Data security acquisition system and security protection method in multi-energy complementary scene

Abstract

A data security acquisition system and security protection method in a multi-energy complementation scene comprises a data acquisition terminal, the data acquisition terminal performs data acquisition on a device to be acquired, the data acquisition terminal is connected with an edge computing gateway, the edge computing gateway is connected with a security access area, and a network server is connected with the security access area. The network server is connected with the application server, and the to-be-collected equipment comprises a hydroelectric generating set, wind power generation equipment and photovoltaic equipment. Aiming at real-time acquisition and calculation of multi-source heterogeneous data such as unit working conditions, operation data and environmental factors, a distributed acquisition and calculation architecture and a complete system suitable for water-wind-light multi-energy complementation are developed, the requirements of real-time acquisition, edge calculation and safe transmission are met, and flexible deployment and long-term reliable operation can be realized.

Description

Technical Field

[0001] The present invention relates to the technical field of data acquisition of power grid information transmission systems, and in particular to a data security acquisition system and a security protection method in a multi-energy complementary scenario. Background Art

[0002] At present, the distributed data collection and monitoring systems used in hydropower, new energy, distribution networks and other scenarios are all targeted at a single scenario and cannot be effectively applied to water, wind and solar multi-energy complementary systems with a wide distribution range, diverse data types, and higher requirements for data collection and processing performance and security protection levels. The wide distribution of data collection terminals at hydropower, wind and solar power stations makes it difficult to ensure the secure transmission of data.

[0003] There are also technologies for protecting energy data security in the prior art. For example, Chinese patent document CN117527325A records a method and system for encrypting and decrypting data of new energy stations. CN114285615A records a method and system for encrypting new energy data. "Design and Implementation of Secure Transmission Scheme for Energy Data", Jiang Ke and Feng Yutian, records a set of secure transmission schemes based on digital signature technology and digital encryption technology in cryptography.

[0004] Among them, the core of CN117527325A mainly adopts AES algorithm encryption, CN114285615A adopts pseudo-random encryption, and "Design and Implementation of Secure Transmission Scheme for Energy Data" mainly adopts encryption algorithms such as AES and ECC. The above patents and papers mainly consider the encryption algorithm itself, and do not consider the security of the data itself. Therefore, if the encryption algorithm is deciphered, the data may be cracked. Summary of the invention

[0005] The technical problem to be solved by the present invention is to provide a data security collection system and a security protection method in a multi-energy complementary scenario, propose a full-chain security protection strategy, ensure the privacy and security of data transmission, and achieve high security protection for data collection and calculation in the multi-energy complementary system.

[0006] In order to solve the above technical problems, the technical solution adopted by the present invention is: A data security collection system in a multi-energy complementary scenario includes a data collection terminal, which collects data from a device to be collected. The data collection terminal is connected to an edge computing gateway, the edge computing gateway is connected to a secure access area, a network server is connected to the secure access area, and the network server is connected to an application server. The device to be collected includes a hydropower unit, a wind power generation equipment, and a photovoltaic device.

[0007] The above-mentioned secure access area includes secure access devices connected to the edge computing gateway and the network server respectively, and an isolation device is provided between the secure access devices at both ends.

[0008] The above-mentioned isolation device includes a forward isolation device and a reverse isolation device.

[0009] The forward isolation device and the reverse isolation device are connected in parallel.

[0010] The security protection method using the above data security collection system includes the following steps: Step 1. Prepare the data acquisition terminal and edge computing gateway, and connect the data acquisition terminal to the hydropower unit, wind power generation equipment, and photovoltaic equipment; Step 2: Disorder the data to be sent and re-form new data; Step 3: Encrypt the new data segments and transmit them to the edge computing gateway through the communication network; Step 4: The edge computing gateway decrypts and verifies the data, and reassembles the data to restore it to its original state; Step 5: Transmit the data to the application server through the secure access area.

[0011] The above-mentioned security protection method also includes: Terminal node security authentication: Only activated and bound terminal nodes can access the gateway to prevent unauthorized devices from attacking the system; Preparation of data to be sent: when the water, wind and light data are collected and ready to be sent, the data to be sent is encoded and the encoding is shuffled; Segment encryption: segment the data after random encoding.

[0012] In the above-mentioned preparation of the data to be sent, when the encoding is performed in a disorderly order, the data is swapped front to back.

[0013] In the above-mentioned preparation of the data to be sent, the number of times the data is swapped forward and backward is limited.

[0014] The above-mentioned secure access device is a firewall.

[0015] The above-mentioned data acquisition terminals and edge computing gateways are provided in multiple numbers, and the data acquisition terminals and edge computing gateways are cross-connected, and the edge computing gateways are connected to each other.

[0016] The present invention provides a data security collection system and safety protection method in a multi-energy complementarity scenario, which aims at the real-time collection and calculation of multi-source heterogeneous data such as unit operating conditions, operating data, environmental factors, etc., and develops a distributed collection and calculation architecture and a complete system suitable for the multi-energy complementarity of water, wind and solar power. It meets the requirements of real-time collection, edge computing, and secure transmission, and can be flexibly deployed and operate reliably for a long time. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The present invention will be further described below in conjunction with the accompanying drawings and embodiments: Figure 1 It is a system diagram of the data security collection system of the present invention; Figure 2 4 is a structural diagram of a data security collection system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0018] The technical solution of the present invention is described in detail below in conjunction with the accompanying drawings and embodiments.

[0019] A data security collection system in a multi-energy complementary scenario includes a data collection terminal, which collects data from a device to be collected. The data collection terminal is connected to an edge computing gateway, the edge computing gateway is connected to a secure access area, a network server is connected to the secure access area, and the network server is connected to an application server. The device to be collected includes a hydropower unit, a wind power generation equipment, and a photovoltaic device.

[0020] The above-mentioned secure access area includes secure access devices connected to the edge computing gateway and the network server respectively, and an isolation device is provided between the secure access devices at both ends.

[0021] The above-mentioned isolation device includes a forward isolation device and a reverse isolation device.

[0022] The forward isolation device and the reverse isolation device are connected in parallel.

[0023] The security protection method using the above data security collection system includes the following steps: Step 1. Prepare the data acquisition terminal and edge computing gateway, and connect the data acquisition terminal to the hydropower unit, wind power generation equipment, and photovoltaic equipment; Step 2: Disorder the data to be sent and re-form new data; Step 3: Encrypt the new data segments and transmit them to the edge computing gateway through the communication network; Step 4: The edge computing gateway decrypts and verifies the data, and reassembles the data to restore it to its original state; Step 5: Transmit the data to the application server through the secure access area.

[0024] The above-mentioned security protection method also includes: Terminal node security authentication: Only activated and bound terminal nodes can access the gateway to prevent unauthorized devices from attacking the system; Preparation of data to be sent: when the water, wind and light data are collected and ready to be sent, the data to be sent is encoded and the encoding is shuffled; Segment encryption: segment the data after random encoding.

[0025] In the above-mentioned preparation of the data to be sent, when the encoding is performed in a disorderly order, the data is swapped front to back.

[0026] In the above-mentioned preparation of the data to be sent, the number of times the data is swapped forward and backward is limited.

[0027] The above-mentioned secure access device is a firewall.

[0028] The above-mentioned data acquisition terminals and edge computing gateways are provided in multiple numbers, and the data acquisition terminals and edge computing gateways are cross-connected, and the edge computing gateways are connected to each other.

[0029] Through mutual backup between multiple edge computing gateways and data acquisition terminals, the phenomenon of device data loss caused by single device failure is avoided.

[0030] The difference between the present invention and the prior art is that the data itself is taken into consideration. By shuffling the data and encrypting it in segments in advance, even if the encryption algorithm is cracked, the data security is further guaranteed due to the segmentation and shuffling of the data.

[0031] Example: The present invention discloses a data security collection system in a multi-energy complementary scenario, and a level protection and encryption transmission method that meets the security of the power grid to further ensure the efficiency and reliability of data transmission. The main steps are as follows: 1. Prepare data collection terminals and gateways with edge computing capabilities, and connect the collection terminals to hydropower units, wind power generation equipment, and photovoltaic equipment; see below Figure 1 ; 2. Disorder the data to be sent and re-form new data; 3. Encrypt the new data segment and transmit it to the edge gateway through the communication network; 4. The edge gateway decrypts and verifies the data, and reassembles the data to restore it to its original state.

[0032] Transfer data to the application server.

[0033] The security protection strategy of this collection system is as follows: 1. Terminal node security authentication: Only activated and bound terminal nodes can access the gateway to prevent unauthorized devices from attacking the system.

[0034] 2. Prepare the data to be sent. When the water, wind and light data is collected and ready to be sent, encode the data to be sent and perform random operations on the encoding. For ease of understanding, hexadecimal encoding is used here. For example, the encoded data is "123ABC", which becomes "A1B2C3" after random encoding.

[0035] It should be noted that: 1) Considering that water, wind and light data are time series data and the data has certain regularity, when performing out-of-order operations, we will focus on the number of times the previous and subsequent data are swapped, rather than just making adjacent adjustments. Otherwise, there will still be a risk of being deciphered.

[0036] 2) The purpose of using out-of-order operations is to effectively prevent data from being cracked, because even if a part is decrypted by chance, the order of the encoded data has changed and valid information cannot be obtained.

[0037] 3. Segmented encryption: Segment the data after random encoding. For example, the above data is divided into two parts, "A1B" and "2C3", and then the two parts of data are encrypted with quantum key 1 and quantum key 2 respectively.

[0038] Remark: 1. Quantum keys can be generated by existing quantum key generators, which can achieve true random keys; 2. Data segment encryption is mainly to prevent the situation where if a key is guessed randomly by chance, only part of the disordered data can be guessed, which is meaningless.

[0039] 3. Decryption and recovery of data: After the receiving end obtains the corresponding data, it uses the synchronized quantum keys 1 and 2 to decrypt the data at both ends respectively; then the scramble algorithm is used to restore the original data.

[0040] 4. Network equipment authentication management: manage gateways, network servers and other equipment through authentication servers, so as to correctly manage and control the behavior of network equipment.

[0041] 5. Carry out work in accordance with the requirements for IoT security in the standards “Basic Requirements for Information Security Technology Network Security Level Protection” and “Basic Requirements for Network Security Level Protection in the Power Industry”.

[0042] Secure access equipment introduces protocol isolation, message encryption and authentication to ensure the integrity, confidentiality and non-repudiation of communications.

[0043] By adding forward and reverse isolation devices, message filtering and access control in the communication direction are achieved by hiding MAC addresses, virtual host IP addresses, and prohibiting different partitions from establishing TCP connections.

Claims

1. A data security collection system in a multi-energy complementary scenario, characterized in that: It includes a data acquisition terminal, which collects data from the equipment to be collected. The data acquisition terminal is connected to the edge computing gateway, the edge computing gateway is connected to the security access area, the network server is connected to the security access area, and the network server is connected to the application server. The equipment to be collected includes hydropower units, wind power generation equipment and photovoltaic equipment.

2. According to the data security collection system in a multi-energy complementary scenario described in claim 1, it is characterized in that: The secure access area includes secure access devices connected to the edge computing gateway and the network server respectively, and an isolation device is provided between the secure access devices at both ends.

3. According to the data security collection system in a multi-energy complementary scenario described in claim 2, it is characterized in that: The isolation device comprises a forward isolation device and a reverse isolation device.

4. According to the data security collection system in a multi-energy complementary scenario described in claim 3, it is characterized in that: The forward isolation device and the reverse isolation device are connected in parallel.

5. The security protection method of the data security collection system according to claim 4 is characterized in that: The following steps are involved: Step 1. Prepare the data acquisition terminal and edge computing gateway, and connect the data acquisition terminal to the hydropower unit, wind power generation equipment, and photovoltaic equipment; Step 2: Disorder the data to be sent and re-form new data; Step 3: Encrypt the new data segments and transmit them to the edge computing gateway through the communication network; Step 4: The edge computing gateway decrypts and verifies the data, and reassembles the data to restore it to its original state; Step 5: Transmit the data to the application server through the secure access area.

6. The security protection method for the data security collection system according to claim 5, characterized in that: The safety protection method also includes: Terminal node security authentication: Only activated and bound terminal nodes can access the gateway to prevent unauthorized devices from attacking the system; Preparation of data to be sent: when the water, wind and light data are collected and ready to be sent, the data to be sent is encoded and the encoding is shuffled; Segment encryption: segment the data after random encoding.

7. The security protection method for the data security collection system according to claim 6, characterized in that: In the preparation of the data to be sent, when the encoding is performed in a disorderly order, the data is swapped front to back.

8. The security protection method for the data security collection system according to claim 7, characterized in that: In the preparation of the data to be sent, the number of times the data is swapped is limited.

9. The security protection method for the data security collection system according to claim 8, characterized in that: The secure access device is a firewall.

10. The security protection method for the data security collection system according to claim 9, characterized in that: There are multiple data acquisition terminals and edge computing gateways, and the data acquisition terminals and edge computing gateways are cross-connected, and the edge computing gateways are connected to each other.

Images