Data security access control method, system and device based on zero-trust architecture and medium

Abstract

The invention relates to the technical field of data security access control, and discloses a data security access control method, system and device based on a zero-trust architecture and a medium, and the method comprises the step of effectively solving many problems existing in an existing power network system management and control mode through a multi-dimensional security policy. And in the aspect of confidential grade division, high-confidential data nodes are accurately identified by utilizing a preset re-acquisition period and a storage proportion threshold value, so that the safety of important data such as power system operation parameters and user sensitive information is guaranteed. According to the repeated access limiting strategy, abnormal repeated access can be found and prevented in time by limiting the number of access times, setting a similarity threshold value and the like, and the risk of data leakage is reduced.

Description

Technical Field

[0001] This invention relates to the field of data security access control technology, and in particular to a data security access control method, system, device and medium based on a zero-trust architecture. Background Technology

[0002] Existing power grid systems primarily monitor and manage user access behavior through permission-based detection mechanisms.

[0003] Specifically, the system first queries and verifies the permission level of a user attempting to access the power network system, and then compares and analyzes this permission information with the actual access operations performed by the user in real time.

[0004] When the system detects that a user is attempting to perform an access operation beyond their authorized scope, it immediately terminates the user's access. This control method, which relies solely on comparing permissions and behavior, has significant limitations: on the one hand, the system's detection and analysis of user data acquisition behavior is insufficient; on the other hand, during the process of user data access, it is often necessary to cross multiple data nodes in the power system network, and this complex access path makes it difficult for the system to monitor comprehensively.

[0005] More concerning is that during this process, users can easily obtain critical information such as the IP addresses of the data nodes they access. This not only exposes the system architecture but also exposes the important data stored on these data nodes to serious security threats. This important data includes both long-term stored core business information and temporary stored sensitive operational data. A leak of this data would pose incalculable security risks to the power system. Summary of the Invention

[0006] In view of the aforementioned existing problems, the present invention is proposed.

[0007] Therefore, this invention provides a data security access control method, system, device, and medium based on a zero-trust architecture, which can solve the problems of insufficient detection and analysis depth, difficulty in comprehensively monitoring complex access paths, and easy exposure of data node information in existing power network systems that rely solely on permission and behavior comparison for control.

[0008] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0009] In a first aspect, the present invention provides a data security access control method based on a zero-trust architecture, comprising:

[0010] Obtain data access request information from users within a power network system configured with a zero-trust architecture, and extract basic information about users accessing the power network system from the data access request information;

[0011] The basic information includes the user's account information and the area where the user accesses the power network system.

[0012] Based on the basic information, obtain the power network area corresponding to the user query data, and based on the power network area corresponding to the user query data, obtain the data nodes in the area that perform data interaction.

[0013] The data nodes are classified into confidentiality levels, and a dynamic access sequence based on the confidentiality level is set.

[0014] The dynamic access sequence is used to encrypt the address information mask of data nodes that meet the preset confidentiality level threshold.

[0015] Establish a duplicate access restriction policy and determine duplicate access based on the data access request information.

[0016] As a preferred embodiment of the data security access control method based on zero-trust architecture described in this invention, the step of classifying the data nodes into confidentiality levels and setting dynamic access sequences based on the confidentiality levels includes:

[0017] Preset a confidentiality level threshold and identify data nodes that meet the confidentiality level threshold;

[0018] The data nodes that meet the confidentiality level threshold are masked and encrypted, and corresponding sub-code data is generated;

[0019] The subcode data is integrated into the data access request information, so that the data access request information after the subcode data is integrated has the authority to access data nodes that meet the confidentiality level threshold.

[0020] This preferred solution significantly enhances the data security of power grid systems. By filtering highly confidential data nodes through a preset confidentiality level threshold and then masking and encrypting them, it acts like putting a robust "protective layer" on this important data, effectively preventing unauthorized theft or tampering during transmission and interaction. The generated sub-code data is integrated with data access request information, ensuring that only users with the appropriate permissions can access these highly confidential data nodes, further enhancing the accuracy and effectiveness of access control.

[0021] Meanwhile, this approach also enhances the system's flexibility and scalability. When data nodes and confidentiality levels in the power grid system change, only the preset confidentiality level thresholds and dynamic access sequences need to be adjusted to quickly adapt to new security requirements, without requiring large-scale modifications to the entire system. Moreover, the combination of repeated access restriction policies and subcode data fusion mechanisms enables more comprehensive monitoring of user access behavior, timely detection and prevention of abnormal repeated access, and reduction of the risk of data leakage, providing multi-dimensional and multi-layered protection for the data security of the power grid system.

[0022] As a preferred embodiment of the data security access control method based on zero-trust architecture described in this invention, the preset confidentiality level threshold includes:

[0023] Preset the reacquisition period and acquire the important data storage ratio of data nodes within the current period;

[0024] The important data includes at least power system operating parameters, user sensitive information, power grid topology information, and model parameters of core power equipment;

[0025] Several storage ratio thresholds are set, and the storage ratio thresholds are the confidentiality level thresholds for the current period.

[0026] As a preferred embodiment of the data security access control method based on zero-trust architecture described in this invention, the step of establishing a repeated access restriction policy and determining repeated access based on the data access request information includes:

[0027] The repeated access restriction policy includes limiting the number of times the same user or the same login port address can access the site within a fixed time period;

[0028] The number of times the same user or the same login port address makes data access requests for the same or similar content is determined based on the data access request information.

[0029] A preset similarity calculation strategy is provided, which is used to determine the similarity of content accessed by the same user or the same login port address.

[0030] Set a similarity threshold, and record each data access request that meets the similarity threshold as a single request.

[0031] As a preferred embodiment of the data security access control method based on zero-trust architecture described in this invention, the step of setting a dynamic access sequence based on the confidentiality level includes:

[0032] A time factor is introduced into the mask data and sub-code data, so that each time the mask data is derived into sub-code data, the matching, verification and decoding are limited to a preset time period.

[0033] As a preferred embodiment of the data security access control method based on zero-trust architecture described in this invention, the step of integrating the subcode data into the data access request information includes:

[0034] Associate each sub-code with an expiration period to prevent sub-code data from being used repeatedly;

[0035] When the subcode data expires, the system automatically regenerates new subcode data and updates it in the data access request information.

[0036] As a preferred embodiment of the data security access control method based on zero-trust architecture described in this invention, it further includes: when the access request cannot be completed within a preset time period, terminating the current data access and prompting the user to re-enter the data access request operation.

[0037] Secondly, the present invention provides a data security access control system based on a zero-trust architecture, comprising:

[0038] The data acquisition module is used to acquire data access request information of users in a power network system with a zero-trust architecture, and extract basic information about users accessing the power network system from the data access request information.

[0039] The basic information includes the user's account information and the area where the user accesses the power network system.

[0040] The data node acquisition module is used to acquire the power network area corresponding to the user query data based on the basic information, and to acquire the data nodes that perform data interaction within the power network area corresponding to the user query data.

[0041] The partitioning module is used to partition the data nodes into confidentiality levels and set a dynamic access sequence based on the confidentiality level.

[0042] The dynamic access sequence is used to encrypt the address information mask of data nodes that meet the preset confidentiality level threshold.

[0043] The judgment module is used to establish a repeated access restriction policy and to judge repeated access based on the data access request information.

[0044] Thirdly, the present invention provides an electronic device including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described above.

[0045] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described above.

[0046] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention proposes a data security access control method based on a zero-trust architecture, which effectively solves many problems existing in the current power network system management and control methods through multi-dimensional security strategies. Regarding confidentiality level classification, by utilizing preset reacquisition cycles and storage ratio thresholds, highly confidential data nodes are accurately identified, ensuring the security of important data such as power system operating parameters and sensitive user information. The repeated access restriction strategy, by limiting the number of accesses and setting similarity thresholds, can promptly detect and prevent abnormal repeated accesses, reducing the risk of data leakage.

[0047] Introducing a time factor into the dynamic access sequence ensures that the matching, verification, and decoding of sub-code data derived from mask data occur within a preset time period, increasing the timeliness and security of access control. Sub-code data is integrated into the data access request information and associated with an expiration date, preventing duplicate use of sub-code data and allowing for new generation after the expiration date, thus guaranteeing system flexibility and data access accuracy. Access is terminated and the user is notified when an access request cannot be completed within a preset time, further optimizing the system's user experience and security. Attached Figure Description

[0048] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a flowchart of a data security access control method based on a zero-trust architecture, provided as an embodiment of the present invention.

[0050] Figure 2 This is an internal structure diagram of an electronic device that provides a data security access control method based on a zero-trust architecture according to an embodiment of the present invention. Detailed Implementation

[0051] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0052] Example 1, referring to Figure 1This is the first embodiment of the present invention, which provides a data security access control method based on a zero-trust architecture, including:

[0053] Existing technologies suffer from several problems. For example, data access permission management is often imprecise, employing a crude approach to permission allocation that fails to dynamically adjust based on individual user needs and operational scenarios, leading to potential abuse or insufficient access. Furthermore, data access authentication mechanisms are inadequate, relying excessively on traditional username and password authentication methods, making them vulnerable to cracking and unable to effectively defend against increasingly sophisticated cyberattacks. Moreover, the lack of real-time monitoring and analysis capabilities for data access behavior hinders the timely detection and mitigation of abnormal access behavior, making it difficult to detect and trace data leaks or tampering in a timely manner. Additionally, the lack of unified security standards and specifications in multi-system, multi-platform data interaction creates significant security vulnerabilities during data transmission and storage. These issues severely impact data security and reliability, hindering the development of related businesses.

[0054] This invention provides a method that can effectively solve the problems mentioned above. The following will describe in detail how to implement this data security access control method based on zero trust architecture with reference to several embodiments.

[0055] Figure 1 A flowchart illustrating a data security access control method based on a zero-trust architecture is shown, including:

[0056] S101, Obtain user data access request information within a power network system configured with a zero-trust architecture, and extract basic information about the user's access to the power network system from the data access request information, including:

[0057] It's important to note that Zero Trust architecture is a completely new network security concept. It abandons the traditional network security approach of "default trust and perimeter protection," instead adhering to the principle of "default distrust and constant verification." Under Zero Trust architecture, users, whether from internal or external networks, cannot be trusted by default; any access request to the power network system requires strict verification and authorization.

[0058] It should be noted that, in order to achieve secure data access control based on a zero-trust architecture, advanced network monitoring technologies and data acquisition tools can be used to obtain users' data access request information. For example, traffic monitoring devices can be deployed at key nodes of the power network system to capture data access request packets sent by users in real time.

[0059] In one optional implementation, extracting basic information about a user's access to the power grid system from data access request information can employ data parsing technology. This involves deep analysis of the access request data packets to accurately extract key information such as the user's account information and access area. The user's account information clearly identifies the accessing entity, which is crucial for subsequent permission assessment and security control. Access area information helps understand the source of the user's access and, combined with factors such as the area's security level, further evaluates the security of the access.

[0060] In one optional implementation, basic information may include the user's device information, such as the device model and operating system version. Different devices may pose different security risks; for example, older devices may be more vulnerable to attacks due to more system vulnerabilities. By obtaining device information, the device can be assessed to determine whether it meets the requirements for secure access. If the device has security vulnerabilities, the user can be required to update the system or take other security measures before accessing the data.

[0061] In an optional implementation, user access time information may also be included. Certain specific time periods may present higher security risks, such as late at night when fewer system administrators are available, potentially leading to delayed responses in the event of a security incident. Based on access time information, and in conjunction with preset security policies, access requests during high-risk time periods can be subject to more stringent scrutiny. For example, access restrictions can be set for specific time periods, or additional authentication steps can be required.

[0062] In an optional implementation, the basic information can also include user access frequency information. Frequent access requests may indicate abnormal behavior, such as attackers attempting to brute-force passwords or steal data. By analyzing access frequency, reasonable frequency thresholds can be set. When a user's access frequency exceeds the threshold, the system can automatically trigger security mechanisms, such as restricting access or sending security alerts, to ensure the data security of the power network system.

[0063] In this embodiment of the invention, the basic information includes the user's account information and the area where the user accesses the power network system;

[0064] Specifically, based on the user's access operations within the power network system, access request information of the power network system is obtained, and basic information about the user's access to the power network system is extracted based on the request information.

[0065] The basic information includes: user account information (username, account level, account permissions, etc.), and the area where the user accesses the power network system (access port information of the power network system, user IP address).

[0066] It should be noted that user access operations within the power grid system refer to the actions of a user interacting with the power grid system through some means (such as logging in, querying, controlling, etc.). This may include specific actions such as viewing power data, adjusting equipment status, and submitting requests. Obtaining access request information from the power grid system refers to capturing relevant technical data and request content from the user's access behavior, such as request time, request type (read, write, modify), target resource address, etc.

[0067] It should be noted that extracting basic information about user access to the power grid system refers to filtering out key data from access request information that can identify the user's identity and access environment for subsequent verification and recording. User account information (username, account level, account permissions, etc.) is a set of attributes describing the user's identity and capabilities. The "username" is the user's unique identifier; the "account level" reflects the user's importance or priority; and "account permissions" define the scope of operations the user can perform, such as whether they can change settings or view sensitive data.

[0068] It should be noted that the area where a user accesses the power grid system refers to the physical or logical range within which the user connects to the power grid system through a specific location or path, typically determined by geographical region, departmental division, or virtual network partitioning. The access port information of the power grid system refers to the specific channel number or interface identifier used to establish communication between the user equipment and the power grid system. These ports may be physical ports at the hardware level or logical ports at the software level. The user's IP address is a unique identifier for the user equipment within the network, used to locate and trace its origin, and also helps determine the user's network environment (such as an internal LAN or the external Internet).

[0069] It's important to note that obtaining user data access request information within a power network system configured with a zero-trust architecture, and extracting basic information about user access to the power network system from this information, provides crucial data security access control. By clearly defining user account information, it's possible to accurately determine a user's identity and permissions, thereby determining whether they are qualified to access specific data resources. For example, high-level accounts may have access to core power data, while low-level accounts can only access some routine, non-sensitive data. Clearly defining account permissions effectively prevents abuse of privileges, ensuring that only users with the appropriate permissions can perform specific operations.

[0070] S102, based on basic information, obtain the power network area corresponding to the user's query data, and based on the power network area corresponding to the user's query data, obtain the data nodes within the area that perform data interaction, wherein:

[0071] It should be noted that once the basic information of the user's access to the power network system is obtained, the power network area corresponding to the user's query data can be located based on this information.

[0072] In one alternative implementation, different power network regions may store different types and levels of data with varying sensitivities. For example, a power generation region may store data such as generator operating parameters and power generation efficiency; while a transmission region may contain data such as transmission line voltage, current, and power. By using basic information such as the user's account information and access region, the type of data the user may query can be inferred, thereby determining the corresponding power network region.

[0073] In an alternative implementation, user access area information can be analyzed by combining the topology of the power network system and the area division rules.

[0074] For example, if a user accesses a specific substation area, it can be preliminarily determined that the data the user is querying may be related to the substation's operational data, such as equipment status and power statistics. Simultaneously, user account permissions will also restrict the data query area; only users with the corresponding permissions can access data in specific areas.

[0075] It should be noted that, based on the power network area corresponding to the user's query data, the data nodes that perform data interaction within the area are obtained. Data nodes are the basic units for data storage, processing and transmission in the power network system. They are distributed in various power network areas and undertake different functions and tasks.

[0076] For example, data nodes in a power generation area might be responsible for collecting and processing real-time operating data from generators; while data nodes in a transmission area might focus on transmitting and monitoring data related to transmission lines. Obtaining these data nodes provides specific operational targets for subsequent secure access control. Data nodes within a region can be obtained by querying the node topology information of the power network system. This topology information records the location, connectivity, and function of each data node; by analyzing and filtering it, data nodes relevant to the user's query data can be accurately located.

[0077] In an alternative implementation, the scope of data nodes can be further determined by combining the user's basic information. For example, if a user's account permissions only allow access to certain specific types of data nodes, then data nodes that meet the criteria can be filtered from the data nodes within the region based on this permission restriction.

[0078] In an optional implementation, data node identification information, such as node number and name, can be used to accurately locate and identify data nodes, ensuring that the obtained data nodes are accurate. Identifying data nodes interacting within the region is a crucial step in implementing data security access control based on a zero-trust architecture, providing a foundation for subsequent operations such as classifying data node confidentiality levels and setting access sequences.

[0079] It should be noted that by obtaining the power network region corresponding to the user's query data based on basic information, and then identifying the data nodes interacting within that region, the granularity of data access control can be further refined, improving the accuracy of data security protection. By clearly defining the power network region corresponding to the user's query data and the data nodes within that region, personalized security strategies can be developed for different data nodes.

[0080] S103, classify data nodes by confidentiality level and set dynamic access sequences based on confidentiality level, wherein:

[0081] It should be noted that once the data nodes interacting within the region are identified, they need to be classified into different confidentiality levels. Different data nodes store and process data with varying degrees of sensitivity and importance; therefore, their confidentiality levels must be determined based on the characteristics of the data.

[0082] In one alternative implementation, the confidentiality level can be divided into multiple levels based on the nature and purpose of the data, such as public, internal, confidential, and top secret. Public data is typically information that can be publicly disclosed, such as promotional materials for power network systems and some statistical data; internal data is information accessible only to internal personnel, such as basic employee information and departmental daily work schedules; confidential data involves the core business and key information of the power network system, such as core parameters of power equipment and important business processes; top secret data is the most sensitive and important data, such as security policies for the power network system and decision-making information of senior management. By classifying data nodes into confidentiality levels, the sensitivity of the data stored on each node can be clearly understood, providing a basis for subsequent secure access control.

[0083] In an alternative implementation, the confidentiality level can also be determined by combining the historical access records and security event information of the data nodes. If a data node has experienced a security incident, such as data breach or tampering, the data stored on that node may be more sensitive, and its confidentiality level should be increased accordingly. Similarly, data nodes frequently accessed by high-privilege users may store more important data, and their confidentiality level can also be appropriately increased.

[0084] In this embodiment of the invention, multiple data nodes are classified into confidentiality levels according to the importance of the data information stored in the data nodes (e.g., the proportion of power grid user information, model parameters of core power equipment, etc. contained in the data nodes). Since the data throughput of the power system network is large and the amount of real-time data storage changes of each data node is large, it is necessary to detect the proportion of important data storage of the data nodes in real time to confirm the confidentiality of the data nodes involved in the user access request in the current state.

[0085] Specifically, in this invention, data confidentiality levels are divided into general, key, and confidential, based on the proportion of important data stored within a data node, that is, the important data and the total amount of data stored in that data node (wherein, 10% or less is a general data node, 10% to 40% is a key data node, and more than 40% is a confidential data node).

[0086] In an embodiment of the present invention, the dynamic access sequence is used to perform address information mask encryption on data nodes that meet a preset confidentiality level threshold.

[0087] In this embodiment of the invention, classifying data nodes into confidentiality levels and setting dynamic access sequences based on confidentiality levels includes:

[0088] Preset a confidentiality level threshold and identify data nodes that meet the confidentiality level threshold;

[0089] Data nodes that meet the confidentiality level threshold are masked and encrypted, and corresponding sub-code data is generated;

[0090] By integrating subcode data into the data access request information, the data access request information after the subcode data is integrated has the authority to access data nodes that meet the confidentiality level threshold.

[0091] In embodiments of the present invention, the preset confidentiality level threshold includes:

[0092] Preset the reacquisition period and acquire the important data storage ratio of data nodes within the current period;

[0093] Important data includes at least power system operating parameters, user-sensitive information, power grid topology information, and model parameters of core power equipment;

[0094] Several storage ratio thresholds are set, and the storage ratio thresholds are the confidentiality level thresholds for the current period.

[0095] In this embodiment of the invention, setting a dynamic access sequence based on confidentiality level includes:

[0096] A time factor is introduced into the mask data and sub-code data, so that each time the mask data is derived into sub-code data, the matching, verification and decoding are limited to a preset time period.

[0097] In this embodiment of the invention, integrating subcode data into the data access request information includes:

[0098] Associate each sub-code with an expiration period to prevent sub-code data from being used repeatedly;

[0099] When the subcode data expires, the system automatically regenerates new subcode data and updates it in the data access request information.

[0100] It should be noted that dynamic access sequences refer to a set of access control rules or encryption logic that are dynamically generated based on the confidentiality level of data nodes, and are used to restrict unauthorized access to data nodes with high confidentiality levels.

[0101] For example, suppose a power system's database contains multiple nodes storing sensitive user information and power grid operating parameters. The system generates different access sequences based on the confidentiality level of these nodes (such as general, important, confidential, or "high," "medium," "low"), and only requests with the correct permissions can be verified.

[0102] It should be noted that address information masking encryption refers to partially hiding or encrypting the address information of data nodes to prevent unauthorized users from directly obtaining the complete address information, thereby enhancing data security.

[0103] For example, the actual address of a data node is 192.168.1.10, which may be displayed as 192.XXX.X.XX after being encrypted with a mask. Only authorized users can obtain the complete address by decryption.

[0104] It should be noted that the preset confidentiality level threshold refers to one or more pre-set numerical standards used to determine whether a data node belongs to the high confidentiality level, thereby deciding whether special protection (such as mask encryption) is required.

[0105] For example, if a data node stores more than 50% of important data (such as sensitive user information), its confidentiality level is determined to be "high," and a mask encryption mechanism is triggered.

[0106] It should be noted that the important data storage ratio refers to the proportion of important data stored in a data node to the total amount of data within a certain period, which is used to assess the confidentiality level of that node.

[0107] For example, suppose a data node stores 100GB of data, of which 60GB is power system operating parameters. This would represent 60% of its data as important data, meeting the standard for a "high" confidentiality level.

[0108] It should be noted that the time factor refers to the time constraint introduced into the mask data and subcode data to ensure that the subcode data generated each time is only valid within a specific time period, thereby further improving security.

[0109] For example, the subcode data A1B2C3 generated by the system is only valid between 8:00 and 18:00 on the same day. After this period, even if you have the correct subcode data, you will not be able to access the target node.

[0110] It should be noted that the validity period of subcode data refers to the usage time limit assigned to each subcode data. After the time limit is exceeded, the system will automatically generate new subcode data to replace the old data, so as to avoid security risks caused by long-term repeated use.

[0111] For example, the validity period of subcode data X1Y2Z3 is 24 hours. After it expires, the system will automatically update it to the new subcode data M4N5O6 and integrate the new data into the data access request.

[0112] It should be noted that the reacquisition cycle refers to the time interval at which the system periodically checks and updates the confidentiality level of data nodes, which is used to dynamically adjust access policies.

[0113] For example, the system recalculates the proportion of critical data storage for data nodes every 7 days and adjusts the confidentiality level threshold based on the latest results.

[0114] Specifically, during the user access request process, for data access operations involving key and confidential data nodes, data address connections and data transmission are performed by setting dynamic access masks;

[0115] Furthermore, based on the confidentiality level of multiple data nodes, the address information of key and confidential data nodes is masked and encrypted, and corresponding subcode data is generated. The subcode data is then integrated into the access request information, so that the current access request can involve the data access needs of key and confidential data nodes.

[0116] Furthermore, a time factor is introduced as a KDF input during the mask and subcode setting process, strongly binding the cryptographic derivation function with the time factor. Time information (such as timestamps and time period identifiers) is used as part of the KDF's info parameter (in HKDF) or salt input, so that each time the master key (i.e., mask data) is derived to form a subkey (i.e., subcode data), it needs to be matched, verified, and decoded within a preset time period. The time length is based on the average response time of data interaction between each data node (i.e., the average response time of data interaction between each data node within a certain period of operation of the power system network (excluding the long period of non-response during faults)).

[0117] Here, KDF stands for Key Derivation Function, used to generate a purpose-specific key from basic key material. HKDF stands for HMAC-based Extract-and-Expand Key Derivation Function, a standard KDF implementation. info stands for ContextInformation, an optional parameter in HKDF used to provide additional application-specific information. salt is a random salt value, an input parameter in KDF used to enhance security and prevent rainbow table attacks.

[0118] Furthermore, the system configuration supports two main methods for setting time parameters: First, absolute timestamp settings, using the Unix timestamp format, supporting both second and millisecond precision levels to accurately record the absolute time of events. Second, relative time identifier settings, providing two standardized formats: "day-YYYY-MM-DD" (e.g., "day-2025-06-03" represents June 3, 2025) and "hour-YYYYMMDDHH" (e.g., "hour-2025060314" represents 2 PM on June 3, 2025), facilitating relative time identification based on days or hours. Additionally, the system supports setting round identifiers, using a monotonically increasing integer sequence (e.g., rotation_epoch = 1) to mark different processing rounds.

[0119] Furthermore, regarding the key derivation mechanism, the system employs the HMAC-based key derivation function HKDF to implement the encoding of data nodes and the generation of subcodes. HKDF is a key derivation function conforming to the RFC 5869 standard. Its core principle is to securely expand short key material into a longer key through two stages: extraction and expansion. The specific implementation process is as follows:

[0120] 1. Extraction Phase: Using an optional salt value (which can be null) and input key material (IKM, i.e., the master key) as input, a fixed-length pseudo-random key (PRK) is generated through HMAC hashing. The calculation formula is: PRK = HMAC - Hash(salt, IKM).

[0121] 2. Expansion Phase: Using the PRK obtained in the extraction phase, combined with optional context information (info, recommended for binding key usage) and a counter, the desired key material (OKM) is derived by repeatedly calling the HMAC function and concatenating the results. The calculation formula is expressed as: OKM = KDF(PRK,info,L), where L represents the desired output key length.

[0122] The input parameters of HKDF include: input key material (IKM), optional salt value, optional context information (info), and the desired output key length (L). Its output is a derived key (OKM). This scheme has significant advantages such as high standardization, simple implementation, strong security, and flexible use, and can meet the security requirements of various key derivation scenarios.

[0123] Furthermore, if the access request cannot be completed within a preset time period, the data access will be terminated, and the user will be prompted to re-enter the data access operation.

[0124] It's important to note that classifying data nodes by confidentiality level and establishing dynamic access sequences based on these levels significantly improves the security and flexibility of data access. By classifying data nodes by confidentiality level, the sensitivity and importance of different data can be clearly defined, allowing for the allocation of appropriate security protection levels. Setting dynamic access sequences based on confidentiality levels means that access rules are not static but are dynamically adjusted based on factors such as the real-time status of the data, the access environment, and user permissions.

[0125] S104, Establish a duplicate access restriction policy, and determine duplicate access based on data access request information, wherein:

[0126] It should be noted that when a user initiates a data access request, duplicate access may occur. This not only increases the system load but may also harbor potential security risks, such as malicious brute-force attacks. Therefore, establishing a duplicate access restriction policy is essential.

[0127] First, the system performs a detailed analysis of the data access request information, extracting key features such as the access time, the accessed data source (i.e., the specific data node), and the user's identifier. Based on these features, the system creates a unique identifier record for each user's data access request.

[0128] For duplicate access detection, the system sets a time window, for example, 5 minutes. Within this time window, if the same user makes multiple access requests to the same data source, the system will consider these requests as duplicate accesses. For further precision, the specific content of the requests can be considered; if the request content is completely identical, the determination of duplicate access is even clearer.

[0129] When the system determines that an access request is duplicated, it will handle it according to a preset strategy. One approach is to limit the number of attempts. For example, within the aforementioned 5-minute time window, a single user is allowed a maximum of 3 accesses to the same data source. If this limit is exceeded, the system will automatically reject subsequent access requests and send a corresponding message to the user, informing them that the access limit has been reached and they need to wait for a period of time before trying again.

[0130] Another approach is to introduce an access interval limit. The system can stipulate that there must be a certain time interval between two accesses by the same user to the same data source, such as 30 seconds. If the user initiates an access request again before the required interval has been met, the system will also reject the request and prompt the user to wait for a sufficient amount of time before attempting to access the data again.

[0131] In addition, for users who frequently trigger repeated access restrictions, the system can take stricter measures, such as temporarily locking the user's access permissions for a period of time, such as locking for 1 hour, in order to prevent possible malicious access behavior.

[0132] Simultaneously, the system records and analyzes repeated access patterns. By analyzing these records, abnormal access patterns can be identified, such as a user repeatedly accessing multiple highly confidential data nodes within a short period, which may indicate a security threat. In such cases, the system can promptly issue an alert, notifying the system administrator for further investigation and handling.

[0133] By establishing a duplicate access restriction policy and combining it with data access request information to determine duplicate access, the system load can be effectively reduced, the system operating efficiency can be improved, and the security of data access can be enhanced to prevent malicious duplicate access behavior from damaging the system and data.

[0134] In this embodiment of the invention, establishing a duplicate access restriction policy and determining duplicate access based on data access request information includes:

[0135] Repeat access restriction policies include limiting the number of times the same user or the same login port address can access the site within a fixed time period;

[0136] Determine the number of times the same user or the same login port address makes data access requests for the same or similar content based on the data access request information;

[0137] A preset similarity calculation strategy is used to determine the similarity of content accessed by the same user or the same login port address.

[0138] Set a similarity threshold, and record each data access request that meets the similarity threshold as a single request.

[0139] In this embodiment of the invention, if the access request cannot be completed within a preset time period, the current data access is terminated, and the user is prompted to re-enter the data access request operation.

[0140] In summary, this invention proposes a data security access control method based on a zero-trust architecture, which effectively solves many problems existing in current power network system management and control methods through multi-dimensional security strategies. Regarding confidentiality level classification, by utilizing preset reacquisition cycles and storage ratio thresholds, highly confidential data nodes are accurately identified, ensuring the security of important data such as power system operating parameters and sensitive user information. The repeated access restriction strategy, by limiting the number of accesses and setting similarity thresholds, can promptly detect and prevent abnormal repeated accesses, reducing the risk of data leakage.

[0141] Introducing a time factor into the dynamic access sequence ensures that the matching, verification, and decoding of sub-code data derived from mask data occur within a preset time period, increasing the timeliness and security of access control. Sub-code data is integrated into the data access request information and associated with an expiration date, preventing duplicate use of sub-code data and allowing for new generation after the expiration date, thus guaranteeing system flexibility and data access accuracy. Access is terminated and the user is notified when an access request cannot be completed within a preset time, further optimizing the system's user experience and security.

[0142] Example 2, in a preferred embodiment, for data access requests from the same user or the same login port address, and where the data access requests involve the same or similar access data content, the number of accesses within a preset time period is recorded. For example, if more than 5 data access operations occur within one hour, the data access request information is intercepted and terminated. The access number threshold can be set according to the actual situation, such as more than 2 identical access operations within 20 minutes, or more than 10 identical access operations within 6 hours, etc.

[0143] In another preferred embodiment, for data access requests based on specific user patterns, i.e., for the same user account performing queries to retrieve specific data information at fixed times or within a fixed time period, a temporary storage node for power system data nodes is generated based on the management of the user account within the power system network. This involves organizing the corresponding data information within the power system network and storing it in the temporary storage node at the corresponding time point or time period. Based on the access request information and verification of basic information such as the user account and user login port IP, rapid data transmission is performed. This approach not only facilitates the management of specific data transmission and improves the efficient operation of the power system network, but also simplifies access to specific user data and reduces the risk of important data leakage.

[0144] If a user misses the preset time for accessing specific data, they need to reapply for access using their user account. Data transmission will then proceed after the aforementioned identity verification and data node encryption protection.

[0145] For example, suppose an employee of a power company, Mr. Zhang, needs to access the electricity load data of a certain area within the power system through his account every day at 9:00 AM for real-time monitoring and analysis. According to the above embodiment, the power system network will compile the electricity load data for that area one day in advance and store it in a temporary storage node. At 8:50 AM the following morning, the system begins to verify Mr. Zhang's login account information and login port IP address. After confirming that everything is correct, the data is transmitted to Mr. Zhang's access port precisely at 9:00 AM.

[0146] If Mr. Zhang is unable to access the data by 9:00 AM for any reason, for example, if he initiates the access request at 10:00 AM, he will need to resubmit the application. In this case, the system will restart the identity verification process, including verifying the user account, login port IP, and other basic information, and using a data node encryption protection mechanism to ensure that data is only transmitted after successful verification. This method ensures data security while providing a flexible access mechanism to meet the user's actual needs.

[0147] Example 3, referring to Figure 2 This embodiment also provides a data security access control system based on a zero-trust architecture, including:

[0148] The data acquisition module is used to acquire data access request information of users in a power network system with a zero-trust architecture, and extract basic information about users accessing the power network system from the data access request information.

[0149] Basic information includes the user's account information and the area where the user is connected to the power grid system;

[0150] The data node acquisition module is used to acquire the power network area corresponding to the user query data based on basic information, and to acquire the data nodes that interact with the data within the power network area corresponding to the user query data.

[0151] The partitioning module is used to classify data nodes by confidentiality level and set dynamic access sequences based on confidentiality level.

[0152] Dynamic access sequences are used to encrypt the address information mask of data nodes that meet the preset confidentiality level threshold.

[0153] The judgment module is used to establish a repeated access restriction policy and to judge repeated access based on data access request information.

[0154] The above-mentioned unit modules can be embedded in the processor of the electronic device in hardware form or independent of it, or they can be stored in the memory of the electronic device in software form, so that the processor can call and execute the corresponding operations of the above modules.

[0155] This embodiment also provides an electronic device, which can be a terminal, and its internal structure diagram can be as follows: Figure 2 As shown, the electronic device includes a processor, memory, communication interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage medium. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a data security access control method based on a zero-trust architecture. The display screen can be an LCD screen or an e-ink screen. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the device's casing, or an external keyboard, touchpad, or mouse.

[0156] This embodiment also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, it performs the following steps:

[0157] Obtain user data access request information within a power network system configured with a zero-trust architecture, and extract basic information about the user's access to the power network system from the data access request information;

[0158] Basic information includes the user's account information and the area where the user is connected to the power grid system;

[0159] Based on basic information, obtain the power network area corresponding to the user's query data, and based on the power network area corresponding to the user's query data, obtain the data nodes that interact with data within the area.

[0160] Data nodes are classified into confidentiality levels, and dynamic access sequences based on confidentiality levels are set.

[0161] Dynamic access sequences are used to encrypt the address information mask of data nodes that meet the preset confidentiality level threshold.

[0162] Establish a duplicate access restriction policy and determine duplicate access based on data access request information.

[0163] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

[0164] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention.

[0165] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A data security access control method based on a zero trust architecture, characterized in that, The method comprises the following steps: Obtaining data access request information of a user in a power network system configured with a zero-trust architecture, and extracting basic information of the user accessing the power network system from the data access request information; The basic information includes account information of the user and a region where the user accesses the power network system; Based on the basic information, a power network region corresponding to user query data is obtained, and data nodes for data interaction in the region are obtained based on the power network region corresponding to the user query data; Classifying the data nodes according to a confidentiality level, and setting a dynamic access sequence based on the confidentiality level; The dynamic access sequence is used for address information mask encryption of the data nodes that meet a preset confidentiality level threshold; A repeated access restriction strategy is established, and repeated access is judged based on the data access request information.

2. The data security access control method based on the zero trust architecture of claim 1, wherein, The method of classifying the data nodes according to a confidentiality level and setting a dynamic access sequence based on the confidentiality level comprises: A preset confidentiality level threshold is determined to determine data nodes that meet the confidentiality level threshold; The data nodes that meet the confidentiality level threshold are subjected to mask encryption, and corresponding sub-code data is generated; The sub-code data is integrated into the data access request information, so that the data access request information fused with the sub-code data has the permission to access the data nodes that meet the confidentiality level threshold.

3. The data security access control method based on the zero trust architecture of claim 2, wherein, The preset confidentiality level threshold comprises: A preset reacquisition period is used to acquire an important data storage ratio of the data nodes in the current period; The important data at least includes power system operation parameters, user sensitive information, power grid topology structure information, and model parameters of core power equipment; A plurality of storage ratio thresholds are set, and the storage ratio threshold is the confidentiality level threshold in the current period.

4. The data security access control method based on the zero trust architecture of claim 3, wherein, The method of establishing a repeated access restriction strategy and judging repeated access based on the data access request information comprises: The repeated access restriction strategy comprises a limitation on the number of accesses by a same user or a same login port address within a fixed time period; The number of data access applications by a same user or a same login port address to the same or similar content is determined according to the data access request information; A preset similarity solving strategy is used to determine the similarity of the content accessed by the same user or the same login port address; A similarity threshold is set, and the data access application that meets the similarity threshold is recorded once.

5. The data security access control method based on a zero trust architecture of claim 4, wherein, The method of setting a dynamic access sequence based on the confidentiality level comprises: A time factor is introduced into the mask data and the sub-code data, so that the sub-code data derived from the mask data each time is limited to be matched and verified within a preset time period.

6. The data security access control method based on a zero trust architecture of claim 5, wherein, The method of integrating the sub-code data into the data access request information comprises: An effective period is associated with each sub-code data to prevent repeated occupation of the sub-code data; When the sub-code data exceeds the effective period, the system automatically generates new sub-code data and updates the data access request information.

7. The data security access control method based on a zero trust architecture according to claim 6, characterized in that, The method further comprises: When the access application cannot be completed within a preset time period, the data access is terminated, and the user is prompted to perform a data access request operation again.

8. A data security access control system based on a zero trust architecture, applying the method according to any one of claims 1 to 7, characterized in that, The method comprises the following steps: A data acquisition module is configured to acquire data access request information of a user in a power network system configured with a zero-trust architecture, and extract basic information of the user accessing the power network system from the data access request information. The basic information includes account information of the user and a region in which the user accesses the power network system. A data node acquisition module is configured to acquire a power network region corresponding to user query data based on the basic information, and acquire data nodes for data interaction in the region based on the power network region corresponding to the user query data. A division module is configured to divide the data nodes into different confidential levels, and set a dynamic access sequence based on the confidential levels. The dynamic access sequence is configured to perform address information mask encryption on the data nodes that meet a preset confidential level threshold. A judgment module is configured to establish a repeated access restriction strategy, and perform repeated access judgment in combination with the data access request information. 9.An electronic device comprising a memory and a processor, the memory storing a computer program, wherein, The processor executes the computer program to implement the steps of the data security access control method based on the zero-trust architecture according to any one of claims 1-7.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the data security access control method based on the zero-trust architecture according to any one of claims 1-7.

Images