Remote debugging method for on-line monitoring system of power transformation equipment

Abstract

The invention discloses a remote debugging method for an on-line monitoring system of power transformation equipment, and relates to the technical field of on-line monitoring of the power transformation equipment, an independent 4G wireless communication module is physically connected with an on-line monitoring device, and the 4G wireless communication module is responsible for accessing a mobile operator network and distributing a local area network IP for the device; after the on-line monitoring device is started, an encryption connection request is automatically initiated to a cloud VPN server deployed by a public cloud based on preset configuration; the far-end PC accesses the same VPN service by using the same server address and authentication information, so that the far-end PC and the device are located in the same virtual local area network; and debugging personnel realize safe remote operation through interface-free command line tools such as SSH, SCP and the like. According to the invention, a security architecture of physical isolation and logic connection is realized, the risk of data leakage caused by graphical remote control is avoided, the security protection requirement of the power monitoring system is met, and the operation and maintenance efficiency is remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of online monitoring technology for power equipment, and more specifically to a remote commissioning method for an online monitoring system for power equipment. Background Technology

[0002] With the deepening of smart grid construction, online monitoring devices are widely deployed in various primary and secondary equipment in substations to collect key status parameters such as transformer oil chromatography, partial discharge, and surge arrester leakage current in real time, supporting equipment condition-based maintenance and fault early warning. However, these devices inevitably encounter problems such as software anomalies, configuration errors, or communication failures during long-term operation, requiring timely intervention and repair by maintenance personnel.

[0003] Currently, the commissioning of online monitoring devices for substations in China mainly relies on the following two points: (1) Direct debugging based on on-site industrial control computer or portable computer: This is the most traditional debugging method. Technicians go to the substation site and connect directly to the online monitoring device via serial port (such as RS-232 / 485), USB or Ethernet cable to perform program burning, parameter configuration, log reading and fault diagnosis. This debugging method is highly dependent on manpower travel, which requires a certain level of technical skills from the traveling personnel and will result in high travel and time costs. For substations located in remote or harsh environments, the safety risks are high and the fault response cycle is long. This method will be severely affected by foreign countries and sudden social events.

[0004] (2) Remote desktop-based debugging: This debugging method establishes remote access between the remote location and the on-site location through software such as Windows Remote Desktop (RDP), VNC, or TeamViewer. However, this method requires copying files to the on-site computer, and the entire operation process is displayed, which poses a risk of data leakage.

[0005] Foreign power equipment companies such as Siemens, GE, Amazon, and Microsoft offer complete IoT solutions. The core of these solutions is that monitoring devices connect to a cloud platform via SDKs, allowing maintenance personnel to manage and remotely operate the devices remotely via web applications. However, for critical infrastructure like power, placing equipment operation data and debugging channels entirely on foreign public clouds poses uncontrollable risks of data leakage and security compliance, and does not comply with my country's cybersecurity regulations.

[0006] Therefore, how to provide a safe, stable, and reliable remote commissioning method for an online monitoring system of power equipment is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0007] In view of the above problems, this invention is proposed to provide a remote commissioning method for an online monitoring system of power equipment that overcomes or at least partially solves the above problems. By establishing a safe, stable and reliable remote commissioning channel, it meets the network security requirements of the power system, solves the pain points and difficulties of the existing commissioning methods of online monitoring devices for power equipment, reduces project performance costs, improves on-site commissioning efficiency, achieves good economic benefits, and has broad market prospects.

[0008] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, embodiments of the present invention provide a remote commissioning method for an online monitoring system for power equipment, comprising the following steps: S1. Connect an independent 4G wireless communication module to the online monitoring device located in the substation via an Ethernet interface; S2. After the 4G wireless communication module is powered on, it automatically initiates a data connection request, accesses the mobile operator's network, obtains an IP address for Internet communication, and establishes a network channel; S3. When the online monitoring device is started, it automatically loads the preset VPN client configuration file and initiates the first VPN connection request to the cloud VPN server deployed in the public cloud through the network channel established by the 4G wireless communication module. S4. The cloud VPN server performs security authentication on the first VPN connection request. After successful authentication, it assigns a first virtual IP address to the online monitoring device and establishes a first VPN connection. S5. Start the VPN client on the remote PC, configure the same fixed public IP address and corresponding authentication information as the cloud VPN server, and initiate a second VPN connection request to the cloud VPN server; S6. The cloud VPN server authenticates the second VPN connection request. After successful authentication, it assigns a second virtual IP address to the remote PC and establishes a second VPN connection. S7. The cloud VPN server places the first virtual IP address and the second virtual IP address in the same virtual local area network; S8. On the remote PC, a user-friendly remote debugging operation is performed on the online monitoring device using the first virtual IP address via a command-line tool or file transfer tool.

[0009] Preferably, S2 includes: After the 4G wireless communication module is powered on, it automatically runs the built-in PPP dialing program and initiates a data connection request to the mobile operator's network through the inserted SIM card. After successfully establishing the PPP link, the 4G wireless communication module obtains an IP address for Internet communication and starts the integrated dnsmasq service. The dnsmasq service configures a private IP address on its Ethernet interface as a local area network gateway and enables DHCP service within that private IP address range. The network card of the online monitoring device operates in DHCP client mode and broadcasts a DHCP Discover message after power-on. The dnsmasq service responds to the DHCP Discover message by assigning a local area network IP address, a default gateway, and a DNS server address to the online monitoring device, wherein the default gateway is the private IP address of the 4G wireless communication module; Based on the assigned default gateway, the online monitoring device and the 4G wireless communication module complete MAC address learning through the ARP protocol, thereby establishing a point-to-point local area network communication link.

[0010] Preferably, the configuration file includes the fixed public IP address and port of the cloud VPN server, the client digital certificate and private key, the tunnel protocol and encryption parameters.

[0011] Preferably, in S4, the security authentication includes verifying whether the client digital certificate was issued by a trusted CA, whether it is within its validity period and has not been revoked, and whether it is on the authorized list.

[0012] Preferably, in S5, the authentication information is a username and a password.

[0013] Preferably, in S8, the command-line tool is SSH and the file transfer tool is SCP.

[0014] Preferably, the online monitoring device runs a Linux-based embedded system, and its VPN client is embedded in the root file system of the Linux embedded operating system as a pre-compiled software package and is automatically loaded as a system service when the device starts.

[0015] As can be seen from the above technical solution, compared with the prior art, the present invention discloses a remote commissioning method for an online monitoring system of power equipment, which has the following advantages: (1) Secure access with physical isolation: The online monitoring device itself does not integrate any public network communication modules, maintaining its closed and secure nature. Instead, a separate 4G wireless communication module is introduced, which physically connects to the online monitoring device via a standard RJ45 network port. The 4G module is responsible for establishing a wireless connection to the Internet and assigning a local area network IP address to the online monitoring device, forming a small private network. In this way, the device itself is not directly exposed to the public network, achieving physical-level security isolation.

[0016] (2) Logical connectivity based on cloud VPN: The system utilizes a cloud-based VPN server deployed on a public cloud as a central hub. The online monitoring device (via a 4G module) and the remote debugging PC act as clients, actively initiating connection requests to the server. After rigorous certificate or key authentication, the cloud server assigns virtual IP addresses to both parties and places them within the same Virtual Local Area Network (VLAN). This logically establishes a communication link between the remote PC and the online monitoring device within the enclosed substation.

[0017] (3) Deep debugging without a user interface: Instead of using remote desktop software (such as TeamViewer) that poses a risk of data leakage on a remote PC, debugging personnel directly use standard command-line tools (such as SSH) or file transfer tools (such as SCP) to access the online monitoring device via a virtual IP address. The entire debugging process is based on secure text or file protocols, eliminating the need to share a graphical user interface and thus completely avoiding the data leakage risks associated with visual operations. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0019] Figure 1 This is a flowchart of a remote commissioning method for an online monitoring system for power equipment provided in an embodiment of the present invention.

[0020] Figure 2 This is a schematic diagram of the remote commissioning system for the online monitoring system of power equipment provided in an embodiment of the present invention. Detailed Implementation

[0021] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] This invention discloses a remote commissioning method for an online monitoring system for power equipment, such as... Figure 1 As shown, it includes the following steps: S1. Connect an independent 4G wireless communication module to the online monitoring device located in the substation via an Ethernet interface; After the S2.4G wireless communication module is powered on, it automatically initiates a data connection request, accesses the mobile operator's network, obtains an IP address for Internet communication, and establishes a network channel. S3. When the online monitoring device is started, it automatically loads the pre-set VPN client configuration file and initiates the first VPN connection request to the cloud VPN server deployed in the public cloud through the network channel established by the 4G wireless communication module. S4. The cloud VPN server performs security authentication on the first VPN connection request. After successful authentication, it assigns a first virtual IP address to the online monitoring device and establishes the first VPN connection. S5. Start the VPN client on the remote PC, configure the same fixed public IP address and corresponding authentication information as the cloud VPN server, and initiate a second VPN connection request to the cloud VPN server; S6. The cloud VPN server authenticates the second VPN connection request. After successful authentication, it assigns a second virtual IP address to the remote PC and establishes a second VPN connection. S7. The cloud VPN server places the first virtual IP address and the second virtual IP address in the same virtual LAN; S8. On a remote PC, use a command-line tool or file transfer tool to perform a user-friendly remote debugging operation on the online monitoring device using the first virtual IP address.

[0023] By using a separate external communication module, a secure "data diplomacy channel" is established for the closed online monitoring device in a manner of "physical isolation and logical connectivity," such as... Figure 2 As shown, the online monitoring device is located within the substation. Its main body does not integrate any functional modules for direct connection to public networks, maintaining its inherent enclosure and security. The device provides a debugging data interface through a standard RJ45 network port.

[0024] (2) 4G wireless communication module: This module is an independent hardware device that is physically connected to the online monitoring device via an RJ45 network port. Its function is to establish a wireless connection with the Internet and forward data. This module is physically connected to the online monitoring device, but it forms the first layer of security isolation in network logic, ensuring that the device itself is not directly exposed to the public network.

[0025] (3) Cloud VPN server: Deployed in the public cloud and has a fixed public IP address. As the central node for all connections, it undertakes the core responsibilities of identity authentication, tunnel encryption, virtual networking and data routing.

[0026] (4) Remote PC: Used by debugging personnel, with a dedicated VPN client and standard debugging tools (such as SSH, SCP) installed.

[0027] This invention organically integrates the design of three aspects—external communication module, cloud virtual networking, and interfaceless debugging—to form a closed-loop remote debugging system.

[0028] The implementation process of this invention will be explained in detail below.

[0029] The online monitoring device connects to an external, independent 4G wireless communication module via a standard RJ45 network port; After powering on, the 4G wireless communication module automatically runs its built-in PPP dialing program, initiating a data connection request to the mobile operator's network through the inserted SIM card. Upon successful establishment of the PPP link, the 4G wireless communication module obtains an IP address for internet communication and starts the integrated dnsmasq service, which combines DHCP and DNS forwarding functions. The dnsmasq service configures a private IP address on its Ethernet interface as a local area network gateway and enables DHCP service within that private IP address range. The network card of the online monitoring device operates in DHCP client mode, broadcasting a DHCP Discover message upon power-on. The dnsmasq service responds to the DHCP Discover message, assigning a local area network IP address, default gateway, and DNS server address to the online monitoring device. The default gateway is the private IP address of the 4G wireless communication module. Based on the assigned default gateway, the online monitoring device and the 4G wireless communication module complete MAC address learning via the ARP protocol, thereby establishing a point-to-point local area network communication link. This invention enables DHCP service in the 4G wireless communication module and configures the online monitoring device as a DHCP client, allowing the latter to automatically obtain a complete network configuration, including the local area network IP address, default gateway, and DNS server, upon power-on. The default gateway points to the 4G module itself, ensuring that all outgoing traffic from the online monitoring device is forwarded to the mobile operator's network via the 4G module. This provides the necessary network routing foundation for the subsequent establishment of a secure tunnel to the cloud VPN server.

[0030] Tunnel Initiation: The online monitoring device runs a Linux-based embedded system. The VPN client is embedded in the device's file system as a pre-compiled software package and exists as a system service. When the device starts up, the VPN service automatically loads the pre-configured configuration file, which contains the fixed public IP address and port of the cloud VPN server, the client's digital certificate and private key required for authentication, the tunnel protocol and encryption parameters, and actively initiates a handshake with the cloud VPN server through the network channel established by the 4G module to establish a control channel.

[0031] Security Authentication and Access: The cloud-based VPN server runs on a public cloud, listening on all ports. Upon receiving a connection request, the cloud-based VPN server first verifies whether the client certificate was issued by a trusted CA, then verifies whether the client certificate is valid and not revoked, and finally verifies whether the client certificate is on the authorized list. After successful verification, the cloud-based VPN server allocates a first virtual IP address (e.g., 10.8.0.2) to the online monitoring device from its configured virtual IP address pool and distributes the routing information for the virtual LAN, thereby establishing the first VPN connection. This connection is initiated by the internal network device.

[0032] On the VPN client on the remote PC, configure the same fixed public IP address and corresponding authentication information as the cloud VPN server, and initiate a second VPN connection request to the cloud VPN server. The authentication information is the username and password.

[0033] The debugging personnel manually initiate the connection and access the cloud VPN server via the Internet. The cloud VPN server authenticates the second VPN connection request. After successful authentication, it assigns a second virtual IP address (such as 10.8.0.3) to the remote PC and establishes a second VPN connection. Interface-free remote debugging execution: The cloud VPN server places both ends (10.8.0.2 and 10.8.0.3) in the same virtual local area network (VLAN). Debuggers can use command-line tools (such as SSH) or file transfer tools (such as SCP) on their PCs to directly access the virtual IP address of the online monitoring device.

[0034] The entire process does not require graphical desktop sharing. All operations are based on secure command-line or file protocols, achieving "interfaceless" deep debugging, which improves efficiency and eliminates the risk of data leakage caused by interface operations.

[0035] This invention achieves physical isolation through an independent 4G communication module, ensuring that the online monitoring device remains within a closed, secure zone, complying with the mandatory requirement of power safety protection that "monitoring devices must not be directly connected to external systems." The "interfaceless" debugging eliminates the risk of data leakage associated with remote desktop technology; deployment is convenient, requiring only the addition and connection of an external communication module, making it easy to promote; it significantly saves on travel, accommodation, and time costs, and allows one expert to support multiple remote sites simultaneously, greatly liberating productivity, reducing production costs, and enhancing market competitiveness.

[0036] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0037] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A remote commissioning method for an online monitoring system for power equipment, characterized in that, Includes the following steps: S1. Connect an independent 4G wireless communication module to the online monitoring device located in the substation via an Ethernet interface; S2. After the 4G wireless communication module is powered on, it automatically initiates a data connection request, accesses the mobile operator's network, obtains an IP address for Internet communication, and establishes a network channel; S3. When the online monitoring device is started, it automatically loads the preset VPN client configuration file and initiates the first VPN connection request to the cloud VPN server deployed in the public cloud through the network channel established by the 4G wireless communication module. S4. The cloud VPN server performs security authentication on the first VPN connection request. After successful authentication, it assigns a first virtual IP address to the online monitoring device and establishes a first VPN connection. S5. Start the VPN client on the remote PC, configure the same fixed public IP address and corresponding authentication information as the cloud VPN server, and initiate a second VPN connection request to the cloud VPN server; S6. The cloud VPN server authenticates the second VPN connection request. After successful authentication, it assigns a second virtual IP address to the remote PC and establishes a second VPN connection. S7. The cloud VPN server places the first virtual IP address and the second virtual IP address in the same virtual local area network; S8. On the remote PC, a user-friendly remote debugging operation is performed on the online monitoring device using the first virtual IP address via a command-line tool or file transfer tool.

2. The method as described in claim 1, characterized in that, S2 includes: After the 4G wireless communication module is powered on, it automatically runs the built-in PPP dialing program and initiates a data connection request to the mobile operator's network through the inserted SIM card. After successfully establishing the PPP link, the 4G wireless communication module obtains an IP address for Internet communication and starts the integrated dnsmasq service. The dnsmasq service configures a private IP address on its Ethernet interface as a local area network gateway and enables DHCP service within that private IP address range. The network card of the online monitoring device operates in DHCP client mode and broadcasts a DHCP Discover message after power-on. The dnsmasq service responds to the DHCP Discover message by assigning a local area network IP address, a default gateway, and a DNS server address to the online monitoring device, wherein the default gateway is the private IP address of the 4G wireless communication module; Based on the assigned default gateway, the online monitoring device and the 4G wireless communication module complete MAC address learning through the ARP protocol, thereby establishing a point-to-point local area network communication link.

3. The method as described in claim 1, characterized in that, The configuration file includes the fixed public IP address and port of the cloud VPN server, the client digital certificate and private key, the tunnel protocol, and encryption parameters.

4. The method as described in claim 1, characterized in that, In S4, the security authentication includes verifying whether the client digital certificate was issued by a trusted CA, whether it is within its validity period and has not been revoked, and whether it is on the authorized list.

5. The method as described in claim 1, characterized in that, In S5, the authentication information is the username and password.

6. The method as described in claim 1, characterized in that, In S8, the command-line tool is SSH, and the file transfer tool is SCP.

7. The method as described in claim 1, characterized in that, The online monitoring device runs on a Linux-based embedded system. Its VPN client is embedded in the root file system of the Linux embedded operating system as a pre-compiled software package and is automatically loaded as a system service when the device starts.

Images