Information collection gateway and method applied to substation monitoring device

Abstract

An information collection gateway and method applied to a substation monitoring device, the gateway comprising a device identification unit, a device access unit and a protocol management unit; the protocol management unit is used for pre-storing the communication protocols of several manufacturers corresponding to the monitoring device; the device identification unit is used for identifying the manufacturer information of the monitoring device to be accessed; the device access unit is used for calling out the communication protocol of the corresponding manufacturer from the protocol management unit based on the manufacturer information of the accessed monitoring device identified by the device identification unit, and accessing the monitoring device based on the communication protocol. The application stores the communication protocols of several mainstream terminal manufacturers in the protocol management unit in advance, automatically monitors the manufacturer information of the device through the device identification unit when the monitoring device is connected to the information collection gateway, and then calls out the communication protocol of the corresponding manufacturer based on the manufacturer information, so as to realize the automatic compatibility of the monitoring devices of several manufacturers.

Description

Technical Field

[0001] This invention relates to the field of substation monitoring technology, specifically to an information acquisition gateway and method for substation monitoring equipment. Background Technology

[0002] With the development of power grid construction and the increasing safety requirements, substation construction is moving towards unmanned or minimally manned operation. To achieve this, a large number of monitoring devices need to be installed in substations, such as current monitoring devices, voltage monitoring devices, video monitoring devices, temperature, humidity and smoke sensors, etc. Regular maintenance of these monitoring devices is also required, such as adding / removing monitoring devices or replacing old ones. Because there are many monitoring devices involved, and the communication protocols of monitoring devices from different manufacturers are usually different, adding or replacing old monitoring devices also requires adding or replacing the corresponding information acquisition gateway, resulting in significant cost waste. Summary of the Invention

[0003] In view of the technical defects and drawbacks existing in the prior art, embodiments of the present invention provide an information acquisition gateway and method for substation monitoring equipment that overcomes or at least partially solves the above problems. The specific solution is as follows:

[0004] As a first aspect of the present invention, an information acquisition gateway for substation monitoring equipment is provided, the gateway comprising a device identification unit, a device access unit, and a protocol management unit;

[0005] The protocol management unit is used to pre-store the communication protocols of several monitoring devices from different manufacturers.

[0006] The device identification unit is used to identify the manufacturer information of the monitoring device to be connected;

[0007] The device access unit is used to retrieve the corresponding manufacturer's communication protocol from the protocol management unit based on the manufacturer information of the monitoring device identified by the device identification unit, and access the monitoring device based on the communication protocol.

[0008] Furthermore, the information acquisition gateway also includes a communication unit, through which the information acquisition gateway communicates with the background monitoring platform. The device access unit is also used to: when a new monitoring device is accessed and the protocol management unit has not stored the communication protocol of the corresponding manufacturer of the monitoring device, send a new protocol request to the background monitoring platform, and after receiving the corresponding manufacturer's communication protocol returned by the background monitoring platform, access the corresponding monitoring device based on the communication protocol returned by the background monitoring platform, and store the communication protocol returned by the background monitoring platform in the protocol management unit.

[0009] Furthermore, the information acquisition gateway also includes a microcontroller unit and a security unit. The microcontroller unit is used to receive user device access requests. The security unit verifies the access permissions of the user device based on the user's device access request. Specifically, when the user's access permissions are verified, the device access unit retrieves the corresponding manufacturer's communication protocol from the protocol management unit and accesses the monitoring device based on the communication protocol.

[0010] Furthermore, the device access request includes the user's username and password, and the security unit pre-stores the username and password of legitimate users; the security unit compares the stored username and password of legitimate users with the username and password in the device access request to confirm whether the user is a legitimate user. If so, the access permission verification passes; otherwise, the verification fails.

[0011] Furthermore, the microcontroller unit is also configured to: receive a gateway authentication command sent by an external device, wherein the external device includes a monitoring device and a background monitoring platform; send an acquisition command to the security unit based on the received gateway authentication command; receive response data returned by the security unit in response to the acquisition command; generate a response command based on the response data, and return the response command to the external device, so that the external device uses the response data in the response command to authenticate the information collection gateway; wherein the gateway authentication command includes an external device random number generated by the external device, and the acquisition command contains the external device random number;

[0012] The security unit is configured to receive an acquisition command sent by the microcontroller unit, generate an external device random number signature value based on the external device random number in the acquisition command, obtain a gateway certificate, generate a gateway random number, and return the gateway certificate, the gateway random number, and the external device random number signature value as response data to the microcontroller unit.

[0013] The microcontroller unit is further configured to receive an external device authentication command sent by the external device, send a verification command to the security unit based on the received external device authentication command, and receive the verification result returned by the security unit in response to the verification command.

[0014] The security unit is further configured to authenticate the external device after receiving the authentication command sent by the microcontroller unit, and return the authentication result to the microcontroller unit.

[0015] Furthermore, the external device authentication command includes an external device certificate and a gateway random number signature value, the gateway random number signature value being generated based on the gateway random number in the response command. The verification command includes the external device certificate and the gateway random number signature value. The security unit authenticates the external device, specifically by:

[0016] The gateway random number signature value is decrypted using the external device public key in the external device certificate to obtain the verification value. If the gateway random number is equal to the obtained verification value, the verification result is determined to be that the external device has passed authentication; otherwise, the verification result is determined to be that the external device has failed authentication.

[0017] Wherein, if the verification result is that the external device has passed authentication,

[0018] The security unit is also used to generate a random number as a session key; to encrypt the session key using the external device public key in the external device certificate; and to return the encrypted session key to the microcontroller unit.

[0019] The microcontroller unit is also used to send an authentication response command to the external device, the authentication response command including an encrypted session key;

[0020] The session key includes an encrypted session key and a MAC session key;

[0021] The microcontroller unit is further configured to receive a first encryption command sent by the external device; based on the received first encryption command, send a decryption request to the security unit for decrypting the first encryption command; and receive a decryption result returned by the security unit in response to the decryption request; wherein the decryption request includes a first command header and a first encryption field from the first encryption command.

[0022] The security unit is further configured to, upon receiving a decryption request, decrypt the first encrypted field in the decryption request using the encrypted session key in the session key to obtain first decrypted data and a first MAC; and perform MAC verification based on the first command header, the first decrypted data, and the first MAC. If the MAC verification result is a successful MAC verification, the first decrypted data and the MAC verification result are used as the decryption result; if the MAC verification result is a failed MAC verification, the MAC verification result is used as the decryption result; and return the decryption result to the microcontroller unit.

[0023] Specifically, the security unit generates a random number signature value for the external device as follows:

[0024] The external device random number is signed using the pre-stored information acquisition gateway private key to obtain the external device random number signature value;

[0025] The gateway certificate is a public key certificate in X.509 format, and the gateway certificate contains the public key of the information collection gateway.

[0026] Furthermore, the device identification unit is also used to identify the ID of the monitoring device to be accessed. The device access request also includes the ID of the monitoring device to be accessed. The security unit verifies the user's access permission based on the user's device access request by matching the ID in the device access request with the ID of the access terminal identified by the device identification unit. If the user is a legitimate registered user and the ID matches successfully, the access permission verification passes; otherwise, the verification fails.

[0027] Furthermore, the microcontroller unit is also used to acquire the status information of the connected monitoring devices and send the status information to the background monitoring platform.

[0028] Furthermore, the gateway also includes a data analysis module and a storage module. The storage module is used to store the monitoring data collected by the monitoring equipment, and the data analysis module is used to organize and analyze the monitoring data collected by the monitoring equipment and transmit the analysis results to the monitoring platform.

[0029] As a second aspect of the present invention, an information acquisition method for substation monitoring equipment is provided, the method comprising:

[0030] Step 1: Pre-store the communication protocols of several monitoring devices from different manufacturers in the protocol management unit;

[0031] Step 2: Identify the manufacturer information of the connected monitoring equipment through the device identification unit;

[0032] Step 3: Based on the manufacturer information of the access terminal identified by the device identification unit, the device access unit retrieves the corresponding manufacturer's communication protocol from the protocol management unit and accesses the access monitoring device based on the communication protocol.

[0033] Furthermore, when a new monitoring device is connected and the protocol management unit does not store the communication protocol of the corresponding manufacturer of the monitoring device, a new protocol request is sent to the background monitoring platform through the device access unit. After receiving the communication protocol of the corresponding manufacturer returned by the background monitoring platform, the corresponding monitoring device is connected based on the communication protocol returned by the background monitoring platform, and the communication protocol returned by the background monitoring platform is stored in the protocol management unit.

[0034] Furthermore, the method also includes receiving a user's device access request through a microcontroller unit and verifying the user's device access permission based on the user's device access request through a security unit. Specifically, when the user's access permission verification is successful, the device access unit is used to retrieve the corresponding manufacturer's communication protocol from the protocol management unit and access the monitoring device based on the communication protocol.

[0035] The device access request includes the user's username and password. The security unit pre-stores the usernames and passwords of legitimate users. The security unit compares the stored usernames and passwords of legitimate users with the usernames and passwords in the device access request to confirm whether the user is a legitimate user. If so, the access permission verification passes; otherwise, the verification fails.

[0036] The present invention has the following beneficial effects:

[0037] This invention provides an information acquisition gateway and method for substation monitoring equipment. By pre-storing the communication protocols of multiple mainstream terminal manufacturers in the protocol management unit, when the monitoring equipment connects to the information acquisition gateway, the device identification unit automatically monitors the manufacturer information of the equipment, and then retrieves the corresponding manufacturer's communication protocol based on the manufacturer information, thereby achieving automatic compatibility with monitoring equipment from multiple manufacturers. Attached Figure Description

[0038] Figure 1 This is a schematic diagram of the structure of an information acquisition gateway applied to substation monitoring equipment, provided by an embodiment of the present invention;

[0039] Figure 2 This is a flowchart illustrating an information acquisition method for substation monitoring equipment, as provided in an embodiment of the present invention. Detailed Implementation

[0040] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0041] like Figure 1 As shown in the figure, an information acquisition gateway for substation monitoring equipment is provided in an embodiment of the present invention. The gateway includes a device identification unit, a device access unit, and a protocol management unit.

[0042] The protocol management unit is used to pre-store the communication protocols of several monitoring devices from different manufacturers.

[0043] The device identification unit is used to identify the manufacturer information of the monitoring device to be connected;

[0044] The device access unit is used to retrieve the corresponding manufacturer's communication protocol from the protocol management unit based on the manufacturer information of the monitoring device identified by the device identification unit, and access the monitoring device based on the communication protocol.

[0045] This invention provides an information acquisition gateway and method for substation monitoring equipment. By pre-storing the communication protocols of multiple mainstream terminal manufacturers in the protocol management unit, when the monitoring equipment connects to the information acquisition gateway, the device identification unit automatically monitors the manufacturer information of the equipment, and then retrieves the corresponding manufacturer's communication protocol based on the manufacturer information, thereby achieving automatic compatibility with monitoring equipment from multiple manufacturers.

[0046] Generally, monitoring devices from the same manufacturer use the same communication protocol. If different types of monitoring devices from the same manufacturer use different communication protocols, the communication protocols for each type of monitoring device from each manufacturer are stored in advance in the protocol management unit. When the monitoring device to be accessed connects to the information acquisition gateway, the device identification unit identifies the manufacturer information and monitoring device type of the monitoring device to be accessed. Based on the manufacturer information and monitoring device type of the monitoring device to be accessed identified by the device identification unit, the device access unit retrieves the corresponding communication protocol for the manufacturer and monitoring device type from the protocol management unit and accesses the monitoring device based on the communication protocol.

[0047] In some embodiments, the information acquisition gateway further includes a communication unit, through which the information acquisition gateway communicates with the background monitoring platform. The device access unit is further configured to: when a new monitoring device is accessed and the protocol management unit has not stored the communication protocol of the corresponding manufacturer of the monitoring device, send a new protocol request to the background monitoring platform, and after receiving the communication protocol of the corresponding manufacturer returned by the background monitoring platform, access the corresponding monitoring device based on the communication protocol returned by the background monitoring platform, and store the communication protocol returned by the background monitoring platform in the protocol management unit.

[0048] In the above embodiments, when a new monitoring device is connected and the protocol management unit does not store the communication protocol of the corresponding manufacturer of the monitoring device, a new protocol request is sent to the background monitoring platform. After receiving the new protocol request, the background monitoring platform verifies whether the newly connected monitoring device is legitimate. If the monitoring device is legitimate, the corresponding communication protocol is retrieved from within the background monitoring platform or from a third party and transmitted to the device access unit. The new protocol request includes one or more of the following: manufacturer information of the newly added monitoring device, monitoring device type, and monitoring device ID.

[0049] In some embodiments, the information acquisition gateway further includes a microcontroller unit and a security unit. The microcontroller unit is used to receive a user's device access request. The security unit verifies the user's device access permission based on the user's device access request. Specifically, when the user's access permission verification is successful, the device access unit retrieves the corresponding manufacturer's communication protocol from the protocol management unit and accesses the monitoring device based on the communication protocol.

[0050] The device access request includes the user's username and password. The security unit pre-stores the usernames and passwords of legitimate users. The security unit compares the stored usernames and passwords of legitimate users with the usernames and passwords in the device access request to confirm whether the user is a legitimate user. If so, the access permission verification passes; otherwise, the verification fails.

[0051] This invention receives user device access requests through a microcontroller unit and verifies user device access permissions based on the user's device access request through a security unit. Only when the user's permissions are approved is the user allowed to perform monitoring device access operations, thereby preventing unauthorized operators from performing access operations and increasing the device access security of the information collection gateway. Specifically, users can log in to the web interface of the background monitoring platform and send device access requests to the information collection gateway through the background monitoring platform.

[0052] In some embodiments, the microcontroller unit is further configured to: receive a gateway authentication command sent by an external device, wherein the external device includes a monitoring device and a background monitoring platform, etc.; send an acquisition command to the security unit based on the received gateway authentication command; receive response data returned by the security unit in response to the acquisition command; generate a response command based on the response data, and return the response command to the external device, so that the external device uses the response data in the response command to authenticate the information collection gateway; wherein the gateway authentication command includes an external device random number generated by the external device, and the acquisition command includes the external device random number;

[0053] The security unit is configured to receive an acquisition command sent by the microcontroller unit, generate an external device random number signature value based on the external device random number in the acquisition command, obtain a gateway certificate, generate a gateway random number, and return the gateway certificate, the gateway random number, and the external device random number signature value as response data to the microcontroller unit.

[0054] Specifically, the security unit generates a random number signature value for the external device as follows:

[0055] The random number of the external device is signed using the private key of the information collection gateway that is stored in advance, and the random number signature value of the external device is obtained.

[0056] The gateway certificate is a public key certificate in X.509 format, and the gateway certificate contains the public key of the information collection gateway.

[0057] In some embodiments, the microcontroller unit is further configured to receive an external device authentication command sent by the external device, send a verification command to the security unit based on the received external device authentication command, and receive a verification result returned by the security unit in response to the verification command;

[0058] The security unit is further configured to authenticate the external device after receiving the authentication command sent by the microcontroller unit, and return the authentication result to the microcontroller unit.

[0059] The external device authentication command includes an external device certificate and a gateway random number signature value, wherein the gateway random number signature value is generated based on the gateway random number in the response command. The verification command includes the external device certificate and the gateway random number signature value. The security unit authenticates the external device, specifically as follows:

[0060] The gateway random number signature value is decrypted using the external device public key in the external device certificate to obtain the verification value. If the gateway random number is equal to the obtained verification value, the verification result is determined to be that the external device has passed authentication; otherwise, the verification result is determined to be that the external device has failed authentication.

[0061] If the verification result indicates that the external device has passed authentication.

[0062] In some embodiments, the security unit is further configured to generate a random number as a session key; encrypt the session key using the external device public key in the external device certificate; and return the encrypted session key to the microcontroller unit.

[0063] The microcontroller unit is also used to send an authentication response command to the external device, the authentication response command including an encrypted session key.

[0064] The session key includes an encrypted session key and a MAC session key.

[0065] In some embodiments, the microcontroller unit is further configured to receive a first encryption command sent by the external device; based on the received first encryption command, send a decryption request to the security unit for decrypting the first encryption command; and receive a decryption result returned by the security unit in response to the decryption request; wherein the decryption request includes a first command header and a first encryption field in the first encryption command;

[0066] The security unit is further configured to, upon receiving a decryption request, decrypt the first encrypted field in the decryption request using the encrypted session key in the session key to obtain first decrypted data and a first MAC; and perform MAC verification based on the first command header, the first decrypted data, and the first MAC. If the MAC verification result is a successful MAC verification, the first decrypted data and the MAC verification result are used as the decryption result; if the MAC verification result is a failed MAC verification, the MAC verification result is used as the decryption result; and return the decryption result to the microcontroller unit.

[0067] The security unit performs MAC verification based on the first command header, the first decryption data, and the first MAC, specifically as follows:

[0068] The first command header and the first decrypted data are encrypted using the MAC session key in the session key to obtain the first ciphertext. The first verification code is determined based on the obtained first ciphertext. The first verification code and the first MAC are compared to see if they are the same. If they are the same, the MAC verification result is determined to be successful. Otherwise, the MAC verification result is determined to be unsuccessful.

[0069] In some embodiments, the microcontroller unit is further configured to: if the received decryption result is that the MAC verification fails, clear the session key and set the status of the external device to an unauthenticated state; send an authentication request to the external device so that the external device returns a gateway authentication command to the microcontroller unit in response to the authentication request.

[0070] In some embodiments, the microcontroller unit is further configured to: send an encryption request to the security unit, the encryption request including a second command header and data to be encrypted; obtain a second encryption field returned by the security unit in response to the encryption request, construct a second encryption command using the second encryption field and the second command header, and send the second encryption command to the external device so that the external device decrypts the second encryption field using the encryption session key in the session key to obtain second decrypted data and a second MAC; and perform MAC verification based on the second command header, the second decrypted data, and the second MAC.

[0071] The security unit is further configured to, upon receiving an encryption request, perform encryption calculations on the second command header and the data to be encrypted using the MAC session key in the session key to obtain a second ciphertext; determine a second MAC based on the obtained second ciphertext; encrypt the data to be encrypted and the second MAC using the encryption session key to obtain a second encrypted field; and return the second encrypted field to the microcontroller unit.

[0072] The external device communicates with the microcontroller via wired or wireless means.

[0073] In some embodiments, the microcontroller unit is further configured to: obtain status information of an external device and send the obtained status information to a cloud platform.

[0074] In some embodiments, the device identification unit is further configured to identify the ID of the monitoring device to be accessed, and the device access request also includes the ID of the monitoring device to be accessed. The security unit's verification of the user's access permission based on the user's device access request further includes: matching the ID in the device access request with the ID of the access terminal identified by the device identification unit. If the user is a legitimate registered user and the ID matches successfully, the access permission verification passes; otherwise, the verification fails.

[0075] In the above embodiments, the security of device access is further enhanced by adding ID verification for the monitoring device to be accessed.

[0076] In some embodiments, the microcontroller unit is further configured to acquire status information of the connected monitoring devices and send the status information to the background monitoring platform.

[0077] By sending status information to the backend monitoring platform, the platform can monitor the online status of the monitoring equipment in real time and promptly dispatch personnel for maintenance when the equipment goes offline.

[0078] In some embodiments, the gateway further includes a data analysis module and a storage module. The storage module is used to store the monitoring data collected by the monitoring device, and the data analysis module is used to organize and analyze the monitoring data collected by the monitoring device and transmit the analysis results to the monitoring platform.

[0079] The sorting and analysis may include preprocessing the monitoring signals of the monitoring equipment, such as classifying the monitoring signals by level, optimizing and filtering out unimportant signals, retaining only some important and urgent data signals, and storing other data in the storage module for retrieval. Event analysis may also be performed based on the preprocessed monitoring signals, and only the analysis results are transmitted to the monitoring platform.

[0080] like Figure 2As shown in the figure, this embodiment of the invention also provides an information acquisition method for substation monitoring equipment, the method comprising:

[0081] Step 1: Pre-store the communication protocols of several monitoring devices from different manufacturers in the protocol management unit;

[0082] Step 2: Identify the manufacturer information of the connected monitoring equipment through the device identification unit;

[0083] Step 3: Based on the manufacturer information of the access terminal identified by the device identification unit, the device access unit retrieves the corresponding manufacturer's communication protocol from the protocol management unit and accesses the access monitoring device based on the communication protocol.

[0084] In some embodiments, when a new monitoring device is connected and the protocol management unit does not store the communication protocol of the corresponding manufacturer of the monitoring device, a new protocol request is sent to the background monitoring platform through the device access unit. After receiving the communication protocol of the corresponding manufacturer returned by the background monitoring platform, the corresponding monitoring device is connected based on the communication protocol returned by the background monitoring platform, and the communication protocol returned by the background monitoring platform is stored in the protocol management unit.

[0085] In some embodiments, the method further includes receiving a user's device access request through a microcontroller unit and verifying the user's device access permission based on the user's device access request through a security unit. Specifically, when the user's access permission verification is successful, the device access unit is used to retrieve the corresponding manufacturer's communication protocol from the protocol management unit and access the monitoring device based on the communication protocol.

[0086] The device access request includes the user's username and password. The security unit pre-stores the usernames and passwords of legitimate users. The security unit compares the stored usernames and passwords of legitimate users with the usernames and passwords in the device access request to confirm whether the user is a legitimate user. If so, the access permission verification passes; otherwise, the verification fails.

[0087] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. An information collection gateway applied to a substation monitoring device, characterized in that, The gateway includes a device identification unit, a device access unit, a protocol management unit, a microcontroller unit, and a security unit; The protocol management unit is used to pre-store the communication protocols of several monitoring devices from different manufacturers. The device identification unit is used to identify the manufacturer information of the monitoring device to be connected; The device access unit is used to retrieve the corresponding manufacturer's communication protocol from the protocol management unit based on the manufacturer information of the monitoring device identified by the device identification unit, and access the monitoring device based on the communication protocol. The microcontroller unit is used to receive a user's device access request, and the security unit verifies the user's device access rights based on the user's device access request. The device access unit is specifically used to retrieve the corresponding manufacturer's communication protocol from the protocol management unit when the user's access permission verification is successful, and to access the monitoring device based on the communication protocol; The microcontroller unit is further configured to: receive a gateway authentication command sent by an external device, wherein the external device includes a monitoring device and a background monitoring platform; send an acquisition command to the security unit based on the received gateway authentication command; receive response data returned by the security unit in response to the acquisition command; generate a response command based on the response data, and return the response command to the external device, so that the external device uses the response data in the response command to authenticate the information collection gateway; wherein the gateway authentication command includes an external device random number generated by the external device, and the acquisition command contains the external device random number; The security unit is configured to receive an acquisition command sent by the microcontroller unit, generate an external device random number signature value based on the external device random number in the acquisition command, obtain a gateway certificate, generate a gateway random number, and return the gateway certificate, the gateway random number, and the external device random number signature value as response data to the microcontroller unit. The microcontroller unit is further configured to receive an external device authentication command sent by the external device, send a verification command to the security unit based on the received external device authentication command, and receive the verification result returned by the security unit in response to the verification command. The security unit is further configured to authenticate the external device after receiving the authentication command sent by the microcontroller unit, and return the authentication result to the microcontroller unit.

2. The information collection gateway for a substation supervisory device according to claim 1, characterized by, The information acquisition gateway further includes a communication unit, through which the information acquisition gateway communicates with the background monitoring platform. The device access unit is also used to: send a new protocol request to the background monitoring platform when a new monitoring device is accessed and the protocol management unit has not stored the communication protocol of the corresponding manufacturer of the monitoring device; and after receiving the communication protocol of the corresponding manufacturer returned by the background monitoring platform, access the corresponding monitoring device based on the communication protocol returned by the background monitoring platform, and store the communication protocol returned by the background monitoring platform in the protocol management unit.

3. The information collection gateway for a substation supervisory device according to claim 1, characterized by, The device access request includes the user's username and password. The security unit pre-stores the usernames and passwords of legitimate users. The security unit compares the stored usernames and passwords of legitimate users with the usernames and passwords in the device access request to confirm whether the user is a legitimate user. If so, the access permission verification passes; otherwise, the verification fails.

4. The information acquisition gateway for substation monitoring equipment according to claim 3, characterized in that, The device identification unit is also used to identify the ID of the monitoring device to be accessed. The device access request also includes the ID of the monitoring device to be accessed. The security unit verifies the user's access permission based on the user's device access request by matching the ID in the device access request with the ID of the access terminal identified by the device identification unit. If the user is a legitimate registered user and the ID matches successfully, the access permission verification passes; otherwise, the verification fails.

5. The information collection gateway for a substation supervisory device according to claim 4, characterized by, The external device authentication command includes an external device certificate and a gateway random number signature value. The gateway random number signature value is generated based on the gateway random number in the response command. The verification command includes the external device certificate and the gateway random number signature value. The security unit authenticates the external device, specifically as follows: The gateway random number signature value is decrypted using the external device public key in the external device certificate to obtain the verification value. If the gateway random number is equal to the obtained verification value, the verification result is determined to be that the external device has passed authentication; otherwise, the verification result is determined to be that the external device has failed authentication. Wherein, if the verification result is that the external device has passed authentication, The security unit is also used to generate a random number as a session key; to encrypt the session key using the external device public key in the external device certificate; and to return the encrypted session key to the microcontroller unit. The microcontroller unit is also used to send an authentication response command to the external device, the authentication response command including an encrypted session key; The session key includes an encrypted session key and a MAC session key; The microcontroller unit is further configured to receive a first encryption command sent by the external device; based on the received first encryption command, send a decryption request to the security unit for decrypting the first encryption command; and receive a decryption result returned by the security unit in response to the decryption request; wherein the decryption request includes a first command header and a first encryption field from the first encryption command. The security unit is further configured to, upon receiving a decryption request, decrypt the first encrypted field in the decryption request using the encrypted session key in the session key to obtain first decrypted data and a first MAC; and perform MAC verification based on the first command header, the first decrypted data, and the first MAC. If the MAC verification result is a successful MAC verification, the first decrypted data and the MAC verification result are used as the decryption result; if the MAC verification result is a failed MAC verification, the MAC verification result is used as the decryption result; and return the decryption result to the microcontroller unit. Specifically, the security unit generates a random number signature value for the external device as follows: The external device random number is signed using the pre-stored information acquisition gateway private key to obtain the external device random number signature value; The gateway certificate is a public key certificate in X.509 format, and the gateway certificate contains the public key of the information collection gateway.

6. An information collecting method applied to the information collecting gateway according to claim 1, characterized by, The method includes: Step 1: Pre-store the communication protocols of several monitoring devices from different manufacturers in the protocol management unit; Step 2: Identify the manufacturer information of the connected monitoring equipment through the device identification unit; Step 3: Based on the manufacturer information of the access terminal identified by the device identification unit, the device access unit retrieves the corresponding manufacturer's communication protocol from the protocol management unit and accesses the access monitoring device based on the communication protocol.

7. The information collection method for a substation monitoring device according to claim 6, characterized by, The method further includes: when a new monitoring device is connected and the protocol management unit does not store the communication protocol of the corresponding manufacturer of the monitoring device, a new protocol request is sent to the background monitoring platform through the device access unit, and after receiving the communication protocol of the corresponding manufacturer returned by the background monitoring platform, the corresponding monitoring device is connected based on the communication protocol returned by the background monitoring platform, and the communication protocol returned by the background monitoring platform is stored in the protocol management unit.

8. The information collection method for a substation monitoring device according to claim 6, characterized by, The method further includes receiving a user's device access request through a microcontroller unit and verifying the user's device access permission based on the user's device access request through a security unit. Specifically, when the user's access permission verification is successful, the device access unit is used to retrieve the corresponding manufacturer's communication protocol from the protocol management unit and access the monitoring device based on the communication protocol. The device access request includes the user's username and password. The security unit pre-stores the usernames and passwords of legitimate users. The security unit compares the stored usernames and passwords of legitimate users with the usernames and passwords in the device access request to confirm whether the user is a legitimate user. If so, the access permission verification passes; otherwise, the verification fails.

Images