Data acquisition system based on multi-user multiplexing mechanism

Abstract

The invention discloses a data acquisition system based on a multi-user multiplexing mechanism, and the system comprises the following modules: a 4G communication terminal module which is used for accessing a VPN network through a VPDN protocol; the industrial gateway module is used for connecting the 4G communication terminal and the middle station through a VPN network, supporting data acquisition and classified storage of southbound equipment, and cooperating with the middle station to realize multi-user data management; the middle station module is used for receiving, classifying and storing the data uploaded by the industrial gateway and providing decryption and data access services according to user permission; the user information management module is used for maintaining a user basic information table, a southbound equipment information table and a data point information table; the encryption and security module is used for performing classified storage and encryption processing on the user data and distributing an independent secret key; and the communication protocol module is used for realizing data encapsulation and transmission based on an MQTT protocol. By utilizing 4G communication, industrial gateway centralization and multi-user multiplexing technologies, efficient data acquisition and classified transmission are realized, and the system has the advantages of low cost, high data security and the like.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial Internet, and in particular to a data acquisition system based on a multi-user multiplexing mechanism. Background Art

[0002] With the rapid development of information technology, the traditional industrial control field is gradually moving towards informatization and intelligence. After the concept of the Internet of Things was proposed, the industrial control field began to integrate the Internet protocol and proposed a series of access and communication standards to enhance the interconnection and interoperability of the system. Among these standards, the most widely used are the MQTT protocol for the northbound interface of the industrial gateway and the ModBus protocol for the southbound interface of the industrial gateway. The MQTT protocol adopts a "publish / subscribe" model, which can achieve efficient data transmission in low-bandwidth, high-latency and unreliable network environments, and is the mainstream choice for northbound interface communication. The ModBus protocol adopts a "client / server" communication model, focusing on data interaction between industrial control system devices, and is the main communication method for the southbound interface.

[0003] Industrial gateways play an important role in "bridging the gap" in industrial control systems. They communicate with host computers, middleware and other devices through northbound interfaces, connect to various data acquisition devices through southbound interfaces, and transmit the collected data to the upper layer for processing and storage. In traditional data acquisition systems, industrial gateways are often deployed near data acquisition interfaces and communicate with southbound devices through wired channels. Although this method is mature and stable, the corresponding construction cost is very high. Especially in large-scale industrial scenarios, the implementation cost is further increased due to the complex laying of wired channels and the long construction period. In addition, in order to support edge computing, industrial gateways are usually equipped with higher computing performance. However, this high-performance configuration is redundant in many scenarios. In actual applications, the amount of data collected by a single data acquisition interface corresponding to an industrial gateway is usually far lower than its processing capacity limit, resulting in insufficient use of hardware resources and waste of performance and cost.

[0004] What is more serious is that in the traditional industrial gateway deployment model, computing power cannot usually be shared between gateways. Although some gateways have excess computing performance, these remaining resources cannot be used to support other devices. This closed architecture not only limits resource utilization, but also makes the scalability of the entire system poor, making it difficult to flexibly respond to changes in business needs. For data acquisition systems in a multi-user environment, traditional industrial gateways also face another key problem, namely data privacy and security. In the traditional architecture, an industrial gateway usually only corresponds to the data acquisition interface of a single user, so user data is relatively isolated and privacy issues are not prominent. However, when an industrial gateway needs to connect to the southbound devices of multiple users at the same time, the data collected by its southbound interface is easily accessed by other users, resulting in the loss of user data privacy. In addition, although the northbound interface of the industrial gateway supports the multi-user classification function of the MQTT protocol, its classification function is limited to the management of northbound data, and it is impossible to effectively classify and isolate southbound data. This makes it difficult for the traditional model to meet the requirements of data privacy protection when facing multi-user needs.

[0005] Therefore, how to provide a data acquisition system based on a multi-user multiplexing mechanism is a problem that those skilled in the art need to solve urgently. Summary of the invention

[0006] One purpose of the present invention is to propose a data acquisition system based on a multi-user multiplexing mechanism. The present invention makes full use of 4G communication technology, centralized deployment technology of industrial gateways and middle platforms, and multi-user multiplexing mechanisms to achieve efficient data acquisition, classified transmission, and user isolation management. By building a southbound channel through 4G communication terminals, the coverage of the system is greatly improved, and the deployment and maintenance costs are reduced; the integration of industrial gateways and middle platforms optimizes resource utilization and simplifies the system structure; the multi-user multiplexing mechanism ensures the security and privacy of the entire process from data acquisition to storage, meets the complex needs of multi-user scenarios, and has the advantages of wide coverage, low cost, and high data security.

[0007] The data acquisition system based on the multi-user multiplexing mechanism according to the embodiment of the present invention includes the following modules: 4G communication terminal module, used to access VPN network through VPDN protocol, including primary 4G communication terminal and secondary 4G communication terminal; Industrial gateway module, used to connect 4G communication terminals and the middle platform through VPN network, support southbound device data collection and classified storage, and collaborate with the middle platform to achieve multi-user data management; The middle platform module is used to manage user information and permissions, receive and classify the data uploaded by the industrial gateway, and provide decryption and data access services according to user permissions; User information management module, used to maintain user basic information table, southbound device information table and data point information table, record user identity, device configuration information and data point information; Encryption and security module, used to classify and store user data, encrypt it, and allocate independent keys; The communication protocol module is used to implement data encapsulation and transmission based on the MQTT protocol.

[0008] Optionally, modules can be connected via the following methods: S1. Configure a 4G communication terminal and connect the 4G communication terminal to a VPN network through a VPDN protocol. The 4G communication terminal includes a primary 4G communication terminal and a secondary 4G communication terminal. S2. The 4G communication terminal uses an IoT private network SIM card, which works in conjunction with the IoT public network SIM card used by the industrial gateway and accesses the southbound device. The IoT private network SIM card component virtual subnet connects the southbound device and the 4G communication terminal. The IoT public network SIM card provides a static IP address to support two-way communication between the gateway and the middle station. S3. Deploy the centralized architecture of industrial gateway and middle platform, integrate the software functions of industrial gateway and middle platform into the same hardware device, and transmit the data collected by southbound devices to industrial gateway and middle platform through the VPN network of 4G communication terminal; S4. Create a multi-user reuse mechanism in the industrial gateway, including establishing a user basic information table, a southbound device information table, and a data point information table; S5. The industrial gateway traverses the user basic information table, combines the southbound device information table and the data point information table, obtains the target data point of the southbound device according to the associated information of each user, and stores the data of the target data point by user classification; S6. Encrypt the classified data stored in the industrial gateway, adopt a multi-user independent key encryption mechanism, and provide an independent encryption key for each user's target data point; S7. Encapsulate the encrypted target data points based on the MQTT protocol, and upload the encapsulated data to the middle platform through the northbound interface. The data of each user is classified and stored according to the user identity information, and the middle platform provides access services based on permissions; S8. After receiving the encrypted data, the middle station uses the independent key corresponding to the user to decrypt the data, and provides the target data points of the corresponding user according to the classification rules of the user basic information table. At the same time, it feeds back the data upload status and the operation status of the southbound device to the industrial gateway.

[0009] Optionally, the first-level 4G communication terminal is used to connect to the industrial gateway and provide NAT service for the industrial gateway; the second-level communication terminal is used to connect to the southbound device and provide data transparent transmission capability for the southbound device; the 4G communication terminal uses NAT service to forward data packets from the southbound device or the industrial gateway, and transparently transmits the data packets to the VPN network, thereby integrating the southbound devices and industrial gateways that do not belong to different local area networks into the same VPN network.

[0010] Optionally, the configuration content of the first-level 4G communication terminal when enabled specifically includes: VNP network configuration based on VPDN protocol, first-level LAN segment setting and static route setting of industrial gateway; the VNP network configuration based on VPDN protocol configures the access point name, PAP / CHAP user name, password and authentication type information according to the current VPN network environment, so that the first-level 4G communication terminal can dial into the VPN network through the private network IoT SIM card; the first-level LAN segment setting requires the user to configure the same LAN segment as the industrial gateway at the first-level 4G communication terminal; the static route setting of the industrial gateway requires the user to set a static route at the industrial gateway, so that all device messages accessing the VPN network at the industrial gateway are sent to the first-level 4G communication terminal and transmitted to the VPN network by the first-level 4G communication terminal.

[0011] Optionally, the configuration content of the secondary 4G communication terminal when enabled specifically includes: VNP network configuration based on VPDN protocol, secondary LAN segment setting and NAT service setting; the secondary LAN segment setting sets the LAN segment of the secondary 4G communication terminal according to the LAN configuration of the southbound device. If the southbound device adopts the serial port communication mode, the serial port parameters of the secondary 4G communication terminal are synchronously configured according to the serial port configuration information; the NAT service setting uses the port forwarding function based on the NAT service, so that requests from the VPN network are forwarded to the southbound device through the secondary 4G communication terminal; for PLC devices with default industrial gateway configuration information, the IP mapping function is used to force the message data of the PLC device to be pushed to the primary 4G communication terminal corresponding to the industrial gateway, and the primary 4G communication terminal forwards the message data to the industrial gateway, so as to realize normal communication between the industrial gateway and the PLC device.

[0012] Optionally, the step of connecting the 4G communication terminal to the VPN network through the VPDN protocol in S1 specifically includes: S11, the client calls the access controller and communicates via a modem or ISDN card; S12, the client negotiates link control protocol options with the access controller, including password authentication protocol, challenge handshake authentication protocol, PPP multilink or compression, and starts the point-to-point protocol phase; S13, the access controller sends a challenge handshake identity authentication protocol challenge to the client; S14, the client generates response data according to the challenge and returns it to the access controller; S15, the access controller checks whether the client is a VPDN user through local configuration or the identity authentication, authorization and accounting server according to the domain name or called number information service in the challenge handshake identity authentication protocol response; S16. If the client is a VPDN user, the access controller obtains information from the local configuration or the authentication, authorization and accounting server, and starts a layer 2 tunneling protocol or a layer 2 forwarding protocol tunnel with the network server; S17, the access controller establishes a tunnel connection with the network server and performs two-way authentication, allowing multiple VPDN sessions to run in the same tunnel; S18, the VPDN session of the client is established with the network server through the access controller, and each client corresponds to a VPDN session; S19, the access controller forwards the negotiated link control protocol options and the user name and password of the client to the network server; S110, the network server clones the virtual access instance from the virtual template specified in the VPDN configuration, accepts the link control protocol option delivered from the access controller, and authenticates the client; S111, the network server sends a challenge handshake identity authentication protocol response to the client to complete the identity authentication; S112, executing the IP control protocol phase, installing routing and starting the PPP session, the PPP frame is transmitted through the tunnel between the access controller and the network server, and the 4G communication terminal accesses the VPN network.

[0013] Optionally, the step of S2 accessing the southbound device specifically includes: S21. Configure the secondary 4G communication terminal to ensure normal communication between the southbound device and the secondary 4G communication terminal; S22, the southbound device connected to the secondary 4G communication terminal through RS485 and RS232 protocols accesses the corresponding secondary 4G communication terminal; S23, accessing the private network carried by the secondary 4G communication terminal through the southbound device of Ethernet communication, where the private network carried by the secondary 4G communication terminal is consistent with the primary 4G communication terminal; S24. The industrial gateway enables the TCP-based protocol and activates the southbound interface by configuring the IP address, port, protocol, and point table information of the southbound device; S25. After the configuration is completed, the user manually activates the southbound interface; S26. The southbound device sends a message to the industrial gateway, and the southbound device is connected.

[0014] Optionally, the user basic information table is used to store general user information; the southbound device information table is used to store southbound device information; the data point information table is used to store point information; the user basic information table includes user ID, user name and password; the southbound device information table includes device ID, device name, private network address and port number; the private network address is the address of the VPN network assigned by the 4G communication terminal to which it joins or set independently by the industrial gateway maintenance personnel; the port number is the port number of the port forwarding service provided by the 4G communication terminal to the connected southbound device; the private network address and the port number are both based on port forwarding; the data point information table includes device ID, point name, register address, data type and data description.

[0015] Optionally, the newly added common users under the multi-user multiplexing mechanism in S4 specifically include: S41. Ordinary users initiate an application to add new ordinary users to the middle office; S42, the middle station administrator verifies the legitimacy of the common user's identity. After the verification is passed, the administrator uses the super user to create a directory corresponding to the common user name under the middle station path / usr / local / iot_gateway / user, and generates a user basic information table, a southbound device information table, and a data point information table under the directory; S43, the middle platform sends a request to the industrial gateway to create a common user; S44. The super user creates a directory corresponding to the name of the ordinary user under the industrial gateway path / usr / local / iot_gateway / user; S45. The industrial gateway feeds back the information that ordinary users have successfully created to the middle platform; S46. The middle platform feeds back the successful creation information to the ordinary user, confirming that the creation of the ordinary user is completed.

[0016] Multi-user reuse means that multiple users reuse the same gateway. This mechanism creates multiple user forms at the gateway to store user basic information, southbound device information collected by users, and data point information that southbound devices need to transmit. After adopting this mechanism, the main program built into the gateway will traverse the user basic information table and query the southbound device information table and the corresponding data point information table. After that, the gateway will obtain the data points of the southbound device based on the query information. Finally, the gateway will encapsulate the data points using the MQTT protocol and upload the encapsulated data to the corresponding user in the middle station. In addition, the users in the middle station and the gateway are one-to-one. That is, the data points defined by user A at the gateway will only be transmitted to user A in the gateway, and will not be obtained by other users. Starting from the southbound device, all data is classified and transmitted based on the user as the classification object. This solution prevents the "mixing" of different user data in the same message and isolates the data of different users from the root. In addition, this solution also provides different keys for different ordinary users to encrypt data, and each key can only be mastered and managed by the corresponding ordinary user. Therefore, this design can prevent the encrypted data message from being cracked by other users from the root. This design can effectively protect the privacy of data and meet the user's needs for data security.

[0017] The gateway will cyclically execute the two processes of acquiring data from southbound devices and sending data to northbound devices. These two processes will traverse the user, device, and point information through interrupts during execution. As mentioned above, all common user information will be stored in the corresponding / usr / local / iot_gateway / user path.

[0018] After adding a new common user, the new common user can add a southbound device and a point in the southbound device table and point table belonging to the common user. It should be noted that the user table, device table, and point table belonging to the common user are encrypted by the key of the super user. The maintenance personnel of the gateway cannot obtain the plaintext information, nor can they crack the ciphertext encrypted by the super user. The process of adding a southbound device is as follows: 1. The gateway traverses the user basic information table in the database.

[0019] 2. If there is common user data, whenever a common user is traversed, the current traversal is interrupted, and then the target path is entered according to the currently traversed user ID and the southbound device information table under the path is queried.

[0020] 3. Query the data point information table according to the device ID and read all corresponding points in the data point information table.

[0021] 4. Obtain the data point of the corresponding southbound device based on the acquired point information.

[0022] 5. Obtain the data points of the target southbound device, encapsulate the acquired data according to the northbound protocol, and then cache or save the data in the target path.

[0023] 6. Return to the interrupted traversal of the user basic information table and prepare to read the next piece of ordinary user data.

[0024] After the gateway completes the data collection of the southbound device, it needs to wait for the data classification work to be completed before sending data to the northbound device. The data will be classified and sent according to the unit of ordinary users. Under the multi-user multiplexing mechanism, the process of the gateway sending data to the northbound device is as follows: 1. The gateway traverses the user basic information table in the database.

[0025] 2. Read the cache or target path to obtain the data points of the current ordinary user, and compare the sent point information to confirm the point range that needs to be sent.

[0026] 3. If the data needs to be encrypted, the key owned by the user is used for encryption. During this period, the data is classified according to ordinary users to completely eliminate the possibility of "data mixing". The data is sent to the middle station using northbound protocols such as MQTT. If the data message is encrypted by the key of an ordinary user, then correspondingly, the message can only be decrypted by the key of the ordinary user at the middle station.

[0027] The beneficial effects of the present invention are: First, the southbound channel constructed based on the 4G communication terminal in this invention successfully solves the problems of complex channel laying and insufficient deployment flexibility in traditional data acquisition systems. System communication is realized through multiple protocols, which not only has higher bandwidth, but also ensures stable and reliable data transmission in complex industrial environments, thereby improving the operating efficiency of the data acquisition system.

[0028] Secondly, the present invention realizes efficient integration and centralized management of data acquisition system functions through the centralized deployment of industrial gateways and middle platforms. The software functions of the industrial gateway and the middle platform are integrated into a single hardware device, which reduces the waste of hardware resources and improves the resource utilization of the system. At the same time, the data acquisition end can be directly uploaded to the middle platform for processing, which simplifies the intermediate transmission link, not only improves the data processing efficiency, but also facilitates the later maintenance and expansion of the system, further reducing the overall operating cost.

[0029] In addition, the present invention achieves user isolation from data collection to transmission and storage through a multi-user multiplexing mechanism. The industrial gateway uses user classification management to independently encrypt all user data from the time it is collected by the southbound device and keep it in each independent transmission link. The middle platform decrypts the data according to the user's independent key and provides accurate data access services based on user permissions, thereby effectively ensuring the privacy and security of sensitive data.

[0030] Finally, the present invention closely combines the functions of 4G communication terminals, industrial gateways and middle stations to form a low-cost, high-efficiency and highly secure data acquisition system solution. While meeting the needs of multiple users, the system optimizes the data management process and transmission efficiency, provides reliable technical support for the promotion and application of the industrial Internet, and has significant application value and promotion prospects. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 This is an overall flow chart of the data acquisition method based on the multi-user multiplexing mechanism proposed by the present invention; Figure 2 This is a schematic diagram of the structure of the data acquisition system based on the multi-user multiplexing mechanism proposed by the present invention. DETAILED DESCRIPTION

[0032] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, which only illustrate the basic structure of the present invention in a schematic manner, and therefore only show the components related to the present invention.

[0033] refer to Figure 1 and Figure 2 , the data acquisition system based on multi-user multiplexing mechanism includes the following modules: 4G communication terminal module, used to access VPN network through VPDN protocol, including primary 4G communication terminal and secondary 4G communication terminal; Industrial gateway module, used to connect 4G communication terminals and the middle platform through VPN network, support southbound device data collection and classified storage, and collaborate with the middle platform to achieve multi-user data management; The middle platform module is used to manage user information and permissions, receive and classify the data uploaded by the industrial gateway, and provide decryption and data access services according to user permissions; User information management module, used to maintain user basic information table, southbound device information table and data point information table, record user identity, device configuration information and data point information; Encryption and security module, used to classify and store user data, encrypt it, and allocate independent keys; The communication protocol module is used to implement data encapsulation and transmission based on the MQTT protocol.

[0034] In this implementation, the modules are implemented by the following method: S1. Configure a 4G communication terminal and connect the 4G communication terminal to a VPN network through a VPDN protocol. The 4G communication terminal includes a primary 4G communication terminal and a secondary 4G communication terminal. S2. The 4G communication terminal uses an IoT private network SIM card, which works in conjunction with the IoT public network SIM card used by the industrial gateway and accesses the southbound device. The IoT private network SIM card component virtual subnet connects the southbound device and the 4G communication terminal. The IoT public network SIM card provides a static IP address to support two-way communication between the gateway and the middle station. S3. Deploy the centralized architecture of industrial gateway and middle platform, integrate the software functions of industrial gateway and middle platform into the same hardware device, and transmit the data collected by southbound devices to industrial gateway and middle platform through the VPN network of 4G communication terminal; S4. Create a multi-user reuse mechanism in the industrial gateway, including establishing a user basic information table, a southbound device information table, and a data point information table; S5. The industrial gateway traverses the user basic information table, combines the southbound device information table and the data point information table, obtains the target data point of the southbound device according to the associated information of each user, and stores the data of the target data point by user classification; S6. Encrypt the classified data stored in the industrial gateway, adopt a multi-user independent key encryption mechanism, and provide an independent encryption key for each user's target data point; S7. Encapsulate the encrypted target data points based on the MQTT protocol, and upload the encapsulated data to the middle platform through the northbound interface. The data of each user is classified and stored according to the user identity information, and the middle platform provides access services based on permissions; S8. After receiving the encrypted data, the middle station uses the independent key corresponding to the user to decrypt the data, and provides the target data points of the corresponding user according to the classification rules of the user basic information table. At the same time, it feeds back the data upload status and the operation status of the southbound device to the industrial gateway.

[0035] In this embodiment, the first-level 4G communication terminal is used to connect to the industrial gateway and provide NAT service for the industrial gateway; the second-level communication terminal is used to connect to the southbound device and provide data transparent transmission capability for the southbound device; the 4G communication terminal uses NAT service to forward data packets from the southbound device or the industrial gateway, and transparently transmits the data packets to the VPN network, thereby integrating the southbound devices and industrial gateways that do not belong to different local area networks into the same VPN network.

[0036] In this embodiment, the configuration content of the first-level 4G communication terminal when it is enabled specifically includes: VNP network configuration based on VPDN protocol, first-level LAN segment setting and static route setting of industrial gateway; the VNP network configuration based on VPDN protocol configures the access point name, PAP / CHAP user name, password and authentication type information according to the current VPN network environment, so that the first-level 4G communication terminal can dial into the VPN network through the private network IoT SIM card; the first-level LAN segment setting requires the user to configure the same LAN segment as the industrial gateway at the first-level 4G communication terminal; the static route setting of the industrial gateway requires the user to set a static route at the industrial gateway, so that all device messages accessing the VPN network at the industrial gateway are sent to the first-level 4G communication terminal and transmitted to the VPN network by the first-level 4G communication terminal.

[0037] In this implementation manner, the configuration content of the secondary 4G communication terminal when enabled specifically includes: VNP network configuration based on the VPDN protocol, secondary LAN segment setting and NAT service setting; the secondary LAN segment setting sets the LAN segment of the secondary 4G communication terminal according to the LAN configuration of the southbound device. If the southbound device adopts the serial port communication mode, the serial port parameters of the secondary 4G communication terminal are synchronously configured according to the serial port configuration information; the NAT service setting uses the port forwarding function based on the NAT service, so that requests from the VPN network are forwarded to the southbound device through the secondary 4G communication terminal; for PLC devices with default industrial gateway configuration information, the IP mapping function is used to force the message data of the PLC device to be pushed to the primary 4G communication terminal corresponding to the industrial gateway, and the primary 4G communication terminal forwards the message data to the industrial gateway to achieve normal communication between the industrial gateway and the PLC device.

[0038] In this implementation manner, the step of connecting the 4G communication terminal to the VPN network through the VPDN protocol in S1 specifically includes: S11, the client calls the access controller and communicates via a modem or ISDN card; S12, the client negotiates link control protocol options with the access controller, including password authentication protocol, challenge handshake authentication protocol, PPP multilink or compression, and starts the point-to-point protocol phase; S13, the access controller sends a challenge handshake identity authentication protocol challenge to the client; S14, the client generates response data according to the challenge and returns it to the access controller; S15, the access controller checks whether the client is a VPDN user through local configuration or the identity authentication, authorization and accounting server according to the domain name or called number information service in the challenge handshake identity authentication protocol response; S16. If the client is a VPDN user, the access controller obtains information from the local configuration or the authentication, authorization and accounting server, and starts a layer 2 tunneling protocol or a layer 2 forwarding protocol tunnel with the network server; S17, the access controller establishes a tunnel connection with the network server and performs two-way authentication, allowing multiple VPDN sessions to run in the same tunnel; S18, the VPDN session of the client is established with the network server through the access controller, and each client corresponds to a VPDN session; S19, the access controller forwards the negotiated link control protocol options and the user name and password of the client to the network server; S110, the network server clones the virtual access instance from the virtual template specified in the VPDN configuration, accepts the link control protocol option delivered from the access controller, and authenticates the client; S111, the network server sends a challenge handshake identity authentication protocol response to the client to complete the identity authentication; S112, executing the IP control protocol phase, installing routing and starting the PPP session, the PPP frame is transmitted through the tunnel between the access controller and the network server, and the 4G communication terminal accesses the VPN network.

[0039] In this implementation manner, the step of S2 accessing the southbound device specifically includes: S21. Configure the secondary 4G communication terminal to ensure normal communication between the southbound device and the secondary 4G communication terminal; S22, the southbound device connected to the secondary 4G communication terminal through RS485 and RS232 protocols accesses the corresponding secondary 4G communication terminal; S23, accessing the private network carried by the secondary 4G communication terminal through the southbound device of Ethernet communication, where the private network carried by the secondary 4G communication terminal is consistent with the primary 4G communication terminal; S24. The industrial gateway enables the TCP-based protocol and activates the southbound interface by configuring the IP address, port, protocol, and point table information of the southbound device; S25. After the configuration is completed, the user manually activates the southbound interface; S26. The southbound device sends a message to the industrial gateway, and the southbound device is connected.

[0040] In this implementation, the user basic information table is used to store general user information; the southbound device information table is used to store southbound device information; the data point information table is used to store point information; the user basic information table includes user ID, user name and password; the southbound device information table includes device ID, device name, private network address and port number; the private network address is the address of the VPN network assigned by the 4G communication terminal to which it joins or set independently by the industrial gateway maintenance personnel; the port number is the port number of the port forwarding service provided by the 4G communication terminal to the connected southbound device; the private network address and the port number are both based on port forwarding; the data point information table includes device ID, point name, register address, data type and data description.

[0041] In this implementation manner, the newly added common users under the multi-user multiplexing mechanism in S4 specifically include: S41. Ordinary users initiate an application to add new ordinary users to the middle office; S42, the middle station administrator verifies the legitimacy of the common user's identity. After the verification is passed, the administrator uses the super user to create a directory corresponding to the common user name under the middle station path / usr / local / iot_gateway / user, and generates a user basic information table, a southbound device information table, and a data point information table under the directory; S43, the middle platform sends a request to the industrial gateway to create a common user; S44. The super user creates a directory corresponding to the name of the ordinary user under the industrial gateway path / usr / local / iot_gateway / user; S45. The industrial gateway feeds back the information that ordinary users have successfully created to the middle platform; S46. The middle platform feeds back the successful creation information to the ordinary user, confirming that the creation of the ordinary user is completed.

[0042] Embodiment 1: In order to verify the feasibility of the present invention in implementation, the present invention is applied to the industrial park of a large manufacturing enterprise. The production workshops of the enterprise are relatively scattered, and each workshop is equipped with a large number of sensors and control equipment to collect key production parameters such as equipment operating status, temperature, and pressure. However, since traditional data acquisition systems need to rely on wired channels for communication, the construction cost is high and maintenance is difficult. At the same time, the coverage of a single industrial gateway is limited, resulting in low resource utilization and difficulty in efficiently sharing data between devices. In addition, data between different users in the workshop is easily mixed, sensitive information may be obtained by unauthorized users, and data privacy issues are particularly prominent.

[0043] To solve these problems, the company decided to introduce a data acquisition system based on a multi-user multiplexing mechanism. By deploying 4G communication terminals and industrial gateways in the workshop, the traditional wired channels are replaced with 4G cellular network channels, thereby reducing construction costs and improving deployment flexibility. In the specific implementation, the secondary 4G communication terminals are arranged at the main data collection points in the workshop, which are responsible for connecting with the southbound equipment and transparently transmitting data to the primary 4G communication terminal using the VPN network. The primary 4G communication terminal works in conjunction with the industrial gateway to upload the collected data to the centrally deployed middle station.

[0044] In actual applications, 20 Level 2 4G communication terminals and 10 Level 1 4G communication terminals are installed in production workshop A and workshop B, respectively, to cover 200 sensor nodes and 50 PLC devices in the workshop. The collected equipment operation data is uploaded to the industrial gateway through the southbound device. On the industrial gateway side, the system automatically classifies and stores data for different users and devices. Each user corresponds to an independent encryption key to ensure the privacy and security of the data. On the northbound interface, the industrial gateway uses the MQTT protocol to upload data to the middle station, and performs permission control based on user identity information to ensure that different users can only access data within the authorized scope.

[0045] In order to verify the beneficial effects of the present invention, the system was tested for three consecutive months. Data records show that through 4G communication terminals and 4G cellular network channels, the average upload delay of equipment operation data in workshops A and B was reduced by 65%, from 2.8 seconds in the traditional system to 0.98 seconds. At the same time, the construction cost dropped significantly. Compared with the traditional wired channel, the total cost was reduced by about 40%, from the original 1.2 million yuan to 720,000 yuan. In terms of data classification and privacy protection, the middle station records show that the decryption accuracy of user data after encrypted storage reaches 99.98%, and there are zero data leakage incidents. In addition, the multi-user multiplexing mechanism enables an industrial gateway to cover more device nodes. An industrial gateway in workshop A supports up to 40 devices, which increases the coverage by 200% compared with the traditional mode.

[0046] Table 1 Comparison of performance improvement between traditional system and the system of the present invention ; Table 2 Cost comparison analysis of the traditional system and the system of the present invention ; Table 3 User data classification storage analysis table ; The data acquisition system based on the multi-user multiplexing mechanism of the present invention shows significant technical advantages and practical application effects in many aspects. First of all, the above Table 1 shows that in terms of system performance, the data upload delay is significantly reduced from 2.80 seconds of the traditional system to 0.98 seconds, and the delay is reduced by 65%. At the same time, the coverage capacity of an industrial gateway is increased to 40 devices, which is 4 times that of the traditional system, effectively improving resource utilization. The accuracy of the data classification and encryption mechanism reached 99.98%, and no data leakage incidents occurred during the entire test cycle, which fully demonstrated the high security of the present invention in data privacy protection.

[0047] By analyzing the above Table 2, it can be seen that in terms of cost control, the present invention greatly reduces the construction cost and equipment procurement cost by adopting 4G communication terminals and cellular network channels. Compared with the traditional system, the construction cost is saved by 50%, the industrial gateway procurement cost is reduced by 33.3%, and the overall system cost is reduced from 1.2 million yuan to 720,000 yuan, with a saving rate of up to 40%. This not only effectively reduces the initial investment of the enterprise, but also provides more flexibility for later system maintenance and expansion.

[0048] Table 3 above shows that in terms of user data management, the system achieves accurate data classification and secure storage and transmission through a multi-user reuse mechanism and independent key encryption technology. Test results show that the classification and storage accuracy of user data exceeds 99.96%, and the decryption accuracy reaches 99.99%. The system has no data errors or abnormal records during the entire operation, showing extremely high stability and reliability, meeting the strict data security requirements in a multi-user environment.

[0049] Therefore, the present invention not only has significant advantages in performance improvement, cost optimization and privacy protection, but also can well adapt to the needs of multiple users in complex scenarios of the Industrial Internet. Its excellent technical performance and economic benefits provide enterprises with an efficient, safe and low-cost data acquisition system solution with broad application prospects and promotion value.

[0050] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

Claims

1. A data acquisition system based on a multi-user multiplexing mechanism, characterized in that: Includes the following modules: 4G communication terminal module, used to access VPN network through VPDN protocol, including primary 4G communication terminal and secondary 4G communication terminal; Industrial gateway module, used to connect 4G communication terminals and the middle platform through VPN network, support southbound device data collection and classified storage, and collaborate with the middle platform to achieve multi-user data management; The middle platform module is used to manage user information and permissions, receive and classify the data uploaded by the industrial gateway, and provide decryption and data access services according to user permissions; User information management module, used to maintain user basic information table, southbound device information table and data point information table, record user identity, device configuration information and data point information; Encryption and security module, used to classify and store user data, encrypt it, and allocate independent keys; The communication protocol module is used to implement data encapsulation and transmission based on the MQTT protocol.

2. The data acquisition system based on a multi-user multiplexing mechanism according to claim 1 is characterized in that: The modules are implemented in the following ways: S1. Configure a 4G communication terminal and connect the 4G communication terminal to a VPN network through a VPDN protocol. The 4G communication terminal includes a primary 4G communication terminal and a secondary 4G communication terminal. S2. The 4G communication terminal uses an IoT private network SIM card, which works in conjunction with the IoT public network SIM card used by the industrial gateway and accesses the southbound device. The IoT private network SIM card component virtual subnet connects the southbound device and the 4G communication terminal. The IoT public network SIM card provides a static IP address to support two-way communication between the gateway and the middle station. S3. Deploy the centralized architecture of industrial gateway and middle platform, integrate the software functions of industrial gateway and middle platform into the same hardware device, and transmit the data collected by southbound devices to industrial gateway and middle platform through the VPN network of 4G communication terminal; S4. Create a multi-user reuse mechanism in the industrial gateway, including establishing a user basic information table, a southbound device information table, and a data point information table; S5. The industrial gateway traverses the user basic information table, combines the southbound device information table and the data point information table, obtains the target data point of the southbound device according to the associated information of each user, and stores the data of the target data point by user classification; S6. Encrypt the classified data stored in the industrial gateway, adopt a multi-user independent key encryption mechanism, and provide an independent encryption key for each user's target data point; S7. Encapsulate the encrypted target data points based on the MQTT protocol, and upload the encapsulated data to the middle platform through the northbound interface. The data of each user is classified and stored according to the user identity information, and the middle platform provides access services based on permissions; S8. After receiving the encrypted data, the middle station uses the independent key corresponding to the user to decrypt the data, and provides the target data points of the corresponding user according to the classification rules of the user basic information table. At the same time, it feeds back the data upload status and the operation status of the southbound device to the industrial gateway.

3. The data acquisition system based on a multi-user multiplexing mechanism according to claim 2 is characterized in that: The first-level 4G communication terminal is used to connect to the industrial gateway and provide NAT service for the industrial gateway; the second-level communication terminal is used to connect to the southbound device and provide data transparent transmission capability for the southbound device; the 4G communication terminal uses NAT service to forward data packets from the southbound device or the industrial gateway, and transparently transmits the data packets to the VPN network, thereby integrating the southbound devices and industrial gateways that do not belong to different local area networks into the same VPN network.

4. The data acquisition system based on a multi-user multiplexing mechanism according to claim 3 is characterized in that: The configuration content of the first-level 4G communication terminal when enabled specifically includes: VNP network configuration based on VPDN protocol, first-level LAN segment setting and static route setting of industrial gateway; the VNP network configuration based on VPDN protocol configures the access point name, PAP / CHAP user name, password and authentication type information according to the current VPN network environment, so that the first-level 4G communication terminal can dial into the VPN network through the private network IoT SIM card; the first-level LAN segment setting requires the user to configure the same LAN segment as the industrial gateway at the first-level 4G communication terminal; the static route setting of the industrial gateway requires the user to set a static route at the industrial gateway, so that all device messages accessing the VPN network at the industrial gateway are sent to the first-level 4G communication terminal and transparently transmitted to the VPN network by the first-level 4G communication terminal.

5. The data acquisition system based on a multi-user multiplexing mechanism according to claim 3 is characterized in that: The configuration content of the secondary 4G communication terminal when enabled specifically includes: VNP network configuration based on VPDN protocol, secondary LAN segment setting and NAT service setting; the secondary LAN segment setting sets the LAN segment of the secondary 4G communication terminal according to the LAN configuration of the southbound device. If the southbound device adopts the serial port communication mode, the serial port parameters of the secondary 4G communication terminal are synchronously configured according to the serial port configuration information; the NAT service setting uses the port forwarding function based on the NAT service, so that requests from the VPN network are forwarded to the southbound device through the secondary 4G communication terminal; for PLC devices with default industrial gateway configuration information, the IP mapping function is used to force the message data of the PLC device to be pushed to the primary 4G communication terminal corresponding to the industrial gateway, and the primary 4G communication terminal forwards the message data to the industrial gateway to achieve normal communication between the industrial gateway and the PLC device.

6. The data acquisition system based on a multi-user multiplexing mechanism according to claim 2 is characterized in that: The step of connecting the 4G communication terminal to the VPN network through the VPDN protocol in S1 specifically includes: S11, the client calls the access controller and communicates via a modem or ISDN card; S12, the client negotiates link control protocol options with the access controller, including password authentication protocol, challenge handshake authentication protocol, PPP multilink or compression, and starts the point-to-point protocol phase; S13, the access controller sends a challenge handshake identity authentication protocol challenge to the client; S14, the client generates response data according to the challenge and returns it to the access controller; S15, the access controller checks whether the client is a VPDN user through local configuration or the identity authentication, authorization and accounting server according to the domain name or called number information service in the challenge handshake identity authentication protocol response; S16. If the client is a VPDN user, the access controller obtains information from the local configuration or the authentication, authorization and accounting server, and starts a layer 2 tunneling protocol or a layer 2 forwarding protocol tunnel with the network server; S17, the access controller establishes a tunnel connection with the network server and performs two-way authentication, allowing multiple VPDN sessions to run in the same tunnel; S18, the VPDN session of the client is established with the network server through the access controller, and each client corresponds to a VPDN session; S19, the access controller forwards the negotiated link control protocol options and the user name and password of the client to the network server; S110, the network server clones the virtual access instance from the virtual template specified in the VPDN configuration, accepts the link control protocol option delivered from the access controller, and authenticates the client; S111, the network server sends a challenge handshake identity authentication protocol response to the client to complete the identity authentication; S112, executing the IP control protocol phase, installing routing and starting the PPP session, the PPP frame is transmitted through the tunnel between the access controller and the network server, and the 4G communication terminal accesses the VPN network.

7. The data acquisition system based on a multi-user multiplexing mechanism according to claim 2 is characterized in that: The steps of S2 accessing the southbound device specifically include: S21. Configure the secondary 4G communication terminal to ensure normal communication between the southbound device and the secondary 4G communication terminal; S22, the southbound device connected to the secondary 4G communication terminal through RS485 and RS232 protocols accesses the corresponding secondary 4G communication terminal; S23, accessing the private network carried by the secondary 4G communication terminal through the southbound device of Ethernet communication, where the private network carried by the secondary 4G communication terminal is consistent with the primary 4G communication terminal; S24. The industrial gateway enables the TCP-based protocol and activates the southbound interface by configuring the IP address, port, protocol, and point table information of the southbound device; S25. After the configuration is completed, the user manually activates the southbound interface; S26. The southbound device sends a message to the industrial gateway, and the southbound device is connected.

8. The data acquisition system based on a multi-user multiplexing mechanism according to claim 2 is characterized in that: The user basic information table is used to store general user information; the southbound device information table is used to store southbound device information; the data point information table is used to store point information; the user basic information table includes user ID, user name and password; the southbound device information table includes device ID, device name, private network address and port number; the private network address is the address of the VPN network assigned by the 4G communication terminal to the VPN network or set independently by the industrial gateway maintenance personnel; the port number is the port number of the port forwarding service provided by the 4G communication terminal to the connected southbound device; the private network address and the port number are both based on port forwarding; the data point information table includes device ID, point name, register address, data type and data description.

9. The data acquisition system based on a multi-user multiplexing mechanism according to claim 2 is characterized in that: The newly added common users under the multi-user multiplexing mechanism in S4 specifically include: S41. Ordinary users initiate an application to add new ordinary users to the middle office; S42, the middle office administrator verifies the legitimacy of the common user's identity. After the verification is passed, the administrator uses the super user to create a common user name corresponding to the directory under the middle office path, and generates a user basic information table, a southbound device information table, and a data point information table under the directory; S43, the middle platform sends a request to the industrial gateway to create a common user; S44. The super user creates a directory corresponding to the name of the common user under the path of the industrial gateway; S45. The industrial gateway feeds back the information that ordinary users have successfully created to the middle platform; S46. The middle platform feeds back the successful creation information to the ordinary user, confirming that the creation of the ordinary user is completed.

Images