Intelligent remote operation and maintenance system and method based on containerized deployment and data synchronization

Abstract

The invention discloses an intelligent remote operation and maintenance system and method based on containerized deployment and data synchronization, and the system comprises an intelligent telecontrol machine which is deployed in a safety I area of a transformer station side, integrates a communication function between the transformer station and a main station, and is used for achieving the operation and maintenance data collection, storage, processing and transmission services of secondary equipment of a station control layer in the transformer station; the remote operation and maintenance master station performs remote monitoring and operation and maintenance on the remote equipment through the intelligent telecontrol machine; the remote operation and maintenance master station comprises an operation and maintenance application server, a data synchronization server and an operation and maintenance management server, the operation and maintenance management server establishes connection communication with the intelligent telecontrol machine, and the operation and maintenance application server performs data synchronization with the operation and maintenance management server through the data synchronization server connected with the intelligent telecontrol machine; communication of operation and maintenance application services is realized; and services in the intelligent remote operation and maintenance system are deployed in corresponding containers of corresponding servers in a micro-service mode. According to the invention, the data synchronization efficiency and security can be improved.

Description

Technical Field

[0001] The present invention belongs to the field of remote operation and maintenance of smart substations, and in particular relates to an intelligent remote operation and maintenance system and method based on containerized deployment and data synchronization. Background Art

[0002] With the rapid development of information technology, remote operation and maintenance of smart substations has become an indispensable part of enterprise IT (Information Technology) infrastructure, ensuring high availability of business and security of data. Although the existing technical framework has achieved the separation of business and data management to a certain extent, in the face of the growing amount of data and complex and changing network environment, how to efficiently and securely synchronize key data in a distributed server environment has become a key issue that needs to be solved urgently. In particular, in scenarios where direct server interconnection is limited, traditional data synchronization strategies often expose the disadvantages of low efficiency and insufficient security. Summary of the invention

[0003] In order to solve the deficiencies in the prior art, the present invention provides an intelligent remote operation and maintenance system and method based on containerized deployment and data synchronization, which realizes efficient and secure synchronization and strict isolation of data between servers in the intelligent remote operation and maintenance system.

[0004] The present invention adopts the following technical solution.

[0005] A first aspect of the present invention provides an intelligent remote operation and maintenance system based on containerized deployment and data synchronization, comprising:

[0006] The remote operation and maintenance master station is deployed in the safety zone I on the side of the power dispatching master station to monitor and remotely operate and maintain the substation;

[0007] Intelligent telemotor, deployed in the safety zone I on the substation side, which integrates the communication function between the substation and the master station, and is used to realize the operation and maintenance data collection, storage, processing and transmission services of the secondary equipment of the station control layer in the substation;

[0008] The remote operation and maintenance master station remotely monitors and operates remote devices through intelligent telemotors. One remote operation and maintenance master station manages multiple intelligent telemotors.

[0009] The remote operation and maintenance master station includes an operation and maintenance application server, a data synchronization server and an operation and maintenance management server. The operation and maintenance management server establishes a connection and communication with the intelligent remote motor. The operation and maintenance application server synchronizes data with the operation and maintenance management server through the data synchronization server established with the intelligent remote motor to realize the communication of the operation and maintenance application business.

[0010] The services in the intelligent remote operation and maintenance system are divided and isolated according to business functions. The services include operation and maintenance application services, operation and maintenance management services, and data synchronization services. The operation and maintenance application services, operation and maintenance management services, and data synchronization services are all deployed in corresponding containers of corresponding servers in a microservice manner.

[0011] Optionally, the operation and maintenance management server and the operation and maintenance application server are isolated from each other through switch VLAN and security policies during internal networking.

[0012] Optionally, the security policy includes an inter-VLAN access control policy, a port binding policy, and a port rate limit policy. The operation and maintenance management server and the operation and maintenance application server are isolated from each other through the switch VLAN and security policy during the internal networking process, including:

[0013] According to the inter-VLAN access control policy, the addresses of the operation and maintenance management server and the operation and maintenance application server are divided into different VLANs, and mutual access between VLANs is prohibited;

[0014] Bind the port on the switch to the specified VLAN according to the port binding policy, and set the port on the switch to only receive data frames from the specified VLAN;

[0015] Configure the port transmission rate according to the port rate limit policy.

[0016] Optionally, the data synchronization direction includes data synchronization from the operation and maintenance application server to the operation and maintenance management server and data synchronization from the operation and maintenance management server to the operation and maintenance application server, and the data synchronization link is unidirectional.

[0017] Optionally, data synchronization between the communicating parties includes:

[0018] Build a first secure container at the sending end of data synchronization, deploy a sending end microservice in the first secure container, and send the synchronization data to the data synchronization server;

[0019] After receiving the synchronization data, the second security container of the data synchronization server verifies the synchronization data, and after passing the verification, synchronizes the data to the third security container, where the third security container is used to send the synchronization data to the receiving end of the data synchronization;

[0020] After receiving the synchronization data, the fourth security container at the receiving end of the data synchronization verifies the synchronization data.

[0021] Optionally, when the communicating parties perform data synchronization, the TLCP protocol is used for data transmission.

[0022] Optionally, when the communicating parties synchronize data, they use a national encryption algorithm to encrypt and protect the data, including:

[0023] The data synchronization sender generates an original symmetric key, encrypts the original symmetric key using the SM2 public key of the receiver, and sends the encrypted symmetric key to the receiver;

[0024] After receiving the encrypted symmetric key, the receiving end uses the receiving end's SM2 private key to decrypt it, obtains the original symmetric key, and completes the session key negotiation between the sending end and the receiving end. The original symmetric key is the session key used by the communicating parties to encrypt and decrypt synchronization data.

[0025] Optionally, when the communicating parties perform data synchronization, they use the negotiated session key to perform group encryption processing on the synchronization data through the SM4 algorithm.

[0026] Optionally, the data synchronization between the communicating parties further includes:

[0027] Before sending the first data, the data synchronization sending end generates a summary of the first data according to the first data, and signs the summary using the SM2 private key of the sending end to generate a digital signature;

[0028] The sending end adds the generated digital signature to the first data, generates second data, and sends the second data to the receiving end;

[0029] After receiving the second data, the receiving end calculates a summary of the second data and then verifies the digital signature using the SM2 public key of the sending end. If the verification passes, the first data included in the second data is received.

[0030] A second aspect of the present invention provides an intelligent remote operation and maintenance method for an intelligent remote operation and maintenance system, the method comprising:

[0031] Deploy the operation and maintenance application service, data synchronization service and operation and maintenance management service in the operation and maintenance application server, data synchronization server and operation and maintenance management server in a microservice manner;

[0032] The operation and maintenance application server synchronizes data with the operation and maintenance management server through the data synchronization server connected to the intelligent remote motor, thus realizing the communication of the operation and maintenance application business;

[0033] Establish a first secure container at the sending end of data synchronization, deploy a sending end microservice in the first secure container, and send the synchronization data to the data synchronization server;

[0034] After receiving the synchronization data, the second security container of the data synchronization server verifies the synchronization data, and after passing the verification, synchronizes the data to the third security container, where the third security container is used to send the synchronization data to the receiving end of the data synchronization;

[0035] After receiving the synchronization data, the fourth security container at the receiving end of the data synchronization verifies the synchronization data.

[0036] Optionally, when the communicating parties synchronize data, they use a national encryption algorithm to encrypt and protect the data, including:

[0037] The data synchronization sender generates an original symmetric key, encrypts the original symmetric key using the SM2 public key of the receiver, and sends the encrypted symmetric key to the receiver;

[0038] After receiving the encrypted symmetric key, the receiving end uses the receiving end's SM2 private key to decrypt it, obtains the original symmetric key, and completes the session key negotiation between the sending end and the receiving end. The original symmetric key is the session key used by the communicating parties to encrypt and decrypt synchronization data.

[0039] Optionally, when the communicating parties synchronize data, they use a national encryption algorithm to encrypt and protect the data, including:

[0040] The data synchronization sender generates an original symmetric key, encrypts the original symmetric key using the SM2 public key of the receiver, and sends the encrypted symmetric key to the receiver;

[0041] After receiving the encrypted symmetric key, the receiving end uses the receiving end's SM2 private key to decrypt it, obtains the original symmetric key, and completes the session key negotiation between the sending end and the receiving end. The original symmetric key is the session key used by the communicating parties to encrypt and decrypt synchronization data.

[0042] Optionally, when the communicating parties perform data synchronization, they use the negotiated session key to perform group encryption processing on the synchronization data through the SM4 algorithm.

[0043] Optionally, the data synchronization between the communicating parties further includes:

[0044] Before sending the first data, the data synchronization sending end generates a summary of the first data according to the first data, and signs the summary using the SM2 private key of the sending end to generate a digital signature;

[0045] The sending end adds the generated digital signature to the first data, generates second data, and sends the second data to the receiving end;

[0046] After receiving the second data, the receiving end calculates a summary of the second data and then verifies the digital signature using the SM2 public key of the sending end. If the verification passes, the first data included in the second data is received.

[0047] Compared with the prior art, the beneficial effects of the present invention include at least:

[0048] The present invention uses the inherent security characteristics of containerization technology and the external protection of TLCP (Transport Layer Cryptography Protocol) to build a comprehensive security system from the underlying container to the transport layer, significantly improving the security barrier of the intelligent remote operation and maintenance system. TLCP encrypts data packets end-to-end, ensuring that data is protected from eavesdropping, tampering or replay attacks even on insecure network channels, building an indestructible line of defense for the transmission of critical data.

[0049] The present invention utilizes the rapid response capability of containerization to ensure timely and accurate synchronization of data even under complex network isolation conditions, thus effectively supporting business continuity and stability.

[0050] The container on the data synchronization server of the present invention is responsible for reviewing and filtering data streams, and strictly verifies the confidentiality, integrity, and availability of data streams to ensure that only authenticated and authorized data packets can pass through, effectively preventing unauthorized access or data leakage, and enhancing the overall data protection capabilities of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0052] Figure 1 It is a functional architecture diagram of an intelligent remote operation and maintenance system provided by an embodiment of the present invention;

[0053] Figure 2 It is a schematic diagram of the deployment architecture of an intelligent remote operation and maintenance system provided by an embodiment of the present invention;

[0054] Figure 3 It is a schematic diagram of a data synchronization process provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. The embodiments described in this application are only embodiments of a part of the present invention, rather than all embodiments. Based on the spirit of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the protection scope of the present invention.

[0056] Combination Figure 1 and Figure 2As shown, Embodiment 1 of the present invention provides an intelligent remote operation and maintenance system based on containerized deployment and data synchronization, including:

[0057] Remote operation and maintenance master station and intelligent telemotors. One remote operation and maintenance master station can manage multiple intelligent telemotors. The remote operation and maintenance master station is deployed in the safety zone I on the side of the power dispatching master station, and the intelligent telemotors are deployed in the safety zone I on the side of the substation. The functions of the remote operation and maintenance master station include remote operation and maintenance, security control, equipment management, operation and maintenance audit, etc. The intelligent telemotors can realize remote monitoring, remote inspection, remote control, remote maintenance and other functions of remote equipment. The intelligent telemotors integrate the communication function between the substation and the master station, realize the operation and maintenance data collection, storage, processing and transmission services of the secondary equipment of the station control layer in the substation, and support channel control, remote monitoring, remote inspection, remote control, remote maintenance, remote login, security control and intelligent alarm and other functions.

[0058] The intelligent remote operation and maintenance system divides and isolates services according to business functions, mainly into operation and maintenance application services, operation and maintenance management services, and data synchronization services. The services in the operation and maintenance system are deployed in the corresponding Docker containers in a microservices manner.

[0059] Specifically, the operation and maintenance application service, operation and maintenance management service and data synchronization service start a container instance on their respective servers. The servers involved in the system all use the domestic operating system Ningsi Security Operating System V6.0.100_X86_64, with 64G memory and x86_64 CPU architecture, on which the Docker container service is deployed. The operation and maintenance application service, data synchronization service, operation and maintenance management service, etc. are packaged into Docker container images through Dockerfile, and the Dcoker container images are loaded into the Docker services of the corresponding servers respectively. The corresponding services are started through script commands to complete the service deployment.

[0060] The remote operation and maintenance master station includes an operation and maintenance application server, a data synchronization server, and an operation and maintenance management server. The operation and maintenance management server can establish a connection and communication with the intelligent remote motor, but the operation and maintenance application server cannot directly establish a connection with the intelligent remote motor. It needs to forward data through the data synchronization server that is connected to the intelligent remote motor to realize the communication of the operation and maintenance application business. The operation and maintenance application service and operation and maintenance management service on the intelligent remote motor are service functions that interact and connect with the operation and maintenance application service and operation and maintenance management service of the remote operation and maintenance master station respectively.

[0061] Specifically, the operation and maintenance application service mainly realizes the operation and maintenance related work order management, remote monitoring, remote access, remote control, remote maintenance and other business tasks. The operation and maintenance management service mainly realizes the remote inspection, data analysis, status monitoring, authority allocation of the operation and maintenance system, and the management of the communication channel with the substation side.

[0062] Optionally, the operation and maintenance application service communicates with the intelligent remote motor through a firewall and a vertical encryption device to complete the operation and execution of related services. The vertical encryption device is a security protection device deployed between the power dispatching data network router and the remote operation and maintenance master station, which is used to authenticate and encrypt the vertical business data transmission of the power dispatching, thereby improving the confidentiality and integrity of data transmission.

[0063] Optionally, the operation and maintenance management server and the operation and maintenance application server are isolated from each other through switch VLAN and security policies during internal networking.

[0064] Create multiple VLANs on the switch, configure different access rights and security policies for each VLAN, and assign the addresses of the operation and maintenance management server and the operation and maintenance application server to different VLANs. The ports on the switch receive data frames belonging to the preset VLAN, where the preset VLAN is set in the port configuration. In this way, servers on different VLANs cannot communicate directly, thus achieving the purpose of network isolation.

[0065] Specifically, the security policy includes inter-VLAN access control policy, port binding policy and port speed limit policy. Through the inter-VLAN access control policy, the operation and maintenance management server and the operation and maintenance application server addresses are divided into different VLANs, and mutual access between VLANs is prohibited. The port binding policy is to bind the port on the switch to a specified VLAN and set it to receive only the data frame of the VLAN. The port speed limit policy is to prevent network congestion and attacks by configuring the transmission rate of the port. According to actual production requirements, the embodiment of the present invention limits the import and export bandwidth of each VLAN to 2M to prevent a single VLAN from occupying too many network resources.

[0066] Specifically, the data synchronization service is mainly used to synchronize the data of operation and maintenance services and operation and maintenance management services to ensure the data consistency and system availability of the smart substation operation and maintenance system.

[0067] When the operation and maintenance application server and the operation and maintenance management server synchronize data, they do not directly establish a network connection, but use data synchronization services to achieve data synchronization; the data synchronization server provides data synchronization services to achieve key business data synchronization between the operation and maintenance application server and the operation and maintenance management server; the data synchronization service is deployed on the server in a containerized manner. The data synchronization service achieves data isolation during the data synchronization process by deploying it separately in a Docker container, and increases the security of the data synchronization process by deploying independent applications on secure containers.

[0068] Furthermore, combined with Figure 3As shown, there are two directions of data synchronization, namely, synchronization from the operation and maintenance application server to the operation and maintenance management server, and synchronization from the operation and maintenance management server to the operation and maintenance application server. The data synchronization links are all unidirectional data flows.

[0069] Specifically, the data synchronization between the communicating parties includes: the data synchronization sending end constructs a first security container, deploys a data synchronization sending end microservice in the first security container, initiates real-time synchronization of key data and sends the synchronized data to the data synchronization server;

[0070] After receiving the synchronization data, the second security container of the data synchronization server will verify the confidentiality, integrity, and availability of the synchronization data. After ensuring that there are no errors, the data will be synchronized to the third security container by mounting the Docker container volume, which is used to send the synchronization data when it is finally received;

[0071] After receiving the synchronization data sent by the data synchronization server, the fourth security container at the receiving end of the data synchronization will verify the confidentiality, integrity and availability of the synchronization data, process the synchronization data that meets the requirements, and block and warn the illegal data. Furthermore, when the communicating parties perform data synchronization, the TLCP protocol is used for data transmission.

[0072] Specifically, when communicating between the operation and maintenance application server and the data synchronization server, and between the data synchronization server and the operation and maintenance management server, the TLCP protocol is uniformly used for transmission, which can improve the security of data communication.

[0073] Optionally, when the communicating parties synchronize data, they use a national encryption algorithm to encrypt and protect the data, including:

[0074] The data synchronization sender generates an original symmetric key, encrypts the original symmetric key using the SM2 public key of the receiver, and sends the encrypted symmetric key to the receiver;

[0075] After receiving the encrypted symmetric key, the receiving end uses the receiving end's SM2 private key to decrypt it, obtains the original symmetric key, and completes the session key negotiation between the sending end and the receiving end. The original symmetric key is the session key used by the communicating parties to encrypt and decrypt synchronization data.

[0076] Optionally, when the communicating parties perform data synchronization, they use the negotiated session key to perform group encryption processing on the synchronization data through the SM4 algorithm.

[0077] Optionally, the data synchronization between the communicating parties further includes:

[0078] Before sending the first data, the data synchronization sending end generates a summary of the first data according to the first data, and signs the summary using the SM2 private key of the sending end to generate a digital signature;

[0079] The sending end adds the generated digital signature to the first data, generates second data, and sends the second data to the receiving end;

[0080] After receiving the second data, the receiving end calculates a summary of the second data and then verifies the digital signature using the SM2 public key of the sending end. If the verification passes, the first data included in the second data is received.

[0081] In this embodiment, the synchronized data content encryption and decryption mainly uses a symmetric key algorithm combined with an asymmetric algorithm to implement key protection, and uses national secret algorithms SM2, SM3, SM4, etc. to implement related encryption, decryption, and signature services. The specific functions are as follows:

[0082] (1) Session key negotiation: Before the communicating parties can encrypt and transmit data, they must ensure that a secure session key has been established. The sending segment of the communication generates a symmetric key (session key), which is then encrypted using the receiving end's public key (SM2 public key). The encrypted symmetric key is then sent to the receiving end. After receiving the encrypted symmetric key, the receiving end uses its own private key (SM2 private key) to decrypt it, thereby recovering the original symmetric key. This symmetric key is the session key used to encrypt and decrypt data in subsequent communications between the two parties.

[0083] (2) Encryption function: The encryption function uses the negotiated session key to encrypt the key data to be transmitted to ensure the confidentiality of the data during transmission. The data is encrypted using the negotiated session key using the SM4 algorithm.

[0084] SM4 is a block encryption algorithm with high security and high efficiency. The encrypted data is output through the encryption interface service and is ready to be sent to the receiving end.

[0085] (3) Decryption function: The decryption function is the reverse process of the encryption function. It uses the same session key to decrypt the received encrypted data to restore the original unencrypted data. The encrypted data is received through the secure channel and decrypted using the previously negotiated session key using the SM4 algorithm. The integrity and correctness of the decrypted data are verified, and then the decrypted original data is output to the application layer.

[0086] (4) Signature and Verification: The SM2 algorithm is used for digital signature and verification. Before sending data, the sender uses its own private key (SM2 private key) and the SM3 digest algorithm to sign the data.

[0087] First, use the SM3 algorithm to generate a summary of the data, and then use the private key to sign the summary to generate a digital signature. The generated digital signature is attached to the original data and then sent to the receiving end. After the receiving end receives the data, it first uses the SM3 algorithm to calculate the summary of the data part, and then uses the public key of the sender (SM2 public key) to verify the attached digital signature. If the verification is successful, it means that the data has not been tampered with during the transmission process and is indeed from the claimed sender. In this way, the integrity of the data and the reliability of the source can be ensured.

[0088] This invention uses a carefully designed containerized data synchronization solution, combined with container technology, TLCP protocol, firewall and industry-leading encryption communication technology to strengthen the system security from different angles. Container technology realizes secure isolation between services; TLCP focuses on data encryption and communication security at the transport layer; firewalls mainly control network security access between different systems; encryption technology mainly protects the security and integrity of data transmission content, successfully overcoming the limitations of traditional data synchronization solutions and bringing a double improvement in security and efficiency to the intelligent remote operation and maintenance system. It not only reflects the deep integration and innovative application of technology, but also provides strong support for data management and protection in the process of enterprise digital transformation.

[0089] Embodiment 2 of the present invention provides an intelligent remote operation and maintenance method based on containerized deployment and data synchronization, which is applied to the intelligent remote operation and maintenance system in Embodiment 1. The method includes the following contents:

[0090] S100. Deploy the operation and maintenance application service, the data synchronization service and the operation and maintenance management service in the form of microservices in the operation and maintenance application server, the data synchronization server and the operation and maintenance management server respectively.

[0091] S200, the operation and maintenance application server synchronizes data with the operation and maintenance management server through the data synchronization server connected to the intelligent remote motor, thereby realizing communication of the operation and maintenance application business.

[0092] Data synchronization in S200 includes:

[0093] S201. Establish a first secure container at the sending end of data synchronization, deploy a sending end microservice in the first secure container, and send the synchronized data to the data synchronization server.

[0094] S202: After receiving the synchronization data, the second security container of the data synchronization server verifies the synchronization data, and after the verification is passed, synchronizes the data to the third security container, where the third security container is used to send the synchronization data to the receiving end of the data synchronization.

[0095] S203: After receiving the synchronization data, the fourth security container at the receiving end of the data synchronization verifies the synchronization data.

[0096] Optionally, in S200, when the communicating parties perform data synchronization, the national secret algorithm is used to encrypt and protect the data, including: the sending end of data synchronization generates an original symmetric key, uses the SM2 public key of the receiving end to encrypt the original symmetric key, and sends the encrypted symmetric key to the receiving end; after receiving the encrypted symmetric key, the receiving end uses the SM2 private key of the receiving end to decrypt it, obtains the original symmetric key, and completes the session key negotiation between the sending end and the receiving end. The original symmetric key is the session key used by the communicating parties to encrypt and decrypt the synchronization data.

[0097] Furthermore, when the communicating parties synchronize data, they use the negotiated session key to perform group encryption processing on the synchronization data through the SM4 algorithm.

[0098] Furthermore, the data synchronization between the communicating parties in S200 further includes:

[0099] Before sending the first data, the data synchronization sending end generates a summary of the first data based on the first data, signs the summary with the SM2 private key of the sending end, and generates a digital signature; the sending end adds the generated digital signature to the first data, generates second data, and sends the second data to the receiving end; after receiving the second data, the receiving end calculates the summary of the second data and verifies the digital signature with the SM2 public key of the sending end. If the verification passes, the first data contained in the second data is received.

[0100] Compared with the prior art, the beneficial effects of the present invention include at least:

[0101] The present invention uses the inherent security characteristics of containerization technology and the external protection of TLCP to build a comprehensive security system from the underlying container to the transport layer, significantly improving the security barrier of the intelligent remote operation and maintenance system. TLCP encrypts data packets end-to-end, ensuring that data is protected from eavesdropping, tampering or replay attacks even on insecure network channels, building an indestructible line of defense for the transmission of critical data.

[0102] The present invention utilizes the rapid response capability of containerization to ensure timely and accurate synchronization of data even under complex network isolation conditions, thus effectively supporting business continuity and stability.

[0103] The container on the data synchronization server of the present invention is responsible for reviewing and filtering data streams, and strictly verifies the confidentiality, integrity, and availability of data streams to ensure that only authenticated and authorized data packets can pass through, effectively preventing unauthorized access or data leakage, and enhancing the overall data protection capabilities of the system.

[0104] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0105] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0106] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0107] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0108] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0109] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. An intelligent remote operation and maintenance system based on containerized deployment and data synchronization, characterized in that: include: The remote operation and maintenance master station is deployed in the safety zone I on the side of the power dispatching master station to monitor and remotely operate and maintain the substation; Intelligent telemotor, deployed in the safety zone I on the substation side, which integrates the communication function between the substation and the master station, and is used to realize the operation and maintenance data collection, storage, processing and transmission services of the secondary equipment of the station control layer in the substation; The remote operation and maintenance master station remotely monitors and operates remote devices through intelligent telemotors. One remote operation and maintenance master station manages multiple intelligent telemotors. The remote operation and maintenance master station includes an operation and maintenance application server, a data synchronization server and an operation and maintenance management server. The operation and maintenance management server establishes a connection and communication with the intelligent remote motor. The operation and maintenance application server synchronizes data with the operation and maintenance management server through the data synchronization server established with the intelligent remote motor to realize the communication of the operation and maintenance application business. The services in the intelligent remote operation and maintenance system are divided and isolated according to business functions. The services include operation and maintenance application services, operation and maintenance management services, and data synchronization services. The operation and maintenance application services, operation and maintenance management services, and data synchronization services are all deployed in corresponding containers of corresponding servers in a microservice manner.

2. The intelligent remote operation and maintenance system based on containerized deployment and data synchronization according to claim 1, characterized in that: The operation and maintenance management server and the operation and maintenance application server are isolated through switch VLAN and security policies during the internal networking process.

3. The intelligent remote operation and maintenance system based on containerized deployment and data synchronization according to claim 2 is characterized in that: Security policies include inter-VLAN access control policies, port binding policies, and port rate limit policies. The operation and maintenance management server and the operation and maintenance application server are isolated through switch VLAN and security policies during the internal networking process, including: According to the inter-VLAN access control policy, the addresses of the operation and maintenance management server and the operation and maintenance application server are divided into different VLANs, and mutual access between VLANs is prohibited; Bind the port on the switch to the specified VLAN according to the port binding policy, and set the port on the switch to only receive data frames from the specified VLAN; Configure the port transmission rate according to the port rate limit policy.

4. The intelligent remote operation and maintenance system based on containerized deployment and data synchronization according to claim 1, characterized in that: The data synchronization direction includes data synchronization from the operation and maintenance application server to the operation and maintenance management server and data synchronization from the operation and maintenance management server to the operation and maintenance application server. The data synchronization link is unidirectional.

5. The intelligent remote operation and maintenance system based on containerized deployment and data synchronization according to claim 4 is characterized in that: Data synchronization between the two communicating parties includes: Build a first secure container at the sending end of data synchronization, deploy a sending end microservice in the first secure container, and send the synchronization data to the data synchronization server; After receiving the synchronization data, the second security container of the data synchronization server verifies the synchronization data, and after passing the verification, synchronizes the data to the third security container, where the third security container is used to send the synchronization data to the receiving end of the data synchronization; After receiving the synchronization data, the fourth security container at the receiving end of the data synchronization verifies the synchronization data.

6. The intelligent remote operation and maintenance system based on containerized deployment and data synchronization according to claim 5 is characterized in that: When the communicating parties perform data synchronization, the TLCP protocol is used for data transmission.

7. The intelligent remote operation and maintenance system based on containerized deployment and data synchronization according to claim 6 is characterized in that: When the two communicating parties synchronize data, they use the national secret algorithm to encrypt and protect the data, including: The data synchronization sender generates an original symmetric key, encrypts the original symmetric key using the SM2 public key of the receiver, and sends the encrypted symmetric key to the receiver; After receiving the encrypted symmetric key, the receiving end uses the receiving end's SM2 private key to decrypt it, obtains the original symmetric key, and completes the session key negotiation between the sending end and the receiving end. The original symmetric key is the session key used by the communicating parties to encrypt and decrypt the synchronization data.

8. The intelligent remote operation and maintenance system based on containerized deployment and data synchronization according to claim 7, characterized in that: When the communicating parties synchronize data, they use the negotiated session key to encrypt the synchronization data in groups using the SM4 algorithm.

9. The intelligent remote operation and maintenance system based on containerized deployment and data synchronization according to claim 7, characterized in that: Data synchronization between the two communicating parties also includes: Before sending the first data, the data synchronization sending end generates a summary of the first data according to the first data, and signs the summary using the SM2 private key of the sending end to generate a digital signature; The sending end adds the generated digital signature to the first data, generates second data, and sends the second data to the receiving end; After receiving the second data, the receiving end calculates a summary of the second data and then verifies the digital signature using the SM2 public key of the sending end. If the verification passes, the first data included in the second data is received.

10. An intelligent remote operation and maintenance method using the intelligent remote operation and maintenance system according to any one of claims 1 to 9, characterized in that: The method comprises: Deploy the operation and maintenance application service, data synchronization service and operation and maintenance management service in the operation and maintenance application server, data synchronization server and operation and maintenance management server in a microservice manner; The operation and maintenance application server synchronizes data with the operation and maintenance management server through the data synchronization server connected to the intelligent remote motor, thus realizing the communication of the operation and maintenance application business; Establish a first secure container at the sending end of data synchronization, deploy a sending end microservice in the first secure container, and send the synchronization data to the data synchronization server; After receiving the synchronization data, the second security container of the data synchronization server verifies the synchronization data, and after passing the verification, synchronizes the data to the third security container, where the third security container is used to send the synchronization data to the receiving end of the data synchronization; After receiving the synchronization data, the fourth security container at the receiving end of the data synchronization verifies the synchronization data.

11. The intelligent remote operation and maintenance method based on containerized deployment and data synchronization according to claim 10, characterized in that: When the two communicating parties synchronize data, they use the national secret algorithm to encrypt and protect the data, including: The data synchronization sender generates an original symmetric key, encrypts the original symmetric key using the SM2 public key of the receiver, and sends the encrypted symmetric key to the receiver; After receiving the encrypted symmetric key, the receiving end uses the receiving end's SM2 private key to decrypt it, obtains the original symmetric key, and completes the session key negotiation between the sending end and the receiving end. The original symmetric key is the session key used by the communicating parties to encrypt and decrypt the synchronization data.

12. The intelligent remote operation and maintenance method based on containerized deployment and data synchronization according to claim 11, characterized in that: When the two communicating parties synchronize data, they use the national secret algorithm to encrypt and protect the data, including: The data synchronization sender generates an original symmetric key, encrypts the original symmetric key using the SM2 public key of the receiver, and sends the encrypted symmetric key to the receiver; After receiving the encrypted symmetric key, the receiving end uses the receiving end's SM2 private key to decrypt it, obtains the original symmetric key, and completes the session key negotiation between the sending end and the receiving end. The original symmetric key is the session key used by the communicating parties to encrypt and decrypt the synchronization data.

13. The intelligent remote operation and maintenance method based on containerized deployment and data synchronization according to claim 12, characterized in that: When the communicating parties synchronize data, they use the negotiated session key to encrypt the synchronization data in groups using the SM4 algorithm.

14. The intelligent remote operation and maintenance method based on containerized deployment and data synchronization according to claim 12, characterized in that: Data synchronization between the two communicating parties also includes: Before sending the first data, the data synchronization sending end generates a summary of the first data according to the first data, and signs the summary using the SM2 private key of the sending end to generate a digital signature; The sending end adds the generated digital signature to the first data, generates second data, and sends the second data to the receiving end; After receiving the second data, the receiving end calculates a summary of the second data and then verifies the digital signature using the SM2 public key of the sending end. If the verification passes, the first data included in the second data is received.

Images