Data processing method, device and equipment of power grid dispatching cloud platform, storage medium and program product

Abstract

The invention relates to a data processing method and device of a power grid dispatching cloud platform, computer equipment, a computer readable storage medium and a computer program product. The method comprises the steps of obtaining user security data of a target service; encrypting the user security data to obtain user security ciphertext data corresponding to the user security data, and calculating a message authentication code of the user security ciphertext data; in response to a data calling request for the user security data, obtaining user security ciphertext data and a message authentication code corresponding to the user security data to be called; performing integrity verification on the user security ciphertext data according to the message authentication code; under the condition that the integrity verification is passed, decrypting the user security ciphertext data to obtain to-be-called user security data; and response information corresponding to the data calling request is obtained according to the to-be-called user security data, and the response information is provided for the data calling party. By adopting the method, the safety and reliability of the power grid dispatching cloud platform can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information technology, and in particular, to a data processing method and device of a power grid dispatching cloud platform, computer equipment, a computer readable storage medium, and a computer program product. BACKGROUND

[0002] With the increasing maturity of cloud computing technology, cloud platforms are applied in various application scenarios such as power grid dispatching. Users can achieve efficient and flexible use of computing resources and application services through the power grid dispatching cloud platform. In order to provide the services required by users, the power grid dispatching cloud platform usually needs to store and process a large amount of user security data. However, the user security data of the power grid dispatching cloud platform is at risk of being leaked or tampered with and destroyed during storage and use, which easily leads to the security of the power grid dispatching cloud platform being threatened. SUMMARY

[0003] Therefore, it is necessary to provide a data processing method and device of a power grid dispatching cloud platform, computer equipment, a computer readable storage medium, and a computer program product to solve the above technical problems.

[0004] In a first aspect, the present application provides a data processing method of a power grid dispatching cloud platform, comprising:

[0005] obtaining user security data of a target service;

[0006] encrypting the user security data to obtain user security ciphertext data corresponding to the user security data, and calculating a message authentication code of the user security ciphertext data;

[0007] in response to a data call request for the user security data, obtaining user security ciphertext data and a message authentication code corresponding to the user security data to be called;

[0008] performing integrity verification on the user security ciphertext data according to the message authentication code;

[0009] decrypting the user security ciphertext data to obtain the user security data to be called if the integrity verification of the user security ciphertext data is passed;

[0010] obtaining response information corresponding to the data call request according to the user security data to be called, and providing the response information to a data caller.

[0011] In one of the embodiments, the encrypting the user security data to obtain user security ciphertext data corresponding to the user security data, and calculating a message authentication code of the user security ciphertext data comprises: encrypting the user security data by using a cipher block chaining mode of the SM4 algorithm to obtain user security ciphertext data; and calculating the message authentication code of the user security ciphertext data by using a hash operation message authentication code algorithm based on the SM3 hash function.

[0012] In one of the embodiments, the method further comprises: obtaining target audit data of a target service; generating a key corresponding to the target audit data; encrypting the target audit data according to the key by using a Galois counter mode of the SM4 algorithm to obtain audit ciphertext data, an authentication tag and an initialization vector corresponding to the target audit data; and storing the audit ciphertext data, the authentication tag and the initialization vector in association.

[0013] In one of the embodiments, the method further comprises: in response to a calling request for the target audit data, obtaining audit ciphertext data, an authentication tag and an initialization vector corresponding to the target audit data to be called, and obtaining a key corresponding to the target audit data to be called; decrypting the audit ciphertext data and verifying the authentication tag by using the Galois counter mode of the SM4 algorithm according to the key and the initialization vector; and in the case that the authentication tag is verified, providing the target audit data obtained by decrypting the audit ciphertext data to a data caller.

[0014] In one of the embodiments, the method further comprises: obtaining mirror data of a target service; signing a digest value of the mirror data by using a first key to obtain a digital signature corresponding to the mirror data; in response to a service deployment request for the target service, providing the mirror data, the digital signature corresponding to the mirror data and a second key corresponding to the first key to a service deployer; and the second key is used for the service deployer to verify the digital signature of the mirror data.

[0015] In one of the embodiments, the signing the digest value of the mirror data by using the first key to obtain the digital signature corresponding to the mirror data comprises: calculating the digest value of the mirror data by using the SM3 algorithm; and signing the digest value by using the SM2 algorithm to obtain the digital signature corresponding to the mirror data.

[0016] In a second aspect, the application further provides a data processing device of a power grid dispatching cloud platform, comprising:

[0017] A first obtaining module is configured to obtain user security data of a target service.

[0018] encrypting the user security data to obtain user security ciphertext data corresponding to the user security data, and calculating a message authentication code of the user security ciphertext data;

[0019] The second obtaining module is configured to, in response to a data invocation request for the user security data, obtain user security ciphertext data and a message authentication code corresponding to the user security data to be invoked;

[0020] The data verification module is configured to perform integrity verification on the user security ciphertext data according to the message authentication code;

[0021] The data decryption module is configured to, in the case that the integrity verification of the user security ciphertext data is passed, decrypt the user security ciphertext data to obtain the user security data to be invoked;

[0022] The data providing module is configured to obtain response information corresponding to the data invocation request according to the user security data to be invoked, and provide the response information to a data invoker.

[0023] In a third aspect, the present application further provides a computer device, comprising a memory and a processor, the memory stores a computer program, and the processor realizes the following steps when executing the computer program:

[0024] obtaining user security data of a target service;

[0025] encrypting the user security data to obtain user security ciphertext data corresponding to the user security data, and calculating a message authentication code of the user security ciphertext data;

[0026] in response to a data invocation request for the user security data, obtaining user security ciphertext data and a message authentication code corresponding to the user security data to be invoked;

[0027] performing integrity verification on the user security ciphertext data according to the message authentication code;

[0028] in the case that the integrity verification of the user security ciphertext data is passed, decrypting the user security ciphertext data to obtain the user security data to be invoked;

[0029] obtaining response information corresponding to the data invocation request according to the user security data to be invoked, and providing the response information to a data invoker.

[0030] In a fourth aspect, the present application further provides a computer readable storage medium, which stores a computer program, and the computer program realizes the following steps when executed by a processor:

[0031] obtaining user security data of a target service;

[0032] encrypting the user security data to obtain user security ciphertext data corresponding to the user security data, and calculating a message authentication code of the user security ciphertext data;

[0033] in response to a data call request for the user security data, obtaining user security ciphertext data corresponding to the user security data to be called and a message authentication code;

[0034] performing integrity verification on the user security ciphertext data according to the message authentication code;

[0035] decrypting the user security ciphertext data to obtain the user security data to be called in a case where the integrity verification on the user security ciphertext data is passed;

[0036] obtaining response information corresponding to the data call request according to the user security data to be called, and providing the response information to a data caller.

[0037] In a fifth aspect, the present application further provides a computer program product comprising a computer program which, when executed by a processor, implements the following steps:

[0038] obtaining user security data of a target service;

[0039] encrypting the user security data to obtain user security ciphertext data corresponding to the user security data, and calculating a message authentication code of the user security ciphertext data;

[0040] in response to a data call request for the user security data, obtaining user security ciphertext data corresponding to the user security data to be called and a message authentication code;

[0041] performing integrity verification on the user security ciphertext data according to the message authentication code;

[0042] decrypting the user security ciphertext data to obtain the user security data to be called in a case where the integrity verification on the user security ciphertext data is passed;

[0043] obtaining response information corresponding to the data call request according to the user security data to be called, and providing the response information to a data caller.

[0044] The data processing method and device of the power grid dispatching cloud platform, the computer device, the computer readable storage medium, and the computer program product, after obtaining the user security data of the target service, encrypt the user security data to obtain user security ciphertext data corresponding to the user security data, and calculate a message authentication code of the user security ciphertext data. In response to a data call request for the user security data, the user security ciphertext data and the message authentication code corresponding to the user security data to be called are obtained. Then, the integrity of the user security ciphertext data is verified according to the message authentication code, and the user security ciphertext data is decrypted in the case that the integrity verification of the user security ciphertext data is passed, to obtain the user security data to be called. Finally, the response information corresponding to the data call request is obtained according to the user security data to be called, and the response information is provided to the data calling party. According to the scheme, the user security data is encrypted and stored in the storage stage, which can effectively reduce the risk of leakage or damage of the user security data. By calculating the message authentication code of the user security data and verifying the message authentication code before decrypting the user security ciphertext data when the user security data is called, the integrity of the data can be verified in the use process of the user security data, so as to avoid using damaged or tampered user security data, which is beneficial to guarantee the security and reliability of the power grid dispatching cloud platform. BRIEF DESCRIPTION OF DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related art, the drawings needed to be used in the description of the embodiments of the present application or the related art will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other related drawings can be obtained by those skilled in the art without creative labor.

[0046] Figure 1 A flowchart of a data processing method of a power grid dispatching cloud platform in an embodiment;

[0047] Figure 2 A flowchart of processing target audit data in an embodiment;

[0048] Figure 3 A flowchart of responding to a call request for target audit data in an embodiment;

[0049] Figure 4 A flowchart of processing mirror data of a target service in an embodiment;

[0050] Figure 5 A block diagram of a data processing device of a power grid dispatching cloud platform in an embodiment;

[0051] Figure 6 Fig. 1 is a schematic diagram of an internal structure of a computer device according to an embodiment. DETAILED DESCRIPTION

[0052] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and should not be used to limit the present application.

[0053] It should be noted that the terms "first", "second", etc. used in the present application can be used to describe various objects, but these objects are not limited by these terms. These terms are only used to distinguish the first object from the second object. The terms "include" and "have" and any variations thereof used in the present application are intended to cover non-exclusive inclusion. The term "multiple" used in the present application refers to two or more. The term "and / or" used in the present application refers to one of the options or any combination of multiple options.

[0054] Specifically, the power grid dispatching cloud platform can include a plurality of services and components deployed in a cloud environment, for example, can include but not limited to an operation and maintenance console for operation and maintenance personnel, an operation console for operation personnel, an identity authentication service (IDaaS), a log service, a cloud password machine, etc. Among them, the operation and maintenance personnel and the operation personnel can be users, log in to the bastion host through the user terminal used by them, and then access the operation and maintenance console or the operation console through the browser of the user terminal in the Hypertext Transfer Protocol Secure (HTTPS) mode.

[0055] In one embodiment, as shown in Figure 1 A data processing method of a power grid dispatching cloud platform is provided, and the present embodiment is exemplified by the method applied to the power grid dispatching cloud platform. In the present embodiment, the method includes the following steps:

[0056] Step S101, obtaining user security data of a target service.

[0057] Specifically, the target service can be an application system service provided by the power grid dispatching cloud platform to the user, for example, can include but not limited to the operation and maintenance console, the operation console and other services. The user security data of the target service can include but not limited to the identity authentication data of the user of the target service, the user contact information, and the access control data of the target service to the user permissions of various types, etc.

[0058] The power grid dispatching cloud platform can process and store the user security data through an identity authentication service (IDaaS). For example, the IDaaS can obtain the corresponding user security data of a target service by synchronizing data with the target service, and the target service can also call the IDaaS to write user security data during user registration, creation, or update operations.

[0059] In step S102, the user security data is encrypted to obtain user security ciphertext data corresponding to the user security data, and a message authentication code of the user security ciphertext data is calculated.

[0060] After obtaining the user security data, a software password module interface can be called to encrypt the user security data using an encryption algorithm to obtain the corresponding user security ciphertext data. Then, the user security ciphertext data can be subjected to message authentication code calculation to protect the integrity of the user security ciphertext data. Thus, the user security data can be stored in the power grid dispatching cloud platform in an encrypted form.

[0061] In step S103, in response to a data call request for the user security data, the user security ciphertext data and the message authentication code corresponding to the user security data to be called are obtained.

[0062] The data call request for the user security data can be used to request the use or access of the user security data, and the corresponding data caller can be a service in the cloud platform or a user terminal. The user security data to be called can include data corresponding to one or more users, or the security data of users in a specific range for a target service.

[0063] After receiving the data call request for the user security data, the power grid dispatching cloud platform determines the user security data to be called according to the data call request, and obtains the corresponding user security ciphertext data and the message authentication code through the IDaaS.

[0064] In step S104, the integrity of the user security ciphertext data is verified according to the message authentication code.

[0065] In the step, after obtaining the message authentication code and the user security ciphertext data corresponding to the user security data to be invoked, the software cryptographic module interface can be invoked to perform integrity verification on the user security ciphertext data according to the message authentication code. For example, in the step, the user security ciphertext data can be subjected to message authentication code calculation again to obtain a new message authentication code, and the new message authentication code can be compared with the original message authentication code. If the two message authentication codes are consistent, it can be determined that the integrity of the user security ciphertext data has not been damaged (i.e., the integrity verification is passed), otherwise, it can be determined that the integrity of the user security ciphertext data has been damaged (i.e., the integrity verification is failed).

[0066] In the step S105, in the case where the integrity verification of the user security ciphertext data is passed, the user security ciphertext data is decrypted to obtain the user security data to be invoked.

[0067] In the case where the integrity verification of the user security ciphertext data is passed, the user security ciphertext data can be decrypted by invoking the software cryptographic module interface to obtain the plaintext data of the user security data to be invoked.

[0068] In the step S106, the response information corresponding to the data invocation request is obtained according to the user security data to be invoked, and the response information is provided to the data invoker.

[0069] In the step, after obtaining the user security data to be invoked, the response information to the data invocation request can be obtained according to the user security data, and the response information is provided to the data invoker.

[0070] For example, the data invoker of the data invocation request can be a target service, the data invocation request can contain login information of a user who needs to log in to the target service, and indicate that the user needs to be subjected to login verification. In this case, the IDaaS can perform login verification on the user according to the login information of the user and the user security data to be invoked, and provide the verification result as the response information to the target service. For example, the data invoker of the data invocation request can be a user terminal, the data invocation request can contain a user identifier corresponding to the user terminal, and indicate that the user needs to access personal profile information of the user. In this case, the personal profile information of the user can be obtained according to the user security data to be invoked, and provided as the response information to the user terminal.

[0071] In the data processing method of the power grid dispatching cloud platform, the user security data is encrypted and stored, which can effectively reduce the risk of user security data leakage or damage. By calculating the message authentication code of the user security data and verifying the message authentication code before decrypting the user security ciphertext data when the user security data is called, the integrity of the data can be verified during the use of the user security data to avoid using damaged or tampered user security data, which is beneficial to the security and reliability of the power grid dispatching cloud platform.

[0072] In one exemplary embodiment, the user security data is encrypted to obtain user security ciphertext data corresponding to the user security data, and a message authentication code of the user security ciphertext data is calculated, including: encrypting the user security data using the Cipher Block Chaining mode of the SM4 algorithm to obtain the user security ciphertext data; and calculating the message authentication code of the user security ciphertext data using the Hash-based Message Authentication Code algorithm based on the SM3 hash function.

[0073] Specifically, in this embodiment, the user security data can be encrypted and the message authentication code can be calculated using the national secret algorithm. For example, the encryption key of the SM4 algorithm can be generated by calling the cloud password machine of the power grid dispatching cloud platform, and then the user security data can be encrypted using the Cipher Block Chaining (CBC) mode of the SM4 algorithm (i.e. SM4-CBC algorithm) to obtain the user security ciphertext data. Then, the Hash-based Message Authentication Code (HMAC) algorithm based on the SM3 hash function (i.e. HMAC-SM3 algorithm) can be used to calculate the message authentication code of the user security ciphertext data to obtain the corresponding message authentication code.

[0074] Based on this, when the integrity of the user security ciphertext data is checked and decrypted subsequently, the HMAC-SM3 algorithm can be used to check the integrity of the user security ciphertext data according to the message authentication code, and then the SM4-CBC algorithm can be used to decrypt the user security ciphertext data after the check is passed.

[0075] In this embodiment, the SM4-CBC algorithm is used to encrypt the user security data, which can effectively improve the confidentiality and attack resistance of the data. The HMAC-SM3 algorithm is used to calculate the message authentication code of the user security ciphertext data, which can effectively guarantee the integrity and source credibility of the user security ciphertext data, and is beneficial to improving the tamper resistance and anti-forgery ability of the user security data.

[0076] In one exemplary embodiment, asFigure 2 The method can further include:

[0077] In step S201, target audit data of a target service is acquired.

[0078] Specifically, the power grid dispatching cloud platform can provide an audit service for the target service, which can audit various operations, changes, etc. of the target service and obtain corresponding audit data. The target audit data of the target service can be data with a higher degree of importance in the audit data of the target service, such as log data, etc. The power grid dispatching cloud platform can acquire the target audit data of the target service through a log service and process and store the target audit data.

[0079] In step S202, a key corresponding to the target audit data is generated.

[0080] After the target audit data is acquired, a cloud cryptographic machine can be called to generate a key for encrypting the target audit data. The key can be a key corresponding to the SM4 algorithm.

[0081] In step S203, the target audit data is encrypted according to the key by using a Galois counter mode of the SM4 algorithm, to obtain audit ciphertext data, an authentication tag, and an initialization vector corresponding to the target audit data.

[0082] The log service of the power grid dispatching cloud platform can call a software cryptographic module interface, use the Galois counter mode (GCM) of the SM4 algorithm, i.e., the SM4-GCM algorithm, and encrypt the target audit data according to the key generated in advance. By encrypting the target audit data, the audit ciphertext data corresponding to the target audit data, the initialization vector, and the authentication tag generated in the encryption process can be obtained. The authentication tag can be used for integrity verification of the target audit data in the future, and the initialization vector can be used for decryption and verification of the audit ciphertext data in the future.

[0083] In step S204, the audit ciphertext data, the authentication tag, and the initialization vector are stored in association.

[0084] In this step, the audit ciphertext data, the authentication tag, and the initialization vector corresponding to the target audit data can be stored in association in the log service,

[0085] In this embodiment, by processing the target audit data of the target service by using the SM4-GCM algorithm, the encryption and integrity authentication of the target audit data can be realized at the same time, the audit ciphertext data and the authentication tag corresponding to the target audit data are obtained, thereby the efficient protection of the data confidentiality and integrity of the target audit data is realized, and the security and reliability of the cloud platform are improved.

[0086] In one exemplary embodiment, as shown in Figure 3 The method can further include:

[0087] In step S301, in response to the calling request for the target audit data, the audit ciphertext data, the authentication tag and the initialization vector corresponding to the target audit data to be called are obtained, and the key corresponding to the target audit data to be called is obtained.

[0088] In the case where the calling request for the target audit data is received, the target audit data to be called can be determined according to the calling request, and the audit ciphertext data, the authentication tag and the initialization vector corresponding to the target audit data to be called are obtained, and the key corresponding to the target audit data to be called is also obtained. The audit ciphertext data, the authentication tag and the initialization vector corresponding to the target audit data to be called can be stored in the log service of the power dispatch cloud platform in association, and the corresponding key can be stored separately.

[0089] In step S302, the audit ciphertext data is decrypted and the authentication tag is verified by using the Galois counter mode of the SM4 algorithm according to the key and the initialization vector.

[0090] The audit ciphertext data can be decrypted to obtain plaintext data according to the key and the initialization vector corresponding to the target audit data to be called by using the Galois counter mode (Galois / Counter Mode, GCM) of the SM4 algorithm, i.e. the SM4-GCM algorithm, and then the authentication tag is verified according to the key, the initialization vector and the plaintext data, and the integrity of the plaintext data is determined according to the verification result of the authentication tag.

[0091] In step S303, in the case where the authentication tag passes the verification, the target audit data obtained by decrypting the audit ciphertext data is provided to the data caller.

[0092] In the case where the authentication tag passes the verification, it can be determined that the plaintext data obtained by decrypting the audit ciphertext data is the target audit data which has not been tampered, and thus the target audit data can be provided to the data caller.

[0093] In this embodiment, by verifying and decrypting the target audit data when it is needed to be used, the integrity of the used data can be ensured, so that the use of tampered or damaged data can be avoided, and the security of the cloud platform can be ensured.

[0094] In one example embodiment, as shown in FIG. 1, the method can further include: Figure 4

[0095] Step S401, obtaining image data of a target service.

[0096] Specifically, the target service can be an application system service provided by the power grid dispatching cloud platform to a user, which can include but is not limited to operation and maintenance console, operation console, etc. The image data of the target service can be an image file of the application system, which can be used for instance deployment of the target service. In this step, the power grid dispatching cloud platform can obtain the image data of the target service.

[0097] Step S402, signing the digest value of the image data using a first key to obtain a digital signature corresponding to the image data.

[0098] The power grid dispatching cloud platform can use a hash algorithm to operate on the image data to obtain the digest value of the image data, and then sign the digest value to obtain the digital signature corresponding to the image data.

[0099] The power grid dispatching cloud platform can use an asymmetric encryption algorithm to sign the digest value. For example, the power grid dispatching cloud platform can generate a key pair including a first key and a second key according to a needed asymmetric encryption algorithm, and use the first key as a private key to encrypt the digest value to obtain the digital signature corresponding to the image data. The second key can be used as a public key to verify the digital signature later.

[0100] Step S403, in response to a service deployment request for the target service, providing the image data, the digital signature corresponding to the image data, and the second key corresponding to the first key to a service deployment party. The second key is used by the service deployment party to verify the digital signature of the image data.

[0101] When receiving the service deployment request for the target service, the power grid dispatching cloud platform can provide the image data of the target service, the digital signature corresponding to the image data, and the second key corresponding to the first key to the service deployment party.

[0102] ​The service deployer can verify the digital signature of the image data using the second key after obtaining the image data and its digital signature, to verify the integrity of the image data. Illustratively, the service deployer can calculate a digest value of the image data, and decrypt the digital signature using the second key, and compare the decryption result with the calculated digest value, if they are consistent, it can be determined that the integrity of the image data is not damaged.

[0103] In this embodiment, by signing the digest value of the image data of the target service using the first key, the integrity of the image data can be guaranteed by the digital signature; and by providing the image data, the digital signature and the second key corresponding to the first key to the deployer when the image data needs to be deployed, the deployer can verify the integrity of the image data before deploying the target service, so that the deployment of tampered or damaged image data can be avoided, which is beneficial to guarantee the security and reliability of the cloud platform.

[0104] In one exemplary embodiment, signing the digest value of the image data using the first key to obtain the digital signature corresponding to the image data can include: calculating the digest value of the image data using the SM3 algorithm; and signing the digest value using the SM2 algorithm using the first key to obtain the digital signature corresponding to the image data.

[0105] Specifically, in this embodiment, the image data can be signed using the national cryptographic algorithm. Wherein, the cryptographic machine can be called, the image data is first hashed using the SM3 algorithm to obtain the digest value corresponding to the image data, and then the SM2 algorithm is used to encrypt the digest value according to the first key to obtain the digital signature corresponding to the image data. Wherein, the first key and the second key corresponding thereto are the private key and the public key corresponding to the SM2 algorithm.

[0106] In this embodiment, by calculating the digest value of the image data using the SM3 algorithm and signing the digest value using the SM2 algorithm, the signature process of the image data can conform to the national cryptographic standard, which is beneficial to improve the security of the data.

[0107] In one exemplary embodiment, a data processing method of a power grid dispatching cloud platform is provided.

[0108] Specifically, the power grid dispatch cloud platform can provide users with various application system services including operation and maintenance consoles and operation consoles. Users can access a bastion host through a management terminal used by the user, and then use a browser to access the operation and maintenance consoles and operation consoles in a Hypertext Transfer Protocol Secure (HTTPS) manner to perform relevant operations. In the process of providing the application system services to the user, important data of different types is usually involved, including but not limited to identity authentication data, user contact information, access control data, important audit data, cloud platform image data, and the like. The important audit data can include log data of the application system services, and the cloud platform image data can include image files of the application system services. In order to protect the security of the important data, the important data of various types can be encrypted and integrity-protected in the embodiment.

[0109] Exemplarily, for user security data such as identity authentication data, user contact information, and access control data of the application system services, the power grid dispatch cloud platform can process and store the user security data through an identity authentication service (IDaaS). An encryption key of an SM4 algorithm can be generated by calling a cloud password machine, and then a software password module interface deployed in the IDaaS service is called to encrypt the user security data in a CBC mode of the SM4 algorithm to obtain user security ciphertext data, and a message authentication code of the user security ciphertext data is calculated by using an HMAC-SM3 algorithm. Subsequently, the user security ciphertext data and the message authentication code can be stored in a database of the IDaaS. When the user security data needs to be used (for example, a data calling request for the user security data is received), the software password module interface can be called through the IDaaS service, the user security ciphertext data is integrity-verified according to the message authentication code by using the HMAC-SM3 algorithm, and the user security ciphertext data is decrypted by using the SM4-CBC algorithm after the verification is passed.

[0110] Exemplarily, for important audit data of the application system services, the power grid dispatch cloud platform can process and store the important audit data through a log service. An encryption key of an SM4 algorithm can be generated by calling a cloud password machine, and then a software password module interface deployed in the log service is called to encrypt the important audit data according to the encryption key in an SM4 algorithm GCM mode to obtain corresponding audit ciphertext data, an authentication tag, and an initialization vector. When the important audit data needs to be used (for example, a calling request for target audit data is received), the software password module can be called through the log service, the audit ciphertext data is decrypted and the authentication tag is verified according to the encryption key and the initialization vector by using the SM4 algorithm GCM mode.

[0111] Exemplarily, for the mirror image data of the application system service, the power grid dispatching cloud platform can call the cryptomachine to operate the mirror image data by using the SM3 algorithm to obtain the digest value, and then sign the digest value by using the SM2 algorithm and the SM2 private key to obtain the digital signature corresponding to the mirror image data. When the user needs to deploy the application system service, the mirror image data, the digest value and the SM2 public key of the application system service can be provided to the user. The user can calculate the digest value of the mirror image data by using the SM3 algorithm, and decrypt the digital signature by using the SM2 public key. Then, the decryption result and the calculated digest value are compared to verify the integrity of the mirror image data.

[0112] In the embodiment, by using the cloud cryptomachine to encrypt and protect the integrity of various important data of the power grid dispatching cloud platform, the security of the important data in the cloud platform can be effectively improved, and the important data can be effectively prevented from being tampered with or damaged or being acquired by unauthorized persons during storage, thereby facilitating the provision of strong protection for the overall security and reliability of the power grid dispatching cloud platform.

[0113] It should be understood that, although each step in the flowchart involved in each of the above embodiments is displayed in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and these steps can be executed in other sequences. Moreover, at least part of the steps in the flowchart involved in each of the above embodiments can include multiple steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence of these steps or stages is not necessarily sequential, but can be executed alternately or alternately with at least part of other steps or steps or stages in other steps. It can be understood that the steps in different embodiments can be freely combined as needed, and various non-contradictory schemes formed by the combination are within the scope of protection of the present application.

[0114] Based on the same inventive concept, the embodiments of the present application also provide a data processing device of a power grid dispatching cloud platform for implementing the data processing method of the power grid dispatching cloud platform as described above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme described in the above method, and therefore the specific limitations in one or more data processing device embodiments of the power grid dispatching cloud platform provided below can refer to the limitations of the data processing method of the power grid dispatching cloud platform described above, which will not be repeated here.

[0115] In one exemplary embodiment, as shown in Figure 5 a data processing device of a power grid dispatching cloud platform is provided, comprising:

[0116] The first obtaining module 501 is configured to obtain user security data of a target service.

[0117] The data encryption module 502 is configured to encrypt the user security data to obtain user security ciphertext data corresponding to the user security data, and to calculate a message authentication code of the user security ciphertext data.

[0118] The second obtaining module 503 is configured to, in response to a data call request for the user security data, obtain user security ciphertext data and a message authentication code corresponding to the user security data to be called.

[0119] The data verification module 504 is configured to perform integrity verification on the user security ciphertext data according to the message authentication code.

[0120] The data decryption module 505 is configured to, in the case that the integrity verification of the user security ciphertext data is passed, decrypt the user security ciphertext data to obtain the user security data to be called.

[0121] The data providing module 506 is configured to obtain response information corresponding to the data call request according to the user security data to be called, and provide the response information to a data caller.

[0122] In an exemplary embodiment, the data encryption module 502 is configured to encrypt the user security data by using a cipher block chaining mode of a national cryptographic algorithm SM4 to obtain user security ciphertext data, and to calculate a message authentication code of the user security ciphertext data by using a hash operation message authentication code algorithm based on a national cryptographic algorithm SM3 hash function.

[0123] In an exemplary embodiment, the apparatus further comprises a third obtaining module configured to obtain target audit data of a target service, a key generation module configured to generate a key corresponding to the target audit data, an audit data encryption module configured to encrypt the target audit data according to the key by using a Galois counter mode of the national cryptographic algorithm SM4 to obtain audit ciphertext data, an authentication tag and an initialization vector corresponding to the target audit data, and a data storage module configured to store the audit ciphertext data, the authentication tag and the initialization vector in association.

[0124] In an example embodiment, the apparatus further comprises: a fourth obtaining module configured to, in response to a calling request for the target audit data, obtain audit ciphertext data, an authentication tag and an initialization vector corresponding to the target audit data to be called, and obtain a key corresponding to the target audit data to be called; an audit data verification module configured to, according to the key and the initialization vector, decrypt the audit ciphertext data and verify the authentication tag by using a Galois counter mode of a national standard SM4 algorithm; and an audit data providing module configured to, in a case where the authentication tag is verified, provide the target audit data obtained by decrypting the audit ciphertext data to a data caller.

[0125] In an example embodiment, the apparatus further comprises: a fifth obtaining module configured to obtain mirror image data of a target service; a mirror image signature module configured to sign a digest value of the mirror image data by using a first key to obtain a digital signature corresponding to the mirror image data; and a mirror image providing module configured to, in response to a service deployment request for the target service, provide the mirror image data, the digital signature corresponding to the mirror image data and a second key corresponding to the first key to a service deployer, wherein the second key is used for the service deployer to verify the digital signature of the mirror image data.

[0126] In an example embodiment, the mirror image signature module is configured to: calculate the digest value of the mirror image data by using a national standard SM3 algorithm; and sign the digest value by using a national standard SM2 algorithm and the first key to obtain the digital signature corresponding to the mirror image data.

[0127] The above various modules in the data processing apparatus of the power grid dispatching cloud platform can be realized by software, hardware and combinations thereof in whole or in part. The above various modules can be embedded in or independent of a processor in a computer device in a hardware form, or can be stored in a memory in a computer device in a software form, so as to be called and executed by a processor to perform operations corresponding to the above various modules.

[0128] In an example embodiment, a computer device is provided, which can be a server, and an internal structure diagram of the computer device can be as shown in Figure 6As shown in the figure. The computer device includes a processor, a memory, an input / output interface (I / O for short) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through the system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capability. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store user security ciphertext data and its corresponding message authentication code and other data. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with external terminals through network connection. The computer program is executed by the processor to realize a data processing method of a power grid dispatching cloud platform.

[0129] Those skilled in the art can understand that, Figure 6 The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device to which the scheme of the present application is applied. The specific computer device can include more or fewer components than those shown in the figure, or combine certain components, or have a different component arrangement.

[0130] In one embodiment, a computer device is also provided, including a memory and a processor, the memory storing a computer program, and the processor executing the computer program to realize the steps in each of the above method embodiments.

[0131] In one embodiment, a computer readable storage medium is provided, which stores a computer program, and the computer program is executed by the processor to realize the steps in each of the above method embodiments.

[0132] In one embodiment, a computer program product is provided, including a computer program, and the computer program is executed by the processor to realize the steps in each of the above method embodiments.

[0133] It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties, and the collection, use and processing of related data need to comply with relevant regulations.

[0134] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing relevant hardware. The computer program can be stored in a non-volatile computer readable storage medium. When the computer program is executed, the processes of the above-mentioned embodiment methods can be included. Any reference to memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. The non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical storage, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. The volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration but not limitation, the RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The database involved in the embodiments provided in the present application can include at least one of a relational database and a non-relational database. The non-relational database can include a distributed database based on a block chain, etc., but is not limited thereto. The processor involved in the embodiments provided in the present application can be a general processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but is not limited thereto.

[0135] The technical features of the above embodiments can be combined arbitrarily. In order to make the description simple, all possible combinations of the technical features in the above embodiments are not described, however, as long as the combinations of the technical features do not exist contradictory, it should be considered as the scope of the present application.

[0136] The above embodiments only express several implementation ways of the present application, and the description is specific and detailed, but it should not be understood as a limitation to the patent scope of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, several modifications and improvements can be made, which all belong to the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the appended claims.

Claims

1. A data processing method for a power grid dispatch cloud platform, characterized in that, The method includes: Obtain user security data for the target service; The user security data is encrypted to obtain the user security ciphertext data corresponding to the user security data, and the message authentication code of the user security ciphertext data is calculated. In response to a data retrieval request for the user security data, obtain the user security encrypted data and message authentication code corresponding to the user security data to be retrieved; The integrity of the user's secure encrypted data is verified based on the message authentication code; If the integrity verification of the user security encrypted data passes, the user security encrypted data is decrypted to obtain the user security data to be invoked; Based on the user security data to be invoked, obtain the response information corresponding to the data invocation request, and provide the response information to the data invocation party.

2. The method according to claim 1, characterized in that, The process of encrypting the user security data to obtain corresponding user security ciphertext data and calculating the message authentication code of the user security ciphertext data includes: The user security data is encrypted using the ciphertext block chaining mode of the national cryptographic SM4 algorithm to obtain user security ciphertext data; The message authentication code for the user's secure encrypted data is calculated using a hash operation message authentication code algorithm based on the national cryptographic SM3 hash function.

3. The method according to claim 1, characterized in that, The method further includes: Obtain the target audit data for the target service; Generate the key corresponding to the target audit data; Using the Galois counter mode of the national cryptographic SM4 algorithm, the target audit data is encrypted according to the key to obtain the audit ciphertext data, authentication tag and initialization vector corresponding to the target audit data; The audit ciphertext data, the authentication tag, and the initialization vector are stored together.

4. The method according to claim 3, characterized in that, The method further includes: In response to a request to invoke the target audit data, the system obtains the audit ciphertext data, authentication tag, and initialization vector corresponding to the target audit data to be invoked, and obtains the key corresponding to the target audit data to be invoked. Based on the key and the initialization vector, the audit ciphertext data is decrypted and the authentication tag is verified using the Galois counter mode of the SM4 national cryptographic algorithm; If the authentication label is verified, the target audit data obtained by decrypting the audit ciphertext data will be provided to the data caller.

5. The method according to claim 1, characterized in that, The method further includes: Obtain the image data of the target service; The digest value of the image data is signed using the first key to obtain the digital signature corresponding to the image data; In response to a service deployment request for the target service, the service deployer is provided with the image data, the digital signature corresponding to the image data, and the second key corresponding to the first key; the second key is used by the service deployer to verify the digital signature of the image data.

6. The method according to claim 5, characterized in that, The step of signing the digest value of the mirror data using the first key to obtain the digital signature corresponding to the mirror data includes: The digest value of the mirrored data was calculated using the national cryptographic SM3 algorithm. The digest value is signed using the first key using the national cryptographic SM2 algorithm to obtain the digital signature corresponding to the mirror data.

7. A data processing device for a power grid dispatch cloud platform, characterized in that, The device includes: The first acquisition module is used to acquire user security data of the target service; The data encryption module is used to encrypt the user security data to obtain the user security ciphertext data corresponding to the user security data, and to calculate the message authentication code of the user security ciphertext data. The second acquisition module is used to acquire, in response to a data access request for the user security data, the user security encrypted data and message authentication code corresponding to the user security data to be accessed; The data verification module is used to verify the integrity of the user's secure encrypted data based on the message authentication code; The data decryption module is used to decrypt the user security ciphertext data to obtain the user security data to be called after the integrity verification of the user security ciphertext data has passed. The data providing module is used to obtain the response information corresponding to the data call request based on the user security data to be called, and to provide the response information to the data caller.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images