CN115766074A - Authority control method, device, medium and equipment of service object - Google Patents

Abstract

The embodiment of the invention provides a method, a device, a medium and equipment for controlling the authority of a service object, wherein the method comprises the following steps: receiving a permission list request message sent by a service object; extracting attribute information of the service object based on the permission list request message; determining an access address corresponding to the permission list request message based on the corresponding relation between the attribute information and the preset message information; determining the authority corresponding to the authority list request message based on the corresponding relation between the attribute information and the preset authority information; and sending the access address and the authority to the service object so that the service object updates the local authority list and performs service access based on the local authority list. According to the embodiment of the invention, the attribute information in the permission list request message is extracted, and the unified management of the permission of the service object is realized through the corresponding rule of the attribute information and the preset message information and the corresponding rule of the preset permission information, so that the safety of the power system is improved.

Description

Method, device, medium, and equipment for authority control of business objects

technical field

The present invention relates to the technical field of authority control, in particular to a method, device, medium and equipment for authority control of business objects.

Background technique

At present, during the communication process between the power service terminal and the power service application server, every time a power service application or power service terminal is connected, the power service application or power service terminal needs to be separately configured with authority. There are many types of business terminals, and each separate configuration of permissions is likely to cause problems such as inconsistent permission configuration, repeated permission configuration, wrong permission configuration, and untimely update of permissions, which will cause security risks for power business applications and terminals, and bring security threats to the operation of the power system .

Contents of the invention

Therefore, the technical problem to be solved by the present invention is to overcome the defect that the business object authority control process in the prior art is likely to cause power system security threats, thereby providing a business object authority control method, device, medium, and equipment.

According to the first aspect, an embodiment of the present invention provides a method for controlling authority of a business object, including: receiving a permission list request message sent by the business object; extracting attribute information of the business object based on the permission list request message; The corresponding relationship with the preset message information determines the access address corresponding to the permission list request message, and the preset message information is the attribute information adaptation rule corresponding to the attribute information; after determining the access address corresponding to the permission list request message Afterwards, based on the corresponding relationship between the attribute information and the preset permission information, determine the permission corresponding to the permission list request message, and the preset permission information is the permission corresponding to the attribute information; send the access address and permission to the business object to update the business object Local permission list, and business access based on the local permission list.

Optionally, the attribute information includes: power business target, power business object type, access IP address, port, power business security level, message type, power business type and business data contained in the message type, based on the permission list request message , to extract the attribute information of the business object, including:

Based on the preset message information storage rules, extract at least one of the access IP address, port, power service security level, message type, power service type, and service data contained in the message type stored in the corresponding location in the permission list request message One: according to the corresponding relationship between the access IP address, the port and the power service target and the power service object type, determine the power service target and the power service object type corresponding to the permission list request message.

Optionally, based on the correspondence between attribute information and preset message information, determining the access address corresponding to the permission list request message includes: judging whether the attribute information is based on the correspondence between the power service security level and preset message information Pass the verification; if the attribute information passes the verification, use the access IP address and port as the access address corresponding to the permission list request message.

Optionally, based on the correspondence between the power service security level and the preset message information, judging whether the attribute information passes the verification includes: determining the message adaptation rule based on the correspondence between the power service security level and the preset message information ;Based on the message adaptation rules, determine whether the message type, power service type, and business data contained in the message type are compatible with the message adaptation rules; If it matches the packet adaptation rule, it is determined that the attribute information passes the verification.

Optionally, based on the correspondence between the attribute information and the preset permission information, determining the permission corresponding to the permission list request message includes: determining the corresponding relationship with the permission List the permissions corresponding to the request message.

Optionally, the authority control method of the business object also includes: authenticating the business object, obtaining the authentication certificate and the object IP corresponding to the authentication certificate; obtaining the certificate and IP of the business object; when the certificate is the same as the authentication certificate, and the IP and IP When the object IPs are the same, it is determined that the business object is legal.

Optionally, the permission control method of the business object further includes: receiving information that the business object fails to perform business access based on the local permission list; based on the information, reducing the trust value of the business object, and when the trust value is lower than the preset trust threshold , to disconnect from the business object.

According to the second aspect, an embodiment of the present invention provides a device for controlling authority of a business object, including: a message receiving unit configured to receive a permission list request message sent by the business object; an attribute information extracting unit configured to The permission list request message extracts the attribute information of the business object; the access address determination unit is configured to determine the access address corresponding to the permission list request message based on the corresponding relationship between the attribute information and the preset message information, and the preset message The information is an attribute information adaptation rule corresponding to the attribute information; the authority determining unit is configured to determine the authority corresponding to the authority list request message based on the correspondence between the attribute information and the preset authority information, and the preset authority information is the corresponding attribute information the authority; the sending unit is configured to send the access address and the authority to the business object, so that the business object updates the local authority list, and performs business access based on the local authority list.

Optionally, the access address determination unit includes: a verification judgment subunit configured to judge whether the attribute information passes the verification based on the correspondence between the power service security level and the preset message information; the access address determination subunit, if The attribute information is verified, and the access IP address and port are used as the access address corresponding to the permission list request message.

Optionally, the verification and judgment subunit includes: a message adaptation rule determination subunit configured to determine the message adaptation rule based on the correspondence between the power service security level and preset message information; the adaptation judgment subunit The unit is configured to determine whether the message type, power service type, and service data contained in the message type are compatible with the message adaptation rule based on the message adaptation rule; the verification result sub-unit is configured to be in the message If the service data contained in the type, power service type, and message type match the message adaptation rule, it is determined that the attribute information passes the verification.

According to a third aspect, an embodiment of the present invention provides a non-transitory computer-readable storage medium. The non-transitory computer-readable storage medium stores computer instructions. When the computer instructions are executed by a processor, any one of the first aspect can be realized. The permission control method of the business object described in the implementation manner.

According to a fourth aspect, an embodiment of the present invention provides a computer device, including at least one processor; and a memory communicatively connected to the at least one processor; wherein, the memory stores instructions executable by the at least one processor, The instruction is executed by at least one processor, so as to execute the method for controlling authority of a business object as described in any implementation manner of the first aspect.

The technical solution of the present invention has the following advantages:

A permission control method for a business object provided by the present invention includes: receiving a permission list request message sent by the business object; extracting attribute information of the business object based on the permission list request message; Correspondence, determine the access address corresponding to the permission list request message; preset message information is the attribute information adaptation rule corresponding to the attribute information; based on the corresponding relationship between attribute information and preset permission information, determine Corresponding authority; the default authority information is the authority corresponding to the attribute information; send the access address and authority to the business object, so that the business object can update the local authority list, and perform business access based on the local authority list. In the embodiment of the present invention, by extracting the attribute information in the permission list request message, the attribute information is summarized, and the corresponding rules between the attribute information and the preset message information and the corresponding rules between the preset permission information are used to make the business object Obtain the permissions corresponding to the permission list request message, realize the unified management of business object permissions, provide refined permission management methods, and meet the permission control requirements of different business access in different business objects, thereby improving the security of the power system.

Description of drawings

In order to more clearly illustrate the specific implementation of the present invention or the technical solutions in the prior art, the following will briefly introduce the accompanying drawings that need to be used in the specific implementation or description of the prior art. Obviously, the accompanying drawings in the following description The drawings show some implementations of the present invention, and those skilled in the art can obtain other drawings based on these drawings without any creative work.

FIG. 1 is a flow chart of a specific example of a method for controlling authority of a business object provided by an embodiment of the present invention;

FIG. 2 is a flow chart of a specific example of a method for controlling authority of a business object provided by an embodiment of the present invention;

FIG. 3 is a structural example diagram of a specific example of an apparatus for controlling authority of a business object provided by an embodiment of the present invention;

Fig. 4 is a structural example diagram of a computer device in an embodiment of the present invention.

Detailed ways

The technical solutions of the present invention will be clearly and completely described below in conjunction with the accompanying drawings. Apparently, the described embodiments are some of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

In addition, the technical features involved in the different embodiments of the present invention described below may be combined with each other as long as there is no conflict with each other.

The authority control method and device of a business object provided in this embodiment are applied to a power security access gateway. The power security access gateway is a gateway device connected to a business Access and permission assignment.

An embodiment of the present invention provides a method for controlling authority of a business object, as shown in FIG. 1 , including:

S101. Receive a permission list request message sent by a business object.

Specifically, the service object includes an electric service application or an electric service terminal. The permission list request message refers to the local permission list update request sent by the power service application or the power service terminal for the permissions corresponding to the power service application or the power service terminal, so that the power service application or the power service terminal is based on the local permission list. permissions for business access.

S102. Based on the authorization list request message, attribute information of the business object is extracted.

Specifically, extracting the attribute information of the business object based on the authorization list request message refers to extracting the attribute information of the business object based on a preset message information storage rule.

In practical applications, based on the authority list request message, the attribute information of the extracted business object is stored in the database, so that based on the authority list request message, the attribute information of the business object is summarized so that there are business objects When connected to the power system, it provides a data basis for the authority management of business objects.

S103. Based on the correspondence between the attribute information and the preset message information, determine an access address corresponding to the permission list request message.

Specifically, the preset message information refers to an adaptation rule with attribute information. Based on the corresponding relationship between attribute information and preset message information, determining the access address corresponding to the permission list request message refers to combining the access IP address included in the attribute information with The port is used as the access address corresponding to the permission list request message.

In practical applications, the attribute information adaptation rules corresponding to the attribute information may be determined according to the power service security level, that is, different power service security levels have corresponding attribute information adaptation rules. When the attribute information satisfies the adaptation rule of the attribute information, determine the access address corresponding to the permission list request message, and combine the access address corresponding to the permission list request message with the subsequently determined permissions corresponding to the permission list request message, Send it to the business object together, so that the business object updates the local authority list, and performs business access based on the access address corresponding to the authority list request message and the authority corresponding to the authority list request message in the local authority list.

S104. After determining the access address corresponding to the permission list request message, determine the permission corresponding to the permission list request message based on the corresponding relationship between the attribute information and the preset permission information.

Specifically, the preset permission information refers to the preset permission corresponding to the attribute information. The preset permissions include read permissions, write permissions, read and write permissions, or other permissions, which are not specifically limited in this application and can be selected according to actual working conditions.

In practical applications, if the access address corresponding to the permission list request message cannot be determined based on the correspondence between the attribute information and the preset message information, there is no need to determine the permission corresponding to the permission list request message.

In practical applications, the storage form of the preset permission information is stored in a database, which is independent from the database storing attribute information. After determining the authority corresponding to the authority list request message, the above-mentioned determined access address corresponding to the authority list request message is sent to the business object, so that the business object updates the local authority list, and based on the local authority list The access address corresponding to the permission list request message and the permission corresponding to the permission list request message are used for business access.

S105. Send the access address and the authority to the business object, so that the business object updates the local authority list, and performs service access based on the local authority list.

In practical applications, after the business object receives the access address and permission, it updates the permission list in the local permission list of the business object. When a business object needs to perform business access, it needs to query the local permission list. Only when the corresponding access address and permission exist in the local permission list, access is granted; otherwise, the access action is directly rejected on the business object side.

In the embodiment of the present invention, by extracting the attribute information in the permission list request message, the attribute information is summarized, and the corresponding rules between the attribute information and the preset message information and the corresponding rules between the preset permission information are used to make the business object Obtain the permissions corresponding to the permission list request message, realize the unified management of business object permissions, provide refined permission management methods, and meet the permission control requirements of different business access in different business objects, thereby improving the security of the power system.

In an optional embodiment, the above attribute information includes: power service target, power service object type, access IP address, port, power service security level, message type, power service type, and service data included in the message type. Correspondingly, in the above step S102, the process of extracting the attribute information of the business object based on the permission list request message specifically includes:

(1) Based on the preset message information storage rules, extract the access IP address, port, power service security level, message type, power service type and business data contained in the message type stored in the corresponding location in the permission list request message at least one of the

Specifically, the preset message information storage rule refers to access to at least one of the IP address, port, power service security level, message type, power service type, and service data contained in the message type, and the storage location of the message field. Correspondence, that is, according to the corresponding storage location in the permission list request message, the extraction of the access IP address, port, power service security level, message type, power service type, and service data contained in the message type is realized.

In practical applications, the power service target refers to a target device, a target terminal or a target application for a business object to access power services. The power business object type refers to the type of business object. The access IP address and port refer to the target IP address and target port of the business object for business access. The power business security level refers to the corresponding security level for the business object to access the power business. The power business security level can be level 1, level 2, level 3 or other security levels, among which level 3 can correspond to the highest security level, or level 1 Corresponding to the highest security level, this application does not specifically limit it, as long as it can be used to reflect different security levels for business access of business objects. The message type refers to the type of the power service message sent by the business object when accessing the power service. The business data contained in the power business type and the message type refers to the corresponding power business type when the business object accesses the power business, and the business data contained in the message type refers to different business data contained in different message types , such as the name of the authentication certificate included in the certificate acquisition message type and the address of the power service terminal corresponding to the name of the authentication certificate.

In practical applications, the access IP address, port, power service security level, message type, power service type, and the storage location of the service data contained in the message type in the permission list request message can be set according to the actual situation. There is no specific limitation on this, as long as it can be used to reflect the extraction of message attribute information according to the message storage location.

(2) Determine the power service target and power service object type corresponding to the permission list request message according to the corresponding relationship between the access IP address, the port, and the power service target and power service object type.

In practical applications, as shown in Table 1, Table 1 exemplarily shows the correspondence between access IP addresses, ports, power service objects, and power service object types.

Table 1

Access IP address port Power Business Goals Power Business Object Type The first access IP address first port first goal first type The first access IP address second port second goal second type ... ... ... ... Nth access IP address Nth port Nth target Type N

In practical applications, based on the difference between the access IP address and the port, and according to the corresponding relationship between the access IP address, the port, and the power service target, the target of the power service access of the business object can be determined, that is, the power service target can be determined. According to the corresponding relationship between the access IP address, port and the type of power business object, the type of business object can be determined, that is, the target IP address and target port for business access through the business object, and the type of access to be determined by the business object, so as to determine Electricity business object type.

Through the implementation of this embodiment, the access IP address, port, power service security level, message type, power service type, and message type contained in the access IP address, port, power service security level, message type, power service type, and message type are extracted from the permission list through the preset message information storage rules. At least one of the business data, and extract the power business target and power business object type based on the access IP address and port, so as to realize the extraction and summary of the attribute information of the business object, so that when a business object is connected to the power system, it is a business Object rights management provides the data foundation.

In an optional embodiment, in the above step S103, the process of determining the access address corresponding to the permission list request message based on the correspondence between the attribute information and the preset message information specifically includes:

(1) Based on the corresponding relationship between the security level of the power service and the preset message information, it is judged whether the attribute information passes the verification.

Specifically, judging whether the attribute information passes the check is a process of judging whether the permission list request message sent by the business object meets the security level of the corresponding electric power business. In practical applications, if the attribute information fails to pass the verification, it means that the permission list request message sent by the business object is illegal or the request is wrong, and the access IP address and port cannot be used as the access address corresponding to the permission list request message. , the business object corresponding to the sent permission list request message does not need to perform the process involved in the above step S104, that is, the corresponding business object cannot update the local permission list.

(2) If the attribute information passes the verification, use the access IP address and port as the access address corresponding to the permission list request message.

In practical applications, using the access IP address and port as the access address corresponding to the permission list request message means that the business object corresponding to the sent permission list request message can obtain the access address, and obtain the access address through the process involved in the above step S104. Corresponding authority, thereby updating the local authority list of the corresponding business object.

In an optional embodiment, in the above steps, based on the corresponding relationship between the power service security level and the preset message information, the process of judging whether the attribute information passes the verification includes:

(1) Based on the corresponding relationship between the power service security level and the preset message information, determine the message adaptation rule.

Specifically, according to the different power service security levels, based on the corresponding relationship between the power service security level and preset message information, it is determined that the message adaptation rule means that when the power service security level is higher, the corresponding message The greater the number of items that need to match the rule in the matching rule.

In practical applications, when the security level of the power service is the lowest, according to the corresponding relationship between the security level of the power service and the preset message information, the determined message adaptation rules can be considered to be adapted if at least one of them is the same. When the security level of the power service is the highest, according to the corresponding relationship between the security level of the power service and the preset message information, the determined message adaptation rules may be partially or completely identical before being considered suitable.

(2) Based on the message adaptation rules, determine whether the message type, the power service type, and the service data included in the message type are compatible with the message adaptation rules.

In practical applications, the process of judging whether the message type, power service type, and service data contained in the message type is compatible with the message adaptation rule based on the message adaptation rule refers to the Whether at least one of the message type, power service type, and service data contained in the message type is the same as the content required in the message adaptation rule. For example, the message adaptation rule can stipulate that the message type is the same, and the message type contains or, the power service type is the same, and the business data contained in the message type is partly the same. This application does not specifically limit this, and it can be set according to actual working conditions.

(3) If the message type, the power service type, and the service data included in the message type match the message adaptation rule, it is determined that the attribute information passes the verification.

By implementing this embodiment, it is determined whether the attribute information satisfies the message adaptation rule through the power service security level, and when the attribute information meets the attribute information adaptation rule, determine the access address corresponding to the permission list request message, and link it with the The access address corresponding to the permission list request message and the subsequently determined permissions corresponding to the permission list request message are sent to the business object together, so that the business object updates the local permission list, and based on the local permission list and the permission list request The access address corresponding to the message and the authority corresponding to the authority list request message are used for business access, so as to realize the unified management of business object authority, provide refined authority management mode, and meet the authority control requirements of different business access in different business objects. Thereby improving the security of the power system.

In an optional embodiment, in the above step S104, the process of determining the authority corresponding to the authority list request message based on the correspondence between the attribute information and the preset authority information includes:

The authority corresponding to the authority list request message is determined based on the corresponding relationship between the power service target, the power service object type, and the preset authority information.

Specifically, based on the corresponding relationship between the power business target, the power business object type, and the preset permission information, determining the permission corresponding to the permission list request message means that the preset permission information is the same as the power business target and the power business object type. The corresponding authority of is used as the authority corresponding to the authority list request message.

In practical applications, the determination of the authority corresponding to the authority list request message is after determining the access address corresponding to the authority list request message, that is, when the attribute information fails to pass the verification, there is no need to assign authority, and the attribute information does not pass the verification. Refer to the description of step S102 in the above-mentioned embodiment for details about the process of passing the verification, and details are not repeated here.

By implementing this embodiment, the authority corresponding to the authority list request message is determined through the preset authority information, and the determined access address corresponding to the authority list request message is sent to the business object, so that the business object updates the local The authority list, and based on the access address corresponding to the authority list request message in the local authority list, and the authority corresponding to the authority list request message, the service access is performed. Realize the unified management of business object permissions, provide refined permission management methods, and meet the permission control requirements of different business access in different business objects, thereby improving the security of the power system.

In an optional embodiment, in order to ensure that the connection with the business object is safe and compliant, before receiving the permission list request message sent by the business object, the method for controlling the permission of the business object in this embodiment further includes:

(1) Authenticate the business object, and obtain the authentication certificate and the object IP corresponding to the authentication certificate.

In practical applications, the authentication of the business object may be performed through SM2 national secret algorithm authentication. The SM2 national secret algorithm is a relatively mature technology, so I won't repeat it here.

Specifically, obtaining the authentication certificate and the object IP corresponding to the authentication certificate refers to obtaining the name of the SM2 terminal certificate and the IP address of the power service terminal corresponding to the name of the terminal certificate.

(2) Obtain the certificate and IP of the business object.

In practical applications, obtaining the certificate and IP of the business object refers to obtaining the name of the authentication certificate and the IP address of the business object that sends the permission list request message.

(3) When the certificate is the same as the authentication certificate, and the IP is the same as the IP of the object, it is determined that the business object is legal.

An embodiment of the present invention provides a method for controlling authority of a business object, as shown in FIG. 2 , including:

S201. Receive a permission list request message sent by a business object.

S202. Based on the permission list request message, attribute information of the business object is extracted.

S203. Based on the correspondence between the attribute information and the preset message information, determine an access address corresponding to the permission list request message.

S204. After determining the access address corresponding to the permission list request message, determine the permission corresponding to the permission list request message based on the corresponding relationship between the attribute information and the preset permission information.

S205. Send the access address and the authority to the business object, so that the business object updates the local authority list, and performs service access based on the local authority list.

Wherein, for the content of step S201-step S205, refer to the related description of step S101-step S105 in any of the above-mentioned embodiments in detail, and details are not repeated here.

S206. Receive information that the business object fails to access the business based on the local authority list.

Specifically, receiving the information about the failure of the business object to perform business access based on the local authority list refers to recording the number of failures of the business object to perform business access based on the local authority list.

S207. Based on the information, reduce the trust value of the business object, and disconnect the connection with the business object when the trust value is lower than the preset trust threshold.

Specifically, based on the information, reducing the trust value of the business object refers to reducing the trust value of the corresponding business object each time the business object performs business access based on the local authority list.

In practical applications, the initial value of the trust value of the business object may be 99, 101, 200 or other numbers. Every time a business object conducts business access based on the local authority list, the reduced trust value of the corresponding business object may be 10, 20, 15 or other values. The preset trust threshold may be 59, 62, 95 or other numerical values.

Through the implementation of this embodiment, by extracting the attribute information in the permission list request message, the attribute information is summarized, and the corresponding rules between the attribute information and the preset message information and the corresponding rules between the preset permission information make the business The object obtains the authority corresponding to the authority list request message, realizes the unified management of the authority of the business object, provides a refined authority management method, meets the authority control requirements of different business access in different business objects, and access failure information based on the business object , when the trust value of the business object is lower than the preset trust threshold, the communication connection with the corresponding business object is disconnected, which further improves the security of the power system.

The embodiment of the present invention provides an authority control device for business objects, as shown in FIG.

The message receiving unit 31 is configured to receive the permission list request message sent by the business object. For the specific process, reference may be made to the description of step S101 in the foregoing embodiments, and details are not repeated here.

The attribute information extracting unit 32 is configured to extract the attribute information of the business object based on the permission list request message. For the specific process, reference may be made to the description of step S102 in the foregoing embodiments, and details are not repeated here.

The access address determining unit 33 is configured to determine the access address corresponding to the permission list request message based on the correspondence between attribute information and preset message information, where the preset message information is an attribute information adaptation rule corresponding to the attribute information. For the specific process, reference may be made to the description of step S103 in the foregoing embodiments, and details are not repeated here.

The authority determination unit 34 is configured to determine the authority corresponding to the authority list request message based on the correspondence between attribute information and preset authority information, where the preset authority information is the authority corresponding to the attribute information. For the specific process, reference may be made to the description of step S104 in the foregoing embodiments, and details are not repeated here.

The sending unit 35 is configured to send the access address and the authority to the business object, so that the business object updates the local authority list, and performs service access based on the local authority list. For the specific process, reference may be made to the description of step S105 in the foregoing embodiments, and details are not repeated here.

In an optional implementation manner, the access address determination unit 33 includes: a verification and judgment subunit, and an access address determination subunit.

The verification judgment subunit is configured to judge whether the attribute information passes the verification based on the corresponding relationship between the power service security level and the preset message information. For the specific process, reference may be made to the description of step S103 in the foregoing embodiments, and details are not repeated here.

The access address determination subunit, if the attribute information passes the verification, uses the access IP address and port as the access address corresponding to the permission list request message. For the specific process, reference may be made to the description of step S103 in the foregoing embodiments, and details are not repeated here.

In an optional implementation manner, the verification and judgment subunit includes: a packet adaptation rule determination subunit, an adaptation judgment subunit, and a verification result subunit.

The message adaptation rule determination subunit is configured to determine the message adaptation rule based on the correspondence between the power service security level and preset message information. For the specific process, reference may be made to the description of step S103 in the foregoing embodiments, and details are not repeated here.

The adaptation judging subunit is configured to judge whether the message type, the power service type, and the service data contained in the message type are compatible with the message adaptation rule based on the message adaptation rule. For the specific process, reference may be made to the description of step S103 in the foregoing embodiments, and details are not repeated here.

The verification result subunit is configured to determine that the attribute information passes the verification when the message type, the power service type, and the service data contained in the message type match the message adaptation rule. For the specific process, reference may be made to the description of step S103 in the foregoing embodiments, and details are not repeated here.

In the embodiment of the present invention, the attribute information in the permission list request message is extracted by the message receiving unit and the attribute information extracting unit, and the attribute information is summarized by the access address determining unit and the permission determining unit respectively, and the attribute information and the preset message The corresponding rules of the information and the corresponding rules of the preset authority information enable the business object to obtain the authority corresponding to the authority list request message, realize the unified management of the authority of the business object, provide a refined authority management method, and meet the needs of different business objects. The authority control requirements for different business access, thus improving the security of the power system.

An embodiment of the present invention also provides a non-transitory computer storage medium. The computer storage medium stores computer-executable instructions, and the computer-executable instructions can execute the method for controlling the authority of a business object in any method embodiment above. Wherein, the storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), a random access memory (Random Access Memory, RAM), a flash memory (Flash Memory), a hard disk (Hard Disk Drive, abbreviation: HDD) or a solid-state drive (Solid-State Drive, SSD), etc.; the storage medium may also include a combination of the above-mentioned types of memory.

An embodiment of the present invention also provides a computer device, as shown in FIG. 4 , which is a schematic structural diagram of a computer device provided in an optional embodiment of the present invention. The computer device may include at least one processor 41, at least A communication interface 42, at least one communication bus 43 and at least one memory 44, wherein the communication interface 42 may include a display screen (Display), a keyboard (Keyboard), and the optional communication interface 42 may also include a standard wired interface and a wireless interface. The memory 64 may be a high-speed RAM memory (Random Access Memory, volatile random access memory), or a non-volatile memory, such as at least one disk memory. Optionally, the memory 44 may also be at least one storage device located away from the aforementioned processor 41 . Wherein the processor 41 can be combined with the device described in FIG. 3 , the application program is stored in the memory 44, and the processor 41 calls the program code stored in the memory 44 to perform the authority control of the business object described in any of the above method embodiments method steps.

Wherein, the communication bus 43 may be a peripheral component interconnect (PCI for short) bus or an extended industry standard architecture (EISA for short) bus or the like. The communication bus 43 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is used in FIG. 4 , but it does not mean that there is only one bus or one type of bus.

Wherein, the memory 44 may include a volatile memory (English: volatile memory), such as a random-access memory (English: random-access memory, abbreviated as RAM); the memory may also include a non-volatile memory (English: non-volatile memory), such as flash memory (English: flash memory), hard disk (English: hard diskdrive, abbreviated: HDD) or solid-state hard disk (English: solid-state drive, abbreviated: SSD); memory 44 can also include the above-mentioned types of memory The combination.

Wherein, the processor 41 may be a central processing unit (English: central processing unit, abbreviated: CPU), a network processor (English: network processor, abbreviated: NP) or a combination of CPU and NP.

Wherein, the processor 41 may further include a hardware chip. The aforementioned hardware chip may be an application-specific integrated circuit (English: application-specific integrated circuit, abbreviation: ASIC), a programmable logic device (English: programmable logic device, abbreviation: PLD) or a combination thereof. The above-mentioned PLD can be a complex programmable logic device (English: complex programmable logic device, abbreviation: CPLD), field-programmable logic gate array (English: field-programmable gate array, abbreviation: FPGA), general array logic (English: generic array logic , Abbreviation: GAL) or any combination thereof.

Optionally, memory 44 is also used to store program instructions. The processor 41 may invoke program instructions to implement the method for controlling the authority of a business object in any embodiment of the present invention.

Apparently, the above-mentioned embodiments are only examples for clear description, rather than limiting the implementation. For those of ordinary skill in the art, other changes or changes in different forms can be made on the basis of the above description. It is not necessary and impossible to exhaustively list all the implementation manners here. And the obvious changes or changes derived therefrom are still within the scope of protection of the present invention.

Claims (12)

1. A permission control method for a business object, comprising: Receive the permission list request message sent by the business object; Extracting attribute information of the business object based on the permission list request message; Determining an access address corresponding to the permission list request message based on the correspondence between the attribute information and preset message information, where the preset message information is an attribute information adaptation rule corresponding to the attribute information; After determining the access address corresponding to the permission list request message, based on the corresponding relationship between the attribute information and preset permission information, determine the permission corresponding to the permission list request message, and the preset permission information is The authority corresponding to the attribute information; Sending the access address and the authority to the business object, so that the business object updates a local authority list, and performs service access based on the local authority list. 2. The authority control method for business objects according to claim 1, wherein the attribute information includes: power business target, power business object type, access IP address, port, power business security level, message type, The type of power service and the service data contained in the message type, The extracting the attribute information of the business object based on the permission list request message includes: Based on the preset message information storage rules, extract the access IP address, the port, the power service security level, the message type, and the power service stored in the corresponding position in the permission list request message type and at least one of the business data contained in the message type; Determine the power service target and the power service object type corresponding to the permission list request message according to the corresponding relationship between the access IP address, the port, the power service target, and the power service object type . 3. The authority control method of a business object according to claim 2, wherein the access address corresponding to the authority list request message is determined based on the correspondence between the attribute information and the preset message information ,include: Based on the corresponding relationship between the power service security level and preset message information, determine whether the attribute information passes the verification; If the attribute information passes the verification, use the access IP address and the port as the access address corresponding to the permission list request message. 4. The authority control method of a business object according to claim 3, characterized in that, based on the corresponding relationship between the power service security level and preset message information, judging whether the attribute information passes the verification includes : Determine message adaptation rules based on the correspondence between the power service security level and preset message information; Based on the message adaptation rule, judging whether the message type, the power service type, and the service data contained in the message type are compatible with the message adaptation rule; If the message type, the power service type, and the service data included in the message type match the message adaptation rule, it is determined that the attribute information passes the verification. 5. The authority control method for a business object according to claim 2, wherein the determination of the authority corresponding to the authority list request message based on the corresponding relationship between the attribute information and the preset authority information includes : Based on the correspondence between the power service object, the power service object type, and preset permission information, the permission corresponding to the permission list request message is determined. 6. The authority control method of the business object according to claim 1, characterized in that, before the authority list request message sent by the receiving business object, it also includes: Authenticating the business object, obtaining the authentication certificate and the object IP corresponding to the authentication certificate; Obtain the certificate and IP of the business object; When the certificate is the same as the authentication certificate, and the IP is the same as the IP of the object, it is determined that the business object is legal. 7. The authority control method of a business object according to claim 1, wherein the method further comprises: receiving information that the business object fails to perform business access based on the local permission list; Based on the information, reduce the trust value of the business object, and disconnect the connection with the business object when the trust value is lower than a preset trust threshold. 8. A permission control device for a business object, characterized in that it comprises: The message receiving unit is configured to receive the permission list request message sent by the business object; An attribute information extraction unit configured to extract attribute information of the business object based on the permission list request message; The access address determination unit is configured to determine the access address corresponding to the permission list request message based on the correspondence between the attribute information and preset message information, and the preset message information corresponds to the attribute information The attribute information adaptation rules of ; The authority determining unit is configured to determine the authority corresponding to the authority list request message based on the corresponding relationship between the attribute information and preset authority information, and the preset authority information is the authority corresponding to the attribute information; The sending unit is configured to send the access address and the authority to the business object, so that the business object updates a local authority list, and performs service access based on the local authority list. 9. The authority control device for business objects according to claim 8, wherein the access address determining unit comprises: The verification judgment subunit is configured to judge whether the attribute information passes the verification based on the correspondence between the power service security level and the preset message information; The access address determining subunit, if the attribute information passes the verification, uses the access IP address and the port as the access address corresponding to the permission list request message. 10. The authority control device for business objects according to claim 9, wherein the verification and judgment subunit includes: The message adaptation rule determination subunit is configured to determine a message adaptation rule based on the correspondence between the power service security level and preset message information; An adaptation judging subunit configured to judge the message type, the power service type, and the service data included in the message type and the message adaptation rule based on the message adaptation rule whether it fits; The verification result subunit is configured to determine whether the message type, the power service type, and the service data contained in the message type match the message adaptation rule The above attribute information has passed the verification. 11. A non-transitory computer-readable storage medium, characterized in that the non-transitory computer-readable storage medium stores computer instructions, and when the computer instructions are executed by a processor, any one of claims 1-7 is implemented. The permission control method of the business object described in the item. 12. A computer device, characterized in that it comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, The instructions are executed by the at least one processor, so as to execute the method for controlling authority of a business object according to any one of claims 1-7.

Images