Security authorization identification method and device for power grid substation facilities

Abstract

The invention provides a security authorization identification method and device for power grid substation facilities, and relates to the technical field of power grid equipment management, and the method comprises the steps: a power station internal network obtains the information of a task to be executed at present, and obtains the visitor identification information obtained through scanning equipment; identifying the visitor identification information according to a permission information base pre-stored in a substation intranet; acquiring equipment state information of the execution facility, and identifying the authenticity of the task information according to the equipment state information; identifying the task execution permission of the visitor according to the permission information base; and if the task execution authority of the visitor is matched with the task information, granting the authority of entering the area where the execution facility is located to the visitor. According to the scheme, safety authorization identification is comprehensively carried out from three aspects of visitor identity, task authenticity and task execution authority, so that the power grid substation facilities can be effectively isolated, and an efficient and reliable identity verification and access control mechanism can be provided.

Description

Technical Field

[0001] The present invention relates to the technical field of power grid equipment management, and in particular to a method and device for secure authorization identification of power grid substation facilities. Background Art

[0002] For power grid substations, the security authorization identification of personnel entering is a key link to ensure site safety management and stable operation of the power system. As the hub of power transmission and distribution, the importance of substations is self-evident. Any unauthorized or improperly reviewed personnel entering may bring safety hazards, including but not limited to equipment damage, accidents caused by operational errors, and information leakage.

[0003] In traditional manned substations, the method of relying on security personnel to verify and control the entry of personnel has a significant risk of human error, such as security vulnerabilities caused by identity verification errors or negligence. In unmanned substations, despite the reduction of labor costs and the improvement of automation, the traditional management model still faces challenges: for example, the inefficiency caused by a single person responsible for the gate opening and closing operations of multiple stations, long waiting times for station staff, inability to accurately record the entry and exit of personnel, difficulty in post-event tracing, and slow response to emergencies.

[0004] Although the current method of using smart gate management APP has improved some automation levels, it still relies on manual approval by managers, which not only reduces the efficiency of real-time approval, but also retains a certain degree of risk of human intervention and subjective judgment, which may lead to misjudgment or delays in the authorization process.

[0005] Therefore, how to provide an efficient and reliable personnel security authorization identification method is an urgent problem that needs to be solved. Summary of the invention

[0006] In order to improve the above problems, the present invention provides a method and device for security authorization identification of power grid substation facilities.

[0007] A first aspect of an embodiment of the present invention provides a method for secure authorization identification of a power grid substation facility, the method comprising: The substation intranet obtains the task information to be executed, including the executor, execution facility, execution operation, task release time, and the visitor identification information obtained by scanning equipment; Identify the visitor's identification information according to the authority information database pre-stored in the substation intranet to confirm the visitor's identity; After the visitor's identity is successfully confirmed, the equipment status information of the execution facility is obtained, and the authenticity of the task information is identified based on the equipment status information; If the authenticity of the task information is confirmed, the task execution authority of the visitor is identified according to the authority information database; If the task execution authority of the visitor matches the task information, the visitor is granted authority to enter the area where the execution facility is located.

[0008] Optionally, the visitor identification information includes the visitor electronic identity information and the visitor biometric information, and the step of obtaining the visitor identification information obtained by the scanning device specifically includes: Obtain the electronic identity information of visitors through signal scanning equipment; Collect the visitor's biometric information through image acquisition equipment or biometric acquisition equipment.

[0009] Optionally, the step of identifying the visitor identification information according to the authority information library pre-stored in the substation intranet to confirm the identity of the visitor specifically includes: Retrieving personnel information matching the electronic identity information of the visitor from the authority information database, wherein the personnel information includes basic personnel information and biometric identification information; Matching the biometric identification information with the collected biometric information of the visitor; If the match is successful, the visitor's identity is confirmed. If the match fails, the visitor's identity confirmation fails and subsequent recognition actions are stopped.

[0010] Optionally, the step of obtaining device status information of the execution facility and identifying the authenticity of the task information according to the device status information specifically includes: Acquire device status information corresponding to the execution facility; Determining the rationality of executing the execution operation according to the device status information; If there is rationality in performing the execution operation, the authenticity of the task information is confirmed.

[0011] Optionally, the step of judging the rationality of executing the execution operation according to the device status information specifically includes: Determine the device status of the execution facility according to the device status information, wherein the device status includes an abnormal state and a normal state; The execution operation includes a repair operation and a maintenance operation. When the equipment state is an abnormal state, if the execution operation is a repair operation, the rationality of the execution operation is judged. When the equipment state is a normal state, if the execution operation is a maintenance operation, the rationality of the execution operation is judged.

[0012] Optionally, the step of judging the rationality of executing the execution operation according to the device status information specifically further includes: When the equipment state is an abnormal state and the execution operation is a maintenance operation, further obtaining the abnormal time point when the execution facility enters the abnormal state, and judging whether the abnormal time point is earlier than the task release time, and if so, judging the rationality of the existence of the execution operation; When the equipment status is normal and the execution operation is a maintenance operation, further obtain the most recent maintenance time point when the execution facility last performed a maintenance operation, and determine whether the interval between the most recent maintenance time point and the task release time conforms to the normal maintenance cycle of the execution facility. If so, determine the rationality of the existence of the execution operation.

[0013] Optionally, the step of judging the rationality of executing the execution operation according to the device status information specifically further includes: When the device state is an abnormal state and the executed operation is a maintenance operation, determining whether the maintenance operation is an operation to relieve the corresponding abnormal state; If yes, then determine whether the execution operation is reasonable.

[0014] Optionally, the step of identifying the visitor's task execution authority according to the authority information database specifically includes: Extracting a list of personnel with corresponding authority from the authority information database according to the execution facility and the execution operation; Determine whether the visitor whose identity is successfully confirmed is on the list of persons; If so, it is determined that the visitor's task execution authority matches the task information.

[0015] Optionally, the step of identifying the visitor's task execution authority according to the authority information database specifically includes: When the number of executors in the task information is two or more, determine whether all the visiting personnel are in the personnel list; If both are present, it is determined that the visitor's task execution authority matches the task information.

[0016] A second aspect of an embodiment of the present invention provides a security authorization identification device for a power grid substation facility, comprising: An information acquisition unit is used to acquire the task information to be executed in the substation intranet, wherein the task information includes the executor, the execution facility, the execution operation, the task release time, and the visitor identification information obtained by the scanning device; The identity recognition unit is used to identify the visitor's identification information according to the authority information database pre-stored in the substation intranet and confirm the visitor's identity; The task identification unit is used to obtain the equipment status information of the execution facility after the identity of the visitor is successfully confirmed, and to identify the authenticity of the task information based on the equipment status information; The authority identification unit is used to identify the task execution authority of the visitor according to the authority information database if the authenticity of the task information is confirmed; The authority granting unit is used to grant the visitor the authority to enter the area where the execution facility is located if the visitor's task execution authority matches the task information.

[0017] According to a third aspect of an embodiment of the present invention, there is provided an electronic device, including: One or more processors; a memory; one or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, and the one or more applications are configured to execute the method as described in the first aspect.

[0018] According to a fourth aspect of an embodiment of the present invention, a computer-readable storage medium is provided, in which a program code is stored. The program code can be called by a processor to execute the method described in the first aspect.

[0019] In summary, the present invention provides a method and device for identifying security authorization of power grid substation facilities. Taking into account the characteristics of the isolation of the substation intranet from the outside, security authorization is comprehensively identified from three perspectives: the identity of the visitor, the authenticity of the task, and the task execution authority. This enables the power grid substation facilities to not only achieve effective isolation at the physical and logical levels, but also provide an efficient and reliable identity authentication and access control mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 A method flow chart of a method for security authorization identification of a power grid substation facility according to an embodiment of the present invention; Figure 2 This is a functional module block diagram of a security authorization identification device for a power grid substation facility according to an embodiment of the present invention; Figure 3 The present invention is a structural block diagram of an electronic device for executing a security authorization identification method for a power grid substation facility according to an embodiment of the present application.

[0022] Figure 4 The present invention is a structural block diagram of a computer-readable storage medium for storing or carrying a program code for implementing the abnormal vessel identification method according to an embodiment of the present application.

[0023] Reference numerals: Information acquisition unit 110 ; identity recognition unit 120 ; task recognition unit 130 ; authority recognition unit 140 ; ​​authority granting unit 150 ; electronic device 300 ; processor 310 ; memory 320 ; computer readable storage medium 400 ; program code 410 . DETAILED DESCRIPTION

[0024] For power grid substations, the security authorization identification of personnel entering is a key link to ensure site safety management and stable operation of the power system. As the hub of power transmission and distribution, the importance of substations is self-evident. Any unauthorized or improperly reviewed personnel entering may bring safety hazards, including but not limited to equipment damage, accidents caused by operational errors, and information leakage.

[0025] In traditional manned substations, the method of relying on security personnel to verify and control the entry of personnel has a significant risk of human error, such as security vulnerabilities caused by identity verification errors or negligence. In unmanned substations, despite the reduction of labor costs and the improvement of automation, the traditional management model still faces challenges: for example, the inefficiency caused by a single person responsible for the gate opening and closing operations of multiple stations, long waiting times for station staff, inability to accurately record the entry and exit of personnel, difficulty in post-event tracing, and slow response to emergencies.

[0026] Although the current method of using smart gate management APP has improved some automation levels, it still relies on manual approval by managers, which not only reduces the efficiency of real-time approval, but also retains a certain degree of risk of human intervention and subjective judgment, which may lead to misjudgment or delays in the authorization process.

[0027] Therefore, how to provide an efficient and reliable personnel security authorization identification method is an urgent problem that needs to be solved.

[0028] In view of this, the designers of the present invention have designed a method and device for secure authorization identification of power grid substation facilities.

[0029] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0030] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0032] In the description of the present invention, it should be noted that the terms "top", "bottom", "inside", "outside", etc. indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, or the orientation or positional relationship in which the invented product is usually placed when in use, which is only for the convenience of describing the present invention and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0033] In the description of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, the terms "set", "install", "connect", and "connect" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0034] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other.

[0035] The security authorization identification method for power grid substation facilities provided in this embodiment will be described in detail below.

[0036] See also Figure 1 The present embodiment provides a method for secure authorization identification of power grid substation facilities, the method comprising: Step S101, the substation intranet obtains the task information to be executed, the task information includes the executor, execution facility, execution operation, task release time, and obtains the visitor identification information obtained by scanning equipment.

[0037] Under normal circumstances, the substation intranet remains isolated from the external network and interacts with the outside world through a pre-set data interaction interface to obtain task information or update other data on the intranet.

[0038] In this embodiment, the substation intranet may obtain task information by directly obtaining task information transmitted by an external task issuing system through a pre-configured communication interface.

[0039] On the other hand, the task information can also be obtained on-site through the substation intranet, that is, the external task release system generates the task information and sends it to the executor. The smart terminal carried by the executor generates the corresponding identification password or QR code according to the task information, and the mapping relationship between the identification password or QR code and the task information is unique. When the executor comes to the substation as a visitor, the substation intranet collects the identification password or QR code displayed by the visitor through a device that has established a signal connection with the substation intranet, and obtains the task information corresponding to the identification password or QR code according to the pre-saved mapping relationship. As a preferred method, the mapping relationship can be updated regularly to reduce the probability of being cracked.

[0040] The task information contains the specific content of the operation task that the executor needs to perform at the current substation. Among them, the executor corresponds to the person who comes to perform the task. It should be noted that, depending on the task, the executor can be one person or multiple people. The execution facility corresponds to the equipment that needs to be operated for the current task, which can be identified by a specific equipment number. The execution operation is a specific operation action that needs to be performed on the equipment. The task release time corresponds to the time when the external task release system generates the task information. As a preferred embodiment, considering that the task release system usually releases execution tasks for multiple different substations, the task information can also include the substation number used to identify the execution of the task. When the substation intranet obtains the current task information to be executed, it will first check whether the substation number is consistent with its own number. If it is inconsistent, the subsequent identification action will be stopped, and a prompt will be given to the source of the task information.

[0041] It should be noted that there are two ways to generate task information. One is that the visiting personnel report the task content to be performed to the task release system according to work needs (they can fill in relevant information through the mobile phone APP to report, or log in to the relevant system on the computer to report), including the execution time, location, execution object, execution operation, etc. The task release system generates the corresponding task information based on the content reported by the visiting personnel. Another way is that the task release system generates corresponding task information based on periodic regular work arrangements or temporary needs of the substation.

[0042] Visitor identification information is also collected through a scanning device that establishes a signal connection with the substation intranet. When task information is acquired on-site, task information and visitor identification information can be acquired simultaneously through a device that integrates multiple information collection functions.

[0043] As a preferred embodiment of the present invention, the visitor identification information includes the visitor electronic identity information and the visitor biometric information. The electronic identity information and the biometric information are bound to each other. The electronic identity information and the biometric information of the substation employees are pre-stored in the authority information library of the substation intranet to facilitate the identification and verification of the visitor in the substation intranet when it is isolated from the external network.

[0044] Specifically, the electronic identity information of the visitor is obtained through a signal scanning device; the biometric information of the visitor is collected through an image acquisition device or a biometric acquisition device. The electronic identity information of the visitor is usually provided by a device carried by the visitor, such as RFID. When the signal scanning device scans the device, the corresponding electronic identity information is read. Biometric information includes facial image data, fingerprints, palm veins, iris features, etc. According to the biometric features used, the corresponding acquisition device can be selected.

[0045] In actual applications, visitors often try to enter with the RFID of other people with access rights. In order to effectively avoid this situation, it is necessary to collect the electronic identity information and biometric information of the visitor at the same time.

[0046] Step S102, identifying the visitor's identification information according to the authority information database pre-stored in the substation intranet to confirm the visitor's identity.

[0047] The identification of visitors is the first step in the entire security authorization identification process, and its purpose is to confirm the identity of the visitor. Since the authority information database of the substation intranet has pre-saved staff information, the obtained visitor identification information can be matched with the information in the authority information database to confirm their identity.

[0048] In order to prevent the above-mentioned visitor from impersonating the electronic identity information of other persons with access rights, as a preferred method of the embodiment of the present invention, step S102 specifically includes: Retrieving personnel information matching the electronic identity information of the visitor from the authority information database, wherein the personnel information includes basic personnel information and biometric identification information; Matching the biometric identification information with the collected biometric information of the visitor; If the match is successful, the visitor's identity is confirmed. If the match fails, the visitor's identity confirmation fails and subsequent recognition actions are stopped.

[0049] It should be noted that when confirming the identity of a visitor, you can also choose to first match the biometric identification information with the visitor's biometric information, and then compare and verify the basic information of the person corresponding to the matched biometric identification information with the visitor's electronic identity information.

[0050] Both methods require that the electronic identity information and biometric information provided by the visitor be the same as the information of the same person in the authority information database. This is used to confirm the identity of the visitor. If any of the information fails to match, the visitor's identity confirmation is considered to have failed. A prompt needs to be issued and subsequent identification actions stopped.

[0051] On the basis of the above, if there are two or more visitors, the identity of each visitor needs to be confirmed in turn.

[0052] Step S103, after the identity of the visitor is successfully confirmed, the equipment status information of the execution facility is obtained, and the authenticity of the task information is identified based on the equipment status information.

[0053] After successfully completing the visitor's identity confirmation, the second step of the security authorization identification process is to confirm the authenticity of the task information.

[0054] In actual applications, visitors who intend to illegally obtain security authorization may do so by forging task information. However, the task information generated by the task publishing system is usually related to the specific status of the power grid substation facilities. Considering the isolation of the intranet, it is difficult to directly obtain the equipment status of the substation facilities from the outside. Therefore, the authenticity of the task information can be identified through the equipment status information of the executing facilities in the task information. Specifically, as a preferred method of an embodiment of the present invention, step S103 specifically includes: Acquire device status information corresponding to the execution facility; Determining the rationality of executing the execution operation according to the device status information; If there is rationality in performing the execution operation, the authenticity of the task information is confirmed.

[0055] The execution operation in the task information generated by the task release system is directly related to the equipment status information corresponding to the execution facility. If an unreasonable execution operation occurs, it means that there is a problem with the authenticity of the task information.

[0056] It should be noted that the acquisition of equipment status information corresponding to the execution facilities is completed through the intranet of the substation. Through certain monitoring strategies, the equipment status information of each facility in the substation is obtained regularly to achieve real-time monitoring of the equipment status to ensure that countermeasures are taken immediately when an abnormality occurs.

[0057] As a preferred embodiment of the present invention, the method for judging the rationality of executing an operation according to the device status information specifically includes: Determine the device status of the execution facility according to the device status information, wherein the device status includes an abnormal state and a normal state; The execution operation includes a repair operation and a maintenance operation. When the equipment state is an abnormal state, if the execution operation is a repair operation, the rationality of the execution operation is judged. When the equipment state is a normal state, if the execution operation is a maintenance operation, the rationality of the execution operation is judged.

[0058] In actual scenarios, the execution operations of the executors can be divided into two categories. One is the maintenance operation, which is aimed at the equipment in abnormal state. When the equipment fails and is in abnormal state. Under normal circumstances, when the intranet detects that a facility is in abnormal state, the warning information is fed back to the task release system through the fixed communication interface between the intranet and the outside. The task release system generates corresponding task information according to the situation of the facility and arranges the corresponding executors to go to the substation for maintenance. In the task information generated at this time, the execution facility is the facility in abnormal state, the execution operation is the maintenance operation corresponding to the abnormal state, and the task release time is a time point after the task release system receives the warning information. The other type of operation is maintenance operation, which is aimed at the regular maintenance of various facilities in the substation. Under normal circumstances, the maintenance operation is carried out when the equipment is in normal state. At this time, in the task information generated by the task release system, the execution facility is the facility in normal state to be maintained, and the execution operation is the normal maintenance operation of the facility. The task release time is related to the maintenance frequency of the facility, and there is a fixed cycle and time interval.

[0059] Based on the above content, in addition to judging the authenticity of the task information based on the rationality of the type of the executed operation, the rationality of the executed operation can also be judged based on the task release time. As a preferred embodiment of the present invention, the specific judgment method includes: When the equipment state is an abnormal state and the execution operation is a maintenance operation, further obtaining the abnormal time point when the execution facility enters the abnormal state, and judging whether the abnormal time point is earlier than the task release time, and if so, judging the rationality of the existence of the execution operation; When the equipment status is normal and the execution operation is a maintenance operation, further obtain the most recent maintenance time point when the execution facility last performed a maintenance operation, and determine whether the interval between the most recent maintenance time point and the task release time conforms to the normal maintenance cycle of the execution facility. If so, determine the rationality of the existence of the execution operation.

[0060] When the equipment status is abnormal, the execution operation in the task information of the facility should be a maintenance operation, and the task release time should lag behind the abnormal time point when the execution facility enters the abnormal state, otherwise it is logically unreasonable. When the equipment status is normal, the execution operation in the task information of the facility should be a maintenance operation, and the task release time should be within the normal maintenance cycle of the facility, otherwise it is logically unreasonable. The authenticity of the task information can be effectively judged through the normal logical correspondence between the equipment status and the execution operation, as well as the normal logical relationship between the task release time.

[0061] In order to further improve the accuracy of judging the authenticity of task information, as a preferred implementation, when the equipment status is abnormal and the execution operation is a maintenance operation, it is judged whether the maintenance operation is an operation to release the corresponding abnormal status; if so, the rationality of the existence of the execution operation is judged. When judging, the execution operation of the task information can be compared with the content of the maintenance or maintenance manual of the execution facility. In the maintenance or maintenance manual, there is a clear description of the abnormal status of the execution facility. Different abnormal states correspond to specific types of faults, and how many execution personnel are required to perform what operations. After obtaining the actual equipment status information, the corresponding number of execution personnel and maintenance operations are obtained according to the content of the maintenance or maintenance manual, and compared with the execution personnel and execution operations in the task information. If there is a mismatch, it can also indicate that there is a problem with the authenticity of the task information.

[0062] Step S104: if the authenticity of the task information is confirmed, the task execution authority of the visitor is identified according to the authority information database.

[0063] After the authenticity of the task information is confirmed, the third step of the security authorization identification process is to confirm the visitor's task execution authority. The identity of the visitor is confirmed through the above step S102, and the authenticity of the task information is verified through step S103. On this basis, if it is confirmed that the visitor has the task execution authority to execute the task, it means that the visitor can obtain security authorization to enter the substation.

[0064] In actual work, the principle of least privilege is usually adopted, that is, only the minimum privileges required to complete the work are granted. At the same time, there are clear restrictions on the facilities that employees of different levels or types of work can operate. Specifically, the above step S104 specifically includes: Extracting a list of personnel with corresponding authority from the authority information database according to the execution facility and the execution operation; Determine whether the visitor whose identity is successfully confirmed is on the list of persons; If so, it is determined that the visitor's task execution authority matches the task information.

[0065] In the authority information library, there is a pre-saved personnel list for each facility's operating authority. The people on the personnel list have the operating authority for the facility, so the visitor is compared with the list of personnel who execute the facility. If the visitor is on the list, it means that the visitor's task execution authority matches the task information.

[0066] It should be noted that when the number of executors in the task information is two or more, in addition to verifying that the number and identity of the visitors are consistent with the executors in the task information, it is also necessary to determine whether the visitors have the task execution authority for the execution facility. That is, when the number of executors in the task information is two or more, determine whether all the visitors are in the personnel list; if they are, determine that the visitor's task execution authority matches the task information.

[0067] Step S105: If the task execution authority of the visitor matches the task information, the visitor is granted authority to enter the area where the execution facility is located.

[0068] In a substation, different execution facilities may be located in different areas. After the security authorization identification process for a certain task information is completed, visitors are only granted access to the area where the execution facilities are located to prevent them from entering other areas.

[0069] As a preferred method, after the visitor is authorized, the visitor's identity information (which may include facial information, name, license plate information, etc.) and authorization scope can be synchronized to the security personnel in the substation area, so that the security personnel can check the status of authorized visitors in each area at any time. At the same time, when encountering a visitor, the security personnel can again obtain information by scanning a QR code or other means and compare it with the synchronized authorization information, so as to facilitate the confirmation of the visitor's identity and authority.

[0070] The following two specific cases illustrate the security authorization identification method for power grid substation facilities provided by the embodiment of the present invention: The application scenario is the access control system of the State Grid substation park.

[0071] Case 1: One day, when the internal LAN of the park was testing the internal facilities, it was found that facility A had an m-type fault at 15:35. The warning information was sent to the external task release system through the internal LAN. The task release system generated task information, which specifically included the executors a and b, the execution facility A, the m-type fault of the execution operation, and the task release time of 15:40. The task information was sent to the mobile phones of executors a and b, and the identification password or QR code corresponding to the task information was generated through the independent app or built-in applet installed on the mobile phone. After executors a and b arrived at the gate of the substation park, the access control system scanned the work badges and facial information of the two people, obtained the electronic identity information and biometric information of the visitors, and then obtained the task information by scanning the QR code generated on a's mobile phone. First, the electronic identity information and biometric information of a and b's visitors were checked with the information in the pre-saved permission information library to confirm that the executors were a and b, and that a and b were both themselves. Then, the equipment status information of Facility A was obtained based on the task information, and it was found that Facility A did have an m-type fault at 15:35, verifying the authenticity of the task information. Then, the list of personnel who can perform m-type fault maintenance on Facility A was extracted from the permission information library, and a and b were confirmed to be on the list of personnel through comparison. Finally, a and b were granted permission to enter the area where Facility A is located.

[0072] Case 2: On a certain day, executive c needs to perform an inspection task. He fills in the relevant information of the inspection content through the mobile app or the built-in applet and reports it. The task information is generated by the task release system and then sent back to generate the corresponding identification password or QR code. After executive c arrives at the substation park, the access control system scans the QR code presented by him to obtain the visitor's electronic identity information, visitor's biometric information, and task information. According to the object of the inspection task, his identity authority is verified. At the same time, after judging that these facilities are indeed in a state where inspection is required, executive c is granted the authority to enter the area where the facilities that need to be inspected are located. After executive c is authorized, his identity information and access authority are synchronized with other security personnel in the park. When security personnel meet executive c in the park, they can ask him to show the QR code, or directly identify his biometric information to confirm whether the identity of executive c and the area where he is located are consistent with the authorization.

[0073] In practical applications, the method and device are not limited to inspection tasks, but can also be used for other tasks such as inspection, maintenance, and construction.

[0074] In summary, the present invention provides a security authorization identification method for power grid substation facilities. Taking into account the characteristics of the isolation of the substation intranet from the outside, security authorization is comprehensively identified from three perspectives: the identity of the visitor, the authenticity of the task, and the task execution authority. This enables the power grid substation facilities to not only achieve effective isolation at the physical and logical levels, but also provide an efficient and reliable identity authentication and access control mechanism.

[0075] like Figure 2 As shown, the present invention implements a security authorization identification device for a power grid substation facility, the device comprising: The information acquisition unit 110 is used to acquire the task information to be executed currently through the substation intranet, wherein the task information includes the execution personnel, execution facilities, execution operations, task release time, and the visitor identification information obtained through the scanning device; The identity recognition unit 120 is used to identify the visitor's identification information according to the authority information library pre-stored in the substation intranet to confirm the visitor's identity; The task identification unit 130 is used to obtain the equipment status information of the execution facility after the identity of the visitor is successfully confirmed, and to identify the authenticity of the task information according to the equipment status information; The authority identification unit 140 is used to identify the task execution authority of the visitor according to the authority information database if the authenticity of the task information is confirmed; The authority granting unit 150 is used to grant the visitor the authority to enter the area where the execution facility is located if the visitor's task execution authority matches the task information.

[0076] The security authorization identification device for power grid substation facilities provided in the embodiment of the present invention is used to implement the security authorization identification method for power grid substation facilities mentioned above, so the specific implementation method is the same as the above method and will not be repeated here.

[0077] like Figure 3 As shown, a structural block diagram of an electronic device 300 provided in an embodiment of the present invention. The electronic device 300 may be an electronic device 300 capable of running applications, such as a smart phone, a tablet computer, an e-book, etc. The electronic device 300 in the present application may include one or more of the following components: a processor 310, a memory 320, and one or more applications, wherein the one or more applications may be stored in the memory 320 and configured to be executed by one or more processors 310, and one or more programs are configured to execute the method described in the aforementioned method embodiment.

[0078] The processor 310 may include one or more processing cores. The processor 310 uses various interfaces and lines to connect various parts of the entire electronic device 300, and executes various functions and processes data of the electronic device 300 by running or executing instructions, programs, code sets or instruction sets stored in the memory 320, and calling data stored in the memory 320. Optionally, the processor 310 can be implemented in at least one hardware form of digital signal processing (DSP), field-programmable gate array (FPGA), and programmable logic array (PLA). The processor 310 can integrate one or a combination of a central processing unit (CPU), a graphics processing unit (GPU), and a modem. Among them, the CPU mainly processes the operating system, user interface, and application programs; the GPU is responsible for rendering and drawing display content; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 310, but may be implemented separately through a communication chip.

[0079] The memory 320 may include a random access memory (RAM) or a read-only memory (ROM). The memory 320 may be used to store instructions, programs, codes, code sets or instruction sets. The memory 320 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the following various method embodiments, etc. The data storage area may also store data created by the terminal during use (such as a phone book, audio and video data, chat record data), etc.

[0080] like Figure 4 FIG. 4 is a block diagram of a computer-readable storage medium 400 provided in an embodiment of the present invention. The computer-readable storage medium stores program code 410, which can be called by a processor to execute the method described in the above method embodiment.

[0081] The computer-readable storage medium 400 may be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk, or a ROM. Optionally, the computer-readable storage medium 400 includes a non-transitory computer-readable storage medium. The computer-readable storage medium 400 has storage space for program codes 410 for executing any method steps in the above method. These program codes 410 may be read from or written to one or more computer program products. The program codes 410 may be compressed, for example, in a suitable form.

[0082] In summary, the present invention provides a method and device for identifying security authorization of power grid substation facilities. Taking into account the characteristics of the isolation of the substation intranet from the outside, security authorization is comprehensively identified from three perspectives: the identity of the visitor, the authenticity of the task, and the task execution authority. This enables the power grid substation facilities to not only achieve effective isolation at the physical and logical levels, but also provide an efficient and reliable identity authentication and access control mechanism.

[0083] In several embodiments disclosed in the present application, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely schematic. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and a module, a program segment or a part of the code contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0084] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0085] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

Claims

1. A method for secure authorization identification of power grid substation facilities, characterized in that: The method comprises: The substation intranet obtains the task information to be executed, including the executor, execution facility, execution operation, task release time, and the visitor identification information obtained by scanning equipment; Identify the visitor's identification information according to the authority information database pre-stored in the substation intranet to confirm the visitor's identity; After the visitor's identity is successfully confirmed, the equipment status information of the execution facility is obtained, and the authenticity of the task information is identified based on the equipment status information; If the authenticity of the task information is confirmed, the task execution authority of the visitor is identified according to the authority information database; If the task execution authority of the visitor matches the task information, the visitor is granted authority to enter the area where the execution facility is located.

2. The method for security authorization identification of power grid substation facilities according to claim 1, characterized in that: The visitor identification information includes the visitor's electronic identity information and the visitor's biometric information. The step of obtaining the visitor identification information obtained by the scanning device specifically includes: Obtain the electronic identity information of visitors through signal scanning equipment; Collect the visitor's biometric information through image acquisition equipment or biometric acquisition equipment.

3. The method for security authorization identification of power grid substation facilities according to claim 2, characterized in that: The step of identifying the visitor's identification information according to the authority information database pre-stored in the substation intranet and confirming the visitor's identity specifically includes: Retrieving personnel information matching the electronic identity information of the visitor from the authority information database, wherein the personnel information includes basic personnel information and biometric identification information; Matching the biometric identification information with the collected biometric information of the visitor; If the match is successful, the visitor's identity is confirmed. If the match fails, the visitor's identity confirmation fails and subsequent recognition actions are stopped.

4. The method for security authorization identification of power grid substation facilities according to claim 1, characterized in that: The step of obtaining the device status information of the execution facility and identifying the authenticity of the task information according to the device status information specifically includes: Acquire device status information corresponding to the execution facility; Determining the rationality of executing the execution operation according to the device status information; If there is rationality in performing the execution operation, the authenticity of the task information is confirmed.

5. The method for security authorization identification of power grid substation facilities according to claim 4, characterized in that: The step of judging the rationality of executing the execution operation according to the device status information specifically includes: Determine the device status of the execution facility according to the device status information, wherein the device status includes an abnormal state and a normal state; The execution operation includes a repair operation and a maintenance operation. When the equipment state is an abnormal state, if the execution operation is a repair operation, the rationality of the execution operation is judged. When the equipment state is a normal state, if the execution operation is a maintenance operation, the rationality of the execution operation is judged.

6. The method for security authorization identification of power grid substation facilities according to claim 5, characterized in that: The step of judging the rationality of executing the execution operation according to the device status information specifically includes: When the equipment state is an abnormal state and the execution operation is a maintenance operation, further obtaining the abnormal time point when the execution facility enters the abnormal state, and judging whether the abnormal time point is earlier than the task release time, and if so, judging the rationality of the existence of the execution operation; When the equipment status is normal and the execution operation is a maintenance operation, further obtain the most recent maintenance time point when the execution facility last performed a maintenance operation, and determine whether the interval between the most recent maintenance time point and the task release time conforms to the normal maintenance cycle of the execution facility. If so, determine the rationality of the existence of the execution operation.

7. The method for security authorization identification of power grid substation facilities according to claim 5, characterized in that: The step of judging the rationality of executing the execution operation according to the device status information specifically includes: When the device state is an abnormal state and the executed operation is a maintenance operation, determining whether the maintenance operation is an operation to relieve the corresponding abnormal state; If yes, then determine whether the execution operation is reasonable.

8. The method for security authorization identification of power grid substation facilities according to any one of claims 1 to 3, characterized in that: The step of identifying the visitor's task execution authority according to the authority information database specifically includes: Extracting a list of personnel with corresponding authority from the authority information database according to the execution facility and the execution operation; Determine whether the visitor whose identity is successfully confirmed is on the list of persons; If so, it is determined that the visitor's task execution authority matches the task information.

9. The method for security authorization identification of power grid substation facilities according to claim 8, characterized in that: The step of identifying the visitor's task execution authority according to the authority information database specifically includes: When the number of executors in the task information is two or more, determine whether all the visiting personnel are in the personnel list; If both are present, it is determined that the visitor's task execution authority matches the task information.

10. A security authorization identification device for a power grid substation facility, characterized in that: include: An information acquisition unit is used to acquire the task information to be executed in the substation intranet, wherein the task information includes the executor, the execution facility, the execution operation, the task release time, and the visitor identification information obtained by the scanning device; The identity recognition unit is used to identify the visitor's identification information according to the authority information database pre-stored in the substation intranet and confirm the visitor's identity; The task identification unit is used to obtain the equipment status information of the execution facility after the identity of the visitor is successfully confirmed, and to identify the authenticity of the task information based on the equipment status information; The authority identification unit is used to identify the task execution authority of the visitor according to the authority information database if the authenticity of the task information is confirmed; The authority granting unit is used to grant the visitor the authority to enter the area where the execution facility is located if the visitor's task execution authority matches the task information.

Images