Information acquisition gateway and method applied to substation monitoring equipment

Abstract

The invention discloses an information acquisition gateway and method applied to substation monitoring equipment. The gateway comprises an equipment identification unit, an equipment access unit and a protocol management unit, the protocol management unit is used for pre-storing communication protocols of manufacturers corresponding to a plurality of monitoring devices; the equipment identification unit is used for identifying manufacturer information of to-be-accessed monitoring equipment; and the equipment access unit is used for calling out a communication protocol of a corresponding manufacturer from the protocol management unit based on the manufacturer information of the accessed monitoring equipment identified by the equipment identification unit, and accessing the monitoring equipment based on the communication protocol. According to the invention, the communication protocols of a plurality of mainstream terminal manufacturers are stored in the protocol management unit in advance, when the monitoring equipment is connected to the information acquisition gateway, the manufacturer information of the equipment is automatically monitored through the equipment identification unit, and then the communication protocols of the corresponding manufacturers are called out based on the manufacturer information. Therefore, automatic compatibility of monitoring equipment of multiple manufacturers is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of substation monitoring, and in particular to an information collection gateway and method applied to substation monitoring equipment. Background Art

[0002] With the development of power grid construction and the improvement of safety requirements, substation construction is moving towards unmanned or less-manned operation. In order to achieve unmanned or less-manned operation, a large number of monitoring equipment need to be installed in the substation, such as current monitoring equipment, voltage monitoring equipment, video monitoring equipment, temperature and humidity, and smoke sensors, etc., and the monitoring equipment needs to be maintained regularly, such as adding / deleting monitoring equipment, or replacing old monitoring equipment; because there are many monitoring devices involved, and the communication protocols of monitoring equipment from different manufacturers are usually different, therefore, when adding or replacing old monitoring equipment, it is also necessary to add or replace the corresponding information collection gateway at the same time, resulting in a lot of cost waste. Summary of the invention

[0003] In view of the technical defects and technical drawbacks existing in the prior art, the embodiments of the present invention provide an information collection gateway and method applied to substation monitoring equipment to overcome the above problems or at least partially solve the above problems. The specific scheme is as follows:

[0004] As a first aspect of the present invention, there is provided an information collection gateway applied to substation monitoring equipment, the gateway comprising a device identification unit, a device access unit and a protocol management unit;

[0005] The protocol management unit is used to pre-store the communication protocols of the manufacturers corresponding to a number of monitoring devices;

[0006] The device identification unit is used to identify the manufacturer information of the monitoring device to be connected;

[0007] The device access unit is used to call out the communication protocol of the corresponding manufacturer from the protocol management unit based on the manufacturer information of the accessed monitoring device identified by the device identification unit, and access the monitoring device based on the communication protocol.

[0008] Furthermore, the information collection gateway also includes a communication unit, and the information collection gateway communicates with the background monitoring platform through the communication unit. The device access unit is also used to: when a new monitoring device is accessed and the protocol management unit does not store the communication protocol of the manufacturer corresponding to the corresponding monitoring device, send a new protocol request to the background monitoring platform, and after receiving the communication protocol of the corresponding manufacturer returned by the background monitoring platform, access the corresponding monitoring device based on the communication protocol returned by the background monitoring platform, and store the communication protocol returned by the background monitoring platform in the protocol management unit.

[0009] Furthermore, the information collection gateway also includes a micro control unit and a security unit. The micro control unit is used to receive a user's device access request. The security unit verifies the access authority of the user device based on the user's device access request. The device access unit is specifically used to call out the communication protocol of the corresponding manufacturer from the protocol management unit when the user's access authority verification is passed, and access the monitoring device based on the communication protocol.

[0010] Furthermore, the device access request includes a user's account name and password, and the security unit pre-stores the account name and password of a legitimate user; the security unit compares the stored account name and password of the legitimate user with the account name and password in the device access request to confirm whether the user is a legitimate user. If so, the access authority verification is passed, otherwise the verification fails.

[0011] Further, the micro control unit is also used to: receive a gateway authentication command sent by an external device, wherein the external device includes a monitoring device and a background monitoring platform; based on the received gateway authentication command, send an acquisition command to the security unit; receive response data returned by the security unit for the acquisition command; generate a response command based on the response data, and return the response command to the external device, so that the external device uses the response data in the response command to authenticate the information collection gateway; wherein the gateway authentication command includes an external device random number generated by the external device, and the acquisition command includes the external device random number;

[0012] The security unit is used to receive the acquisition command sent by the micro control unit, generate an external device random number signature value based on the external device random number in the acquisition command, obtain a gateway certificate, and generate a gateway random number, and return the gateway certificate, the gateway random number and the external device random number signature value as response data to the micro control unit.

[0013] The micro control unit is further configured to receive an external device identity authentication command sent by the external device, and based on the received external device identity authentication command, send a verification command to the security unit; and receive a verification result returned by the security unit for the verification command;

[0014] The security unit is further configured to perform identity authentication on the external device after receiving a verification command sent by the micro control unit, and return a verification result to the micro control unit.

[0015] Further, the external device identity authentication command includes an external device certificate and a gateway random number signature value, the gateway random number signature value is generated based on the gateway random number in the response command, the verification command includes the external device certificate and the gateway random number signature value, and the security unit authenticates the external device, specifically:

[0016] Decrypting the gateway random number signature value with the external device public key in the external device certificate to obtain a verification value, and if the gateway random number is equal to the obtained verification value, determining that the verification result is that the external device passes the identity authentication; otherwise, determining that the verification result is that the external device fails the identity authentication;

[0017] If the verification result is that the external device passes the identity authentication,

[0018] The security unit is further used to generate a random number as a session key; encrypt and calculate the session key using the external device public key in the external device certificate; and return the encrypted session key to the micro control unit;

[0019] The micro control unit is further used to send an identity authentication response command to the external device, wherein the identity authentication response command includes an encrypted session key;

[0020] Wherein, the session key includes an encryption session key and a MAC session key;

[0021] The micro control unit is further configured to receive a first encryption command sent by the external device; based on the received first encryption command, send a decryption request for decrypting the first encryption command to the security unit; and receive a decryption result returned by the security unit for the decryption request; wherein the decryption request includes a first command header and a first encryption field in the first encryption command;

[0022] The security unit is further configured to, after receiving the decryption request, decrypt the first encrypted field in the decryption request using the encrypted session key in the session key to obtain first decrypted data and a first MAC; and perform MAC verification based on the first command header, the first decrypted data and the first MAC, and if the MAC verification result is that the MAC verification passes, use the first decrypted data and the MAC verification result as the decryption result; if the MAC verification result is that the MAC verification fails, use the MAC verification result as the decryption result; and return the decryption result to the micro control unit;

[0023] The security unit generates a random number signature value for an external device, specifically:

[0024] Sign the external device random number using the pre-stored information collection gateway private key to obtain the external device random number signature value;

[0025] The gateway certificate is a public key certificate in X.509 format, and the gateway certificate includes the information collection gateway public key.

[0026] Furthermore, the device identification unit is also used to identify the ID of the monitoring device to be accessed, and the device access request also includes the ID of the monitoring device to be accessed. The security unit verifies the user's access authority based on the user's device access request and also includes: matching the ID in the device access request with the ID of the access terminal identified by the device identification unit. If the user is a legitimate registered user and the ID matches successfully, the access authority verification passes, otherwise the verification fails.

[0027] Furthermore, the micro control unit is also used to obtain status information of the connected monitoring device and send the status information to the background monitoring platform.

[0028] Furthermore, the gateway also includes a data analysis module and a storage module, the storage module is used to store the monitoring data collected by the monitoring device, and the data analysis module is used to organize and analyze the monitoring data collected by the monitoring device, and transmit the analysis results to the monitoring platform.

[0029] As a second aspect of the present invention, there is provided an information collection method applied to a substation monitoring device, the method comprising:

[0030] Step 1, storing communication protocols of manufacturers corresponding to a number of monitoring devices in the protocol management unit in advance;

[0031] Step 2, identifying the manufacturer information of the connected monitoring device through the device identification unit;

[0032] Step 3: Based on the manufacturer information of the access terminal identified by the device identification unit, the device access unit calls out the communication protocol of the corresponding manufacturer from the protocol management unit, and accesses the access monitoring device based on the communication protocol.

[0033] Furthermore, when a new monitoring device is connected and the protocol management unit does not store the communication protocol of the manufacturer corresponding to the corresponding monitoring device, a new protocol request is sent to the background monitoring platform through the device access unit, and after receiving the communication protocol of the corresponding manufacturer returned by the background monitoring platform, the corresponding monitoring device is accessed based on the communication protocol returned by the background monitoring platform, and the communication protocol returned by the background monitoring platform is stored in the protocol management unit.

[0034] Furthermore, the method further includes receiving a device access request from a user through a micro control unit, and verifying the access authority of the user device through a security unit based on the device access request from the user, wherein the device access unit is specifically configured to call out a communication protocol of a corresponding manufacturer from the protocol management unit when the user's access authority verification passes, and access the monitoring device based on the communication protocol;

[0035] Among them, the device access request includes the user's account name and password, and the security unit pre-stores the account name and password of a legitimate user; the security unit compares the stored account name and password of the legitimate user with the account name and password in the device access request to confirm whether the user is a legitimate user. If so, the access authority verification is passed, otherwise the verification fails.

[0036] The present invention has the following beneficial effects:

[0037] The present invention provides an information collection gateway and method for substation monitoring equipment. The communication protocols of multiple mainstream terminal manufacturers are stored in a protocol management unit in advance. When the monitoring equipment is connected to the information collection gateway, the manufacturer information of the equipment is automatically monitored through the equipment identification unit, and then the communication protocol of the corresponding manufacturer is called out based on the manufacturer information, thereby achieving automatic compatibility with monitoring equipment of multiple manufacturers. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 A schematic diagram of the structure of an information collection gateway applied to substation monitoring equipment provided by an embodiment of the present invention;

[0039] Figure 2 A flowchart of an information collection method applied to substation monitoring equipment provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0040] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0041] like Figure 1 As shown, an information collection gateway for substation monitoring equipment provided by an embodiment of the present invention, the gateway includes a device identification unit, a device access unit and a protocol management unit;

[0042] The protocol management unit is used to pre-store the communication protocols of the manufacturers corresponding to a number of monitoring devices;

[0043] The device identification unit is used to identify the manufacturer information of the monitoring device to be connected;

[0044] The device access unit is used to call out the communication protocol of the corresponding manufacturer from the protocol management unit based on the manufacturer information of the accessed monitoring device identified by the device identification unit, and access the monitoring device based on the communication protocol.

[0045] The present invention provides an information collection gateway and method for substation monitoring equipment. The communication protocols of multiple mainstream terminal manufacturers are stored in a protocol management unit in advance. When the monitoring equipment is connected to the information collection gateway, the manufacturer information of the equipment is automatically monitored through the equipment identification unit, and then the communication protocol of the corresponding manufacturer is called out based on the manufacturer information, thereby achieving automatic compatibility with monitoring equipment of multiple manufacturers.

[0046] Generally speaking, the communication protocols of monitoring equipment from the same manufacturer are the same. If different types of monitoring equipment from the same manufacturer have corresponding communication protocols different, the communication protocols corresponding to different types of monitoring equipment from each manufacturer are stored in the protocol management unit in advance. When the monitoring device to be connected is connected to the information collection gateway, the manufacturer information and monitoring device type of the monitoring device to be connected are identified by the device identification unit. The device access unit calls out the communication protocol corresponding to the manufacturer and monitoring device type from the protocol management unit based on the manufacturer information and monitoring device type of the monitoring device to be connected identified by the device identification unit, and accesses the monitoring device based on the communication protocol.

[0047] In some embodiments, the information collection gateway also includes a communication unit, and the information collection gateway communicates with the background monitoring platform through the communication unit. The device access unit is also used to: when a new monitoring device is accessed and the protocol management unit does not store the communication protocol of the manufacturer corresponding to the corresponding monitoring device, send a new protocol request to the background monitoring platform, and after receiving the communication protocol of the corresponding manufacturer returned by the background monitoring platform, access the corresponding monitoring device based on the communication protocol returned by the background monitoring platform, and store the communication protocol returned by the background monitoring platform in the protocol management unit.

[0048] Through the above embodiment, when a new monitoring device is connected and the protocol management unit does not store the communication protocol of the manufacturer corresponding to the corresponding monitoring device, a new protocol request is sent to the background monitoring platform. After receiving the new protocol request, the background monitoring platform verifies whether the newly connected monitoring device is legal. If the monitoring device is legal, the corresponding communication protocol is retrieved from the background monitoring platform or a third party and transmitted to the device access unit, wherein the new protocol request includes one or more of the manufacturer information of the newly added monitoring device, the type of monitoring device and the ID of the monitoring device.

[0049] In some embodiments, the information collection gateway also includes a micro control unit and a security unit. The micro control unit is used to receive a user's device access request. The security unit verifies the access authority of the user device based on the user's device access request. The device access unit is specifically used to call up the communication protocol of the corresponding manufacturer from the protocol management unit when the user's access authority verification is passed, and access the monitoring device based on the communication protocol.

[0050] Among them, the device access request includes the user's account name and password, and the security unit pre-stores the account name and password of a legitimate user; the security unit compares the stored account name and password of the legitimate user with the account name and password in the device access request to confirm whether the user is a legitimate user. If so, the access authority verification is passed, otherwise the verification fails.

[0051] The present invention receives the user's device access request through a micro control unit, and verifies the access authority of the user's device based on the user's device access request through a security unit. Only when the user's authority is passed, the user is allowed to perform monitoring device access operations, thereby preventing unauthorized operators from performing access operations to increase the device access security of the information collection gateway. Specifically, the user can log in to the web page of the background monitoring platform and send a device access request to the information collection gateway through the background monitoring platform.

[0052] In some embodiments, the microcontroller unit is further used to: receive a gateway authentication command sent by an external device, wherein the external device includes a monitoring device and a background monitoring platform, etc.; based on the received gateway authentication command, send an acquisition command to the security unit; receive response data returned by the security unit for the acquisition command; generate a response command based on the response data, and return the response command to the external device, so that the external device uses the response data in the response command to authenticate the information collection gateway; wherein the gateway authentication command includes an external device random number generated by the external device, and the acquisition command includes the external device random number;

[0053] The security unit is used to receive the acquisition command sent by the micro control unit, generate an external device random number signature value based on the external device random number in the acquisition command, obtain a gateway certificate, and generate a gateway random number, and return the gateway certificate, the gateway random number and the external device random number signature value as response data to the micro control unit.

[0054] The security unit generates a random number signature value for an external device, specifically:

[0055] The external device random number is signed with a pre-stored information collection gateway private key to obtain the external device random number signature value.

[0056] The gateway certificate is a public key certificate in X.509 format, and the gateway certificate includes the information collection gateway public key.

[0057] In some embodiments, the micro control unit is further used to receive an external device identity authentication command sent by the external device, and based on the received external device identity authentication command, send a verification command to the security unit; and receive a verification result returned by the security unit for the verification command;

[0058] The security unit is further configured to perform identity authentication on the external device after receiving a verification command sent by the micro control unit, and return a verification result to the micro control unit.

[0059] Among them, the external device identity authentication command includes an external device certificate and a gateway random number signature value, the gateway random number signature value is generated based on the gateway random number in the response command, the verification command includes the external device certificate and the gateway random number signature value, and the security unit authenticates the external device, specifically:

[0060] The gateway random number signature value is decrypted using the external device public key in the external device certificate to obtain a verification value. If the gateway random number is equal to the obtained verification value, the verification result is determined to be that the external device has passed the identity authentication; otherwise, the verification result is determined to be that the external device has not passed the identity authentication.

[0061] If the verification result is that the external device passes the identity authentication,

[0062] In some embodiments, the security unit is further used to generate a random number as a session key; perform encryption calculation on the session key using the external device public key in the external device certificate; and return the encrypted session key to the micro control unit;

[0063] The micro control unit is further used to send an identity authentication response command to the external device, wherein the identity authentication response command includes an encrypted session key.

[0064] The session key includes an encryption session key and a MAC session key.

[0065] In some embodiments, the micro control unit is further used to receive a first encryption command sent by the external device; based on the received first encryption command, send a decryption request for decrypting the first encryption command to the security unit; receive a decryption result returned by the security unit for the decryption request; wherein the decryption request includes the first command header and the first encryption field in the first encryption command;

[0066] The security unit is also used to, after receiving a decryption request, decrypt the first encrypted field in the decryption request with the encrypted session key in the session key to obtain first decrypted data and a first MAC; and perform MAC verification based on the first command header, the first decrypted data and the first MAC, if the MAC verification result is that the MAC verification passes, then use the first decrypted data and the MAC verification result as the decryption result; if the MAC verification result is that the MAC verification fails, then use the MAC verification result as the decryption result; and return the decryption result to the micro control unit.

[0067] The security unit performs MAC verification based on the first command header, the first decrypted data and the first MAC, specifically:

[0068] The first command header and the first decrypted data are encrypted and calculated using the MAC session key in the session key to obtain a first ciphertext, and a first verification code is determined based on the obtained first ciphertext, and the first verification code and the first MAC are compared to see whether they are the same; if they are the same, the MAC verification result is determined to be passed; otherwise, the MAC verification result is determined to be failed.

[0069] In some embodiments, the micro control unit is also used to: if the received decryption result fails the MAC verification, clear the session key and set the status of the external device to an unauthenticated state; send an authentication request to the external device so that the external device returns a gateway authentication command to the micro control unit in response to the authentication request.

[0070] In some embodiments, the micro control unit is further used to: send an encryption request to the security unit, wherein the encryption request includes a second command header and data to be encrypted; obtain a second encryption field returned by the security unit in response to the encryption request, use the second encryption field and the second command header to form a second encryption command, and send the second encryption command to the external device, so that the external device decrypts the second encryption field with the encrypted session key in the session key to obtain second decrypted data and a second MAC; and perform MAC verification based on the second command header, the second decrypted data and the second MAC;

[0071] The security unit is further configured to, after receiving the encryption request, use the MAC session key in the session key to perform encryption calculation on the second command header and the data to be encrypted to obtain a second ciphertext; determine a second MAC based on the obtained second ciphertext; encrypt the data to be encrypted and the second MAC using the encryption session key to obtain a second encrypted field; and return the second encrypted field to the micro control unit;

[0072] Wherein, the external device communicates with the micro control unit via wired or wireless means.

[0073] In some embodiments, the micro control unit is further used to obtain status information of external devices and send the obtained status information to the cloud platform.

[0074] In some embodiments, the device identification unit is also used to identify the ID of the monitoring device to be accessed, and the device access request also includes the ID of the monitoring device to be accessed. The security unit verifies the user's access authority based on the user's device access request and also includes: matching the ID in the device access request with the ID of the access terminal identified by the device identification unit. If the user is a legitimate registered user and the ID matches successfully, the access authority verification passes, otherwise the verification fails.

[0075] In the above embodiment, by adding ID verification of the monitoring device to be accessed, the security of device access is further increased.

[0076] In some embodiments, the micro control unit is also used to obtain status information of connected monitoring devices and send the status information to the background monitoring platform.

[0077] By sending the status information to the background monitoring platform, the background monitoring platform can monitor the online status of the monitoring device in real time, and dispatch staff to perform maintenance in time when the monitoring device is offline.

[0078] In some embodiments, the gateway also includes a data analysis module and a storage module. The storage module is used to store the monitoring data collected by the monitoring device, and the data analysis module is used to organize and analyze the monitoring data collected by the monitoring device and transmit the analysis results to the monitoring platform.

[0079] Among them, the sorting and analysis may include preprocessing the monitoring signals of the monitoring equipment, such as classifying the monitoring signals, optimizing and filtering out unimportant signals, retaining only some important emergency data signals, and placing other data in a storage module for reference, and performing event analysis based on the preprocessed monitoring signals, and only transmitting the analysis results to the monitoring platform.

[0080] like Figure 2As shown, an embodiment of the present invention further provides an information collection method applied to a substation monitoring device, the method comprising:

[0081] Step 1, storing communication protocols of manufacturers corresponding to a number of monitoring devices in the protocol management unit in advance;

[0082] Step 2, identifying the manufacturer information of the connected monitoring device through the device identification unit;

[0083] Step 3: Based on the manufacturer information of the access terminal identified by the device identification unit, the device access unit calls out the communication protocol of the corresponding manufacturer from the protocol management unit, and accesses the access monitoring device based on the communication protocol.

[0084] In some embodiments, when a new monitoring device is connected and the protocol management unit does not store the communication protocol of the manufacturer corresponding to the corresponding monitoring device, a new protocol request is sent to the background monitoring platform through the device access unit, and after receiving the communication protocol of the corresponding manufacturer returned by the background monitoring platform, the corresponding monitoring device is accessed based on the communication protocol returned by the background monitoring platform, and the communication protocol returned by the background monitoring platform is stored in the protocol management unit.

[0085] In some embodiments, the method further includes receiving a device access request from a user through a micro control unit, and verifying the access authority of the user device through a security unit based on the device access request from the user, wherein the device access unit is specifically configured to call out a communication protocol of a corresponding manufacturer from the protocol management unit when the user's access authority verification passes, and access the monitoring device based on the communication protocol;

[0086] Among them, the device access request includes the user's account name and password, and the security unit pre-stores the account name and password of a legitimate user; the security unit compares the stored account name and password of the legitimate user with the account name and password in the device access request to confirm whether the user is a legitimate user. If so, the access authority verification is passed, otherwise the verification fails.

[0087] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An information collection gateway applied to substation monitoring equipment, characterized in that: The gateway includes a device identification unit, a device access unit and a protocol management unit; The protocol management unit is used to pre-store the communication protocols of the manufacturers corresponding to a number of monitoring devices; The device identification unit is used to identify the manufacturer information of the monitoring device to be connected; The device access unit is used to call out the communication protocol of the corresponding manufacturer from the protocol management unit based on the manufacturer information of the accessed monitoring device identified by the device identification unit, and access the monitoring device based on the communication protocol.

2. The information collection gateway applied to substation monitoring equipment according to claim 1 is characterized in that: The information collection gateway also includes a communication unit, and the information collection gateway communicates with the background monitoring platform through the communication unit. The device access unit is also used to: when a new monitoring device is accessed and the protocol management unit does not store the communication protocol of the manufacturer corresponding to the corresponding monitoring device, send a new protocol request to the background monitoring platform, and after receiving the communication protocol of the corresponding manufacturer returned by the background monitoring platform, access the corresponding monitoring device based on the communication protocol returned by the background monitoring platform, and store the communication protocol returned by the background monitoring platform in the protocol management unit.

3. The information collection gateway applied to substation monitoring equipment according to claim 1 is characterized in that: The information collection gateway also includes a micro control unit and a security unit. The micro control unit is used to receive a user's device access request. The security unit verifies the access authority of the user's device based on the user's device access request. The device access unit is specifically used to call out the communication protocol of the corresponding manufacturer from the protocol management unit when the user's access authority verification is passed, and access the monitoring device based on the communication protocol.

4. The information collection gateway applied to substation monitoring equipment according to claim 3 is characterized in that: The device access request includes the user's account name and password, and the security unit pre-stores the account name and password of a legitimate user; the security unit compares the stored account name and password of the legitimate user with the account name and password in the device access request to confirm whether the user is a legitimate user. If so, the access authority verification is passed, otherwise the verification fails.

5. The information collection gateway applied to substation monitoring equipment according to claim 4 is characterized in that: The device identification unit is also used to identify the ID of the monitoring device to be accessed, and the device access request also includes the ID of the monitoring device to be accessed. The security unit verifies the user's access authority based on the user's device access request and also includes: matching the ID in the device access request with the ID of the access terminal identified by the device identification unit. If the user is a legal registered user and the ID matches successfully, the access authority verification is successful, otherwise the verification fails.

6. The information collection gateway applied to substation monitoring equipment according to claim 3 is characterized in that: The microcontroller unit is also used to: receive a gateway authentication command sent by an external device, wherein the external device includes a monitoring device and a background monitoring platform; based on the received gateway authentication command, send an acquisition command to the security unit; receive response data returned by the security unit for the acquisition command; generate a response command based on the response data, and return the response command to the external device, so that the external device uses the response data in the response command to authenticate the information collection gateway; wherein the gateway authentication command includes an external device random number generated by the external device, and the acquisition command includes the external device random number; The security unit is used to receive the acquisition command sent by the micro control unit, generate an external device random number signature value based on the external device random number in the acquisition command, obtain a gateway certificate, and generate a gateway random number, and return the gateway certificate, the gateway random number and the external device random number signature value as response data to the micro control unit; The micro control unit is further configured to receive an external device identity authentication command sent by the external device, and based on the received external device identity authentication command, send a verification command to the security unit; and receive a verification result returned by the security unit for the verification command; The security unit is further configured to perform identity authentication on the external device after receiving a verification command sent by the micro control unit, and return a verification result to the micro control unit.

7. The information collection gateway applied to substation monitoring equipment according to claim 6 is characterized in that: The external device identity authentication command includes an external device certificate and a gateway random number signature value, the gateway random number signature value is generated based on the gateway random number in the response command, the verification command includes the external device certificate and the gateway random number signature value, and the security unit authenticates the external device, specifically: Decrypting the gateway random number signature value with the external device public key in the external device certificate to obtain a verification value, and if the gateway random number is equal to the obtained verification value, determining that the verification result is that the external device passes the identity authentication; otherwise, determining that the verification result is that the external device fails the identity authentication; If the verification result is that the external device passes the identity authentication, The security unit is further used to generate a random number as a session key; encrypt and calculate the session key using the external device public key in the external device certificate; and return the encrypted session key to the micro control unit; The micro control unit is further used to send an identity authentication response command to the external device, wherein the identity authentication response command includes an encrypted session key; Wherein, the session key includes an encryption session key and a MAC session key; The micro control unit is further configured to receive a first encryption command sent by the external device; based on the received first encryption command, send a decryption request for decrypting the first encryption command to the security unit; and receive a decryption result returned by the security unit for the decryption request; wherein the decryption request includes a first command header and a first encryption field in the first encryption command; The security unit is further configured to, after receiving the decryption request, decrypt the first encrypted field in the decryption request using the encrypted session key in the session key to obtain first decrypted data and a first MAC; and perform MAC verification based on the first command header, the first decrypted data and the first MAC, and if the MAC verification result is that the MAC verification passes, use the first decrypted data and the MAC verification result as the decryption result; if the MAC verification result is that the MAC verification fails, use the MAC verification result as the decryption result; and return the decryption result to the micro control unit; The security unit generates a random number signature value for an external device, specifically: Sign the external device random number using the pre-stored information collection gateway private key to obtain the external device random number signature value; The gateway certificate is a public key certificate in X.509 format, and the gateway certificate includes the information collection gateway public key.

8. An information collection method applied to substation monitoring equipment, characterized in that: The method comprises: Step 1, storing communication protocols of manufacturers corresponding to a number of monitoring devices in the protocol management unit in advance; Step 2, identifying the manufacturer information of the connected monitoring device through the device identification unit; Step 3: Based on the manufacturer information of the access terminal identified by the device identification unit, the device access unit calls out the communication protocol of the corresponding manufacturer from the protocol management unit, and accesses the access monitoring device based on the communication protocol.

9. The information collection method applied to substation monitoring equipment according to claim 8 is characterized in that: The method also includes: when a new monitoring device is connected and the protocol management unit does not store the communication protocol of the manufacturer corresponding to the corresponding monitoring device, a new protocol request is sent to the background monitoring platform through the device access unit, and after receiving the communication protocol of the corresponding manufacturer returned by the background monitoring platform, the corresponding monitoring device is accessed based on the communication protocol returned by the background monitoring platform, and the communication protocol returned by the background monitoring platform is stored in the protocol management unit.

10. The information collection method applied to substation monitoring equipment according to claim 8, characterized in that: The method further includes receiving a device access request from a user through a micro control unit, and verifying the access authority of the user device through a security unit based on the device access request from the user, wherein the device access unit is specifically configured to call out a communication protocol of a corresponding manufacturer from the protocol management unit when the user's access authority verification passes, and access the monitoring device based on the communication protocol; Among them, the device access request includes the user's account name and password, and the security unit pre-stores the account name and password of a legitimate user; the security unit compares the stored account name and password of the legitimate user with the account name and password in the device access request to confirm whether the user is a legitimate user. If so, the access authority verification is passed, otherwise the verification fails.

Images