculated using the SM3 algorithm based on the time factor and the target seed key.

[0070] In one embodiment, the power grid dispatch cloud platform includes a cloud platform deployment server, a cloud platform database, and a cloud platform log server. Step S203, accessing the power grid dispatch cloud platform via a bastion host, may include the following steps:

[0071] In response to the current user's platform selection command, the platform to be accessed is determined from the platform deployment server, cloud platform database, and cloud platform log server; the platform to be accessed is then accessed via SSH (Secure Shell) protocol on the bastion host.

[0072] SSH is a network communication protocol designed to securely access remote computers over an insecure network. It provides an encrypted communication channel for managing remote systems, transferring files, and executing commands.

[0073] Among these features, cloud platform deployment servers can be quickly created and deployed using virtual machine instances provided by cloud service providers, supporting automation and elastic scaling. Cloud platform databases can choose managed relational or non-relational database services, simplifying database management, expansion, and backup. Cloud platform log servers can use the log management tools provided by the cloud platform to collect, store, analyze, and visualize log data, improving system monitoring and troubleshooting capabilities.

[0074] Specifically, in response to the current user's platform selection command, the operation and maintenance terminal determines the platform to be accessed from the platform deployment server, cloud platform database, and cloud platform log server; and logs the platform to be accessed on the bastion host via SSH single sign-on to access the platform.

[0075] In one embodiment, the method of this application further includes the following steps:

[0076] If the password or OTP token verification fails, the access request is rejected and the current user's account is updated with the cumulative number of verification failures within a preset time window; if the cumulative number of verification failures exceeds the threshold, the account's login privileges are revoked within the preset time window.

[0077] Account login permissions refer to the operations and access rights that users have when using an account. These permissions are usually set and assigned by the account administrator or system administrator to ensure that users can only perform the operations they need and to protect the security of the account and the system.

[0078] Specifically, if the operation and maintenance terminal fails to verify the password or OTP detection token, it rejects the access request and updates the current user's account's cumulative number of verification failures within a preset time window; if the cumulative number of verification failures exceeds the threshold, it cancels the account's login privileges within the preset time window. This can effectively identify abnormal user logins and help increase the security of user authentication.

[0079] In one embodiment, before sending the current user's username, password, and detection token to the bastion host, the method of this application further includes the following steps:

[0080] Get the current user's username and receive the password and verification token returned by the OTP server.

[0081] Specifically, the operation and maintenance terminal obtains the username entered by the current user through a preset username input window, and receives the password and detection token returned by the OTP server.

[0082] In one embodiment, such as Figure 3As shown, a specific embodiment of an access authentication method for a power grid dispatch cloud platform based on a bastion host is provided, which specifically includes the following steps:

[0083] Step S301: Obtain the user's user information and send the user information to the server to be configured so that the server to be configured can bind the user information and the imported seed key to obtain the configured OTP server.

[0084] Step S302: In response to the current user's access request to the power grid dispatch cloud platform, the access request is sent to the configured OTP server, so that the OTP server can generate a time factor based on the reception time of the access request, identify the current user's user information based on the access request, and match the corresponding target seed key based on the current user's user information; and calculate the password and OTP detection token using the SM3 algorithm based on the time factor and the target seed key.

[0085] Step S303: Obtain the current user's username, and receive the password and OTP detection token returned by the OTP server. Package the username, password, and OTP detection token and send them to the bastion host. The bastion host verifies the detection token based on the username. If the detection token is verified, the bastion host sends the password to the OTP server, and the OTP server verifies the password.

[0086] Step S304: Log in to the bastion host after the password verification is successful. In response to the current user's platform selection command, determine the platform to be accessed from the platform deployment server, cloud platform database, and cloud platform log server. Log in to the platform to be accessed on the bastion host via SSH protocol to access the platform.

[0087] Step S305: If the access request is approved, record the operation information of this access to the power grid dispatch cloud platform; match the target information entry in the information database according to the username, and enter the operation information into the target information entry.

[0088] The beneficial effects of the above embodiments are as follows:

[0089] 1) By using national cryptographic algorithms and a password + detection token authentication mechanism to perform dual verification on users, it is possible to accurately verify whether the user's access behavior is legal and compliant, making up for the shortcomings of traditional technologies such as insufficient authentication factors and unknown login security.

[0090] 2) Users first access the bastion host through security authentication, and then connect to the power grid dispatch cloud platform through the bastion host. In this way, all operations are strictly controlled and audited by the bastion host, thereby improving the authenticity of entity authentication and the security of network communication, and reducing the security risks when remotely accessing the power grid dispatch cloud platform.

[0091] 3) Each user's username is used as a identifier, and the user's operation information is entered into the corresponding information entry in the information database in an orderly manner, which is conducive to the efficient storage and subsequent use of operation information.

[0092] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0093] Based on the same inventive concept, this application also provides a bastion host-based power grid dispatching cloud platform access authentication device for implementing the aforementioned bastion host-based power grid dispatching cloud platform access authentication method. The solution provided by this device is similar to the implementation described in the above method. Therefore, the specific limitations in one or more bastion host-based power grid dispatching cloud platform access authentication device embodiments provided below can be found in the limitations of the bastion host-based power grid dispatching cloud platform access authentication method described above, and will not be repeated here.

[0094] In one exemplary embodiment, such as Figure 4 As shown, a bastion host-based access authentication device for a power grid dispatch cloud platform is provided. This device may include:

[0095] The request receiving module 401 is used to respond to the current user's access request to the power grid dispatch cloud platform, send the access request to the configured OTP server, so that the OTP server can generate a password and a detection token according to the access request and hash algorithm, and return the password and detection token to the operation and maintenance terminal.

[0096] The information verification module 402 is used to package the current user's username, password, and detection token and send them to the bastion host. The bastion host verifies the detection token based on the username. If the detection token is verified, the bastion host sends the password to the OTP server, and the OTP server verifies the password.

[0097] The login access module 403 is used to log in to the bastion host after the password verification is successful, and to access the platform to be accessed in the power grid dispatch cloud platform through the bastion host.

[0098] The operation recording module 404 is used to record the operation information of this access to the power grid dispatch cloud platform when the access request is approved, match the target information entry in the information database according to the username, and enter the operation information into the target information entry.

[0099] In one embodiment, the device may further include: a user binding module, used to obtain user information of a user and send the user information to a server to be configured, so that the server to be configured can bind the user information and the imported seed key to obtain a configured OTP server.

[0100] In one embodiment, the request receiving module 401 is further configured to: generate a time factor based on the time of receiving the access request; identify the user information of the current user based on the access request; and match the corresponding target seed key based on the user information of the current user; and calculate the password and detection token using the SM3 algorithm based on the time factor and the target seed key.

[0101] In one embodiment, the power grid dispatch cloud platform includes a cloud platform deployment server, a cloud platform database, and a cloud platform log server. The login access module 403 is also used to respond to the current user's platform selection instruction, determine the platform to be accessed from the platform deployment server, the cloud platform database, and the cloud platform log server, and log in to the platform to be accessed on the bastion host via the SSH protocol.

[0102] In one embodiment, the device may further include: a failure statistics module, used to reject the access request and update the current user's account's cumulative number of verification failures within a preset time window if the password or OTP detection token verification fails; and to cancel the account's login privileges within the preset time window if the cumulative number of verification failures exceeds a threshold.

[0103] In one embodiment, the device may further include: an information receiving module, used to obtain the username of the current user and receive the password and detection token returned by the OTP server.

[0104] The modules in the aforementioned bastion host-based power grid dispatch cloud platform access authentication device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0105] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 5 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, Near Field Communication (NFC), or other technologies. When the computer program is executed by the processor, it implements an access authentication method for a power grid dispatch cloud platform. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0106] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0107] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0108] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0109] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0110] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0111] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0112] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0113] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for access authentication in a power grid dispatch cloud platform based on a bastion host, characterized in that, Applied to operation and maintenance terminals, the method includes: In response to the current user's access request to the power grid dispatch cloud platform, the access request is sent to the configured OTP server, so that the OTP server can generate a password and a detection token according to the access request and hash algorithm, and return the password and the detection token to the operation and maintenance terminal. The current user's username, password, and detection token are packaged and sent to the bastion host. The bastion host verifies the detection token based on the username. If the detection token is verified, the bastion host sends the password to the OTP server, which then verifies the password. Log in to the bastion host after the password verification is successful, and access the platform to be accessed in the power grid dispatch cloud platform through the bastion host; If the access request is approved, the operation information of this access to the power grid dispatch cloud platform is recorded, the target information entry in the information database is matched according to the username, and the operation information is entered into the target information entry.

2. The method according to claim 1, characterized in that, The response prior to the current user's access request to the power grid dispatch cloud platform also includes: Obtain the user's information and send it to the server to be configured, so that the server to be configured can bind the user information and the imported seed key to obtain the configured OTP server.

3. The method according to claim 2, characterized in that, The OTP server generates a password and a verification token based on the access request and a hash algorithm, including: The OTP server generates a time factor based on the time the access request is received, identifies the user information of the current user based on the access request, and matches the corresponding target seed key based on the user information of the current user. The password and the detection token are calculated using the SM3 algorithm based on the time factor and the target seed key.

4. The method according to claim 1, characterized in that, The power grid dispatch cloud platform includes a cloud platform deployment server, a cloud platform database, and a cloud platform log server. Accessing the platform to be accessed within the power grid dispatch cloud platform via the bastion host includes: In response to the current user's platform selection instruction, the platform to be accessed is determined from the platform deployment server, the cloud platform database, and the cloud platform log server; The user can access the platform to be accessed by single sign-on via SSH on the bastion host.

5. The method according to claim 1, characterized in that, The method further includes: If the password or OTP detection token fails to verify, the access request is rejected and the current user's account is updated with the cumulative number of verification failures within a preset time window. If the cumulative number of verification failures exceeds a threshold, the account's login privileges will be revoked within the preset time window.

6. The method according to any one of claims 1 to 5, characterized in that, Before sending the current user's username, password, and detection token to the bastion host, the process further includes: Obtain the username of the current user, and receive the password and detection token returned by the OTP server.

7. A power grid dispatch cloud platform access authentication device based on a bastion host, characterized in that, The device, applied to maintenance terminals, includes: The request receiving module is used to respond to the current user's access request for the power grid dispatch cloud platform, send the access request to the configured OTP server, so that the OTP server can generate a password and a detection token according to the access request and a hash algorithm, and return the password and the detection token to the operation and maintenance terminal. The information verification module is used to package the current user's username, password, and detection token and send them to the bastion host. The bastion host verifies the detection token based on the username. If the detection token is verified, the bastion host sends the password to the OTP server, and the OTP server verifies the password. The login access module is used to log in to the bastion host when the password verification is successful, and to access the platform to be accessed in the power grid dispatch cloud platform through the bastion host. The operation recording module is used to record the operation information of this access to the power grid dispatch cloud platform when the access request is approved, match the target information entry in the information database according to the username, and enter the operation information into the target information entry.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images