Transformer substation secondary screen cabinet intelligent lock control system and method based on dynamic authority management

Abstract

The invention relates to a transformer substation secondary screen cabinet intelligent lock control system and method based on dynamic authority management, the system comprises an intelligent lock control management platform and at least one field terminal equipment group, and the field terminal equipment group is composed of an intelligent lock installed on a secondary screen cabinet and a mobile authorization terminal held by a user. And the intelligent lock control management platform communicates with an external electronic work ticket system through the work ticket interface module, obtains work ticket data, responds to an unlocking request of the mobile authorization terminal through the dynamic authority management module, and dynamically generates an unlocking authorization certificate. And the intelligent lock performs local verification on the received authorization certificate, executes unlocking operation after the verification is passed, and transmits operation state information back to the management platform in real time. According to the invention, refined dynamic authorization is realized, the traceability of the whole process is ensured, the system security is improved, the real-time visual state management is realized, and the closed loop of the management process is promoted.

Description

Technical Field

[0001] This invention relates to the field of power system safety operation and maintenance technology, specifically to an intelligent interlocking control system and method for substation secondary cabinets based on dynamic access control. Background Technology

[0002] As a core component of the power grid, substations bear the crucial responsibility of power transmission and distribution. Within substations, secondary equipment protection panels play a vital role. Through a series of sophisticated control, protection, and monitoring functions, they ensure the main equipment operates normally in a safe and reliable environment, thus providing a solid guarantee for the safe and stable operation of the entire power grid. These secondary equipment protection panels not only monitor the operating status of the main equipment in real time but also quickly take protective measures in the event of abnormalities to prevent the fault from escalating and ensure the continuous power supply capacity of the power grid. They are an important line of defense for maintaining the safe and stable operation of the power grid.

[0003] Currently, the vast majority of substation protection panel doors still use traditional mechanical padlocks or universal key mechanical locks, which have the following significant drawbacks: chaotic access control, traditional locks cannot achieve accurate authorization; lack of electronic records, making it impossible to accurately trace operational details; disconnect from workflow, lock management is separate from the work ticket system, allowing staff to arbitrarily expand their work scope, and management relies on manual supervision; status cannot be perceived in real time, resulting in management blind spots; these are the shortcomings of existing technology.

[0004] In view of this, the present invention provides an intelligent lock control solution that enables flexible authorization, accurate recording, status feedback and deep integration with safety workflows, so as to fundamentally improve the technical level of substation safety management and solve the above-mentioned defects in the existing technology, which is very necessary. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of the existing technology by providing a design and method for an intelligent lock control system and method for substation secondary cabinets based on dynamic access control, thereby solving the aforementioned technical problems.

[0006] To achieve the above objectives, the present invention provides the following technical solution: In a first aspect, the present invention provides a substation secondary cabinet intelligent lock control system based on dynamic access control, the system comprising: an intelligent lock control management platform and at least one field terminal equipment group; The intelligent lock control management platform includes a work order interface module and a dynamic permission management module; The on-site terminal equipment group includes smart locks installed on the secondary screen cabinet and mobile authorization terminals held by users; The work order interface module is used to communicate with an external electronic work order system to obtain work order data containing information on the work time range, work equipment range, and personnel. Through communication with the external electronic work order system, it ensures that the unlocking operation strictly corresponds to the work task and avoids unauthorized operations. The dynamic permission management module is used to respond to unlocking requests from mobile authorization terminals and dynamically generate unlocking authorization credentials based on work order data; it realizes dynamic authorization, ensuring that each unlocking operation has a clear authorization basis, thereby improving security. The mobile authorization terminal is used to send an unlocking request to the smart lock control management platform and to receive and forward unlocking authorization credentials to the target smart lock. The unlocking request includes a user identifier, a target lock identifier, and an associated work ticket identifier. The mobile terminal enables convenient authorization applications and improves operation and maintenance efficiency. The smart lock is used to locally verify the received unlocking authorization credential and perform the unlocking operation after successful verification. At the same time, the operation status information is transmitted back to the smart lock control management platform through the communication network. Local verification ensures the security of the unlocking operation, and status transmission enables full monitoring of the operation.

[0007] Furthermore, in the dynamic access control module, the dynamic generation of unlocking authorization credentials specifically involves: Based on the work ticket data obtained from the work ticket interface module, the legality of the unlocking request is verified; through legality verification, illegal unlocking requests are prevented. After successful verification, a dynamic access token is generated as an unlocking authorization credential. The dynamic access token includes at least a user identifier, a target lock identifier, a valid time window, and a digital signature based on an asymmetric encryption algorithm. The dynamic access token ensures the uniqueness and security of each authorization. Furthermore, in the dynamic permission management module, the process of generating a dynamic permission token includes: The user identifier, target lock identifier, start and end times of the effective time window, associated work order identifier, and a random number are concatenated according to a predetermined rule to form plaintext data; the random number and effective time window are used to prevent replay attacks. The hash value of the plaintext data is calculated using a hash algorithm for data integrity verification. The hash value is signed using the private key of the smart lock management platform, and signature data is generated to ensure the authenticity of the authorization certificate. The plaintext data and the signature data are combined and encoded to output a dynamic permission token; Furthermore, the process by which the smart lock performs local verification of the unlocking authorization credential includes: Receive and decode dynamic permission tokens, separating plaintext data and signature data; Extract the target lock identifier and effective time window from plaintext data; Verify whether the parsed target lock identifier matches the identifier of this lock; Verify whether the current time is within the valid time window; The signature data is verified using the pre-stored public key of the smart lock management platform, and the hash value of the plaintext data is recalculated to verify the validity of the signature. The unlocking operation is performed if and only if all checks pass.

[0008] Furthermore, in the dynamic permission management module, the hash algorithm is the national standard SM3 algorithm, and the asymmetric encryption algorithm is the national standard SM2 algorithm.

[0009] Furthermore, the smart lock also includes a status sensing module, which includes a door magnetic sensor and a bolt position sensor; The door magnetic sensor is used to detect the open and closed status of the cabinet door; The latch position sensor is used to detect whether the latch is in the fully locked position; The smart lock is configured to report changes in the door status and bolt status to the smart lock control management platform in real time.

[0010] Furthermore, the smart lock also includes a locking logic control module, which is connected to the door magnetic sensor and the bolt position sensor, and is configured to: A locking signal is generated only when the door magnetic sensor outputs a first signal indicating that the door is closed; Furthermore, upon receiving feedback indicating that the locking action is complete, if the bolt position sensor outputs a second signal indicating that the bolt is in position, then a "locked" status message is sent to the intelligent lock control management platform.

[0011] Secondly, the present invention also provides a method for intelligent locking and control of secondary switchgear in substations based on dynamic access control, specifically including the following steps: Step S1, the step of sending an unlock request, in which: The mobile authorized terminal sends an unlocking request to the intelligent lock control management platform. The request includes a user identifier, a target lock identifier, and an associated work order identifier. Step S2, the step of verifying the validity of the request, in which: The intelligent lock control management platform verifies the legitimacy of the request and, upon successful verification, dynamically generates a time-sensitive unlocking authorization credential and sends it to the mobile authorization terminal. Step S3, the step of transmitting the unlocking authorization certificate, in which: The mobile authorization terminal transmits the unlocking authorization credential to the target smart lock; Step S4, verifying the unlocking authorization credential and unlocking the lock, in which: The target smart lock decodes and parses the received credentials; it then sequentially performs the steps of lock identity matching verification, time validity verification, and digital signature verification; after all verifications are successful, the main controller inside the lock drives the lock body to perform the unlocking action. Step S5, the information feedback step, in which: The target smart lock will transmit the unlocking event and subsequent door and lock status information back to the smart lock control management platform.

[0012] Furthermore, step S1 specifically includes: The mobile authorization terminal is used to send the unlocking request to the smart lock control management platform, and to receive and forward the unlocking authorization certificate to the target smart lock; The intelligent lock control management platform specifically includes a work order interface module and a dynamic permission management module; Furthermore, the work order interface module is used to communicate with an external electronic work order system to obtain work order data containing information on the work time range, work equipment range, and work personnel. Furthermore, the dynamic permission management module is used to respond to unlocking requests from the mobile authorization terminal and dynamically generate unlocking authorization credentials based on the work order data; Furthermore, step S2 specifically includes: Verify the legality of the unlocking request based on the work order data; Furthermore, after successful verification, the intelligent lock control management platform generates a dynamic permission token as an unlocking authorization credential; the dynamic permission token includes at least a user identifier, a target lock identifier, a valid time window, and a digital signature based on an asymmetric encryption algorithm. Furthermore, the dynamic permission token is created in the following way: The user identifier, the target lock identifier, the start and end times of the effective time window, the associated work order identifier, and a random number are concatenated according to a predetermined rule to form plaintext data. The hash value of the plaintext data is calculated using a hash algorithm; The hash value is signed using the private key of the smart lock management platform to generate signature data; The plaintext data and the signature data are combined and encoded to output the dynamic permission token.

[0013] Furthermore, the hash algorithm is the Chinese national standard SM3 algorithm, and the asymmetric encryption algorithm is the Chinese national standard SM2 algorithm.

[0014] Furthermore, step S3 specifically includes: The smart lock is used to locally verify the unlocking authorization certificate generated in step S2, and to perform the unlocking operation after the verification is successful. At the same time, the operation status information is transmitted back to the smart lock control management platform through the communication network.

[0015] Furthermore, the smart lock also includes a status sensing module, which includes a door magnetic sensor and a bolt position sensor; Furthermore, the door magnetic sensor is used to detect the open and closed state of the cabinet door; Furthermore, the bolt position sensor is used to detect whether the bolt is in the fully locked position; Furthermore, the smart lock is configured to report changes in the door status and bolt status to the smart lock control management platform in real time.

[0016] Furthermore, the smart lock also includes a locking logic control module, which is connected to the door magnetic sensor and the bolt position sensor, and is configured as follows: A locking signal is generated only when the door magnetic sensor outputs a first signal indicating that the door is closed; Furthermore, upon receiving feedback indicating that the locking action is complete, if the bolt position sensor outputs a second signal indicating that the bolt is in position, then a "locked" status message is sent to the intelligent lock control management platform.

[0017] Furthermore, step S4 specifically includes: The target smart lock decodes and parses the received unlocking authorization credential, separating plaintext data and signature data; it parses the target lock identifier and valid time window from the plaintext data; and then sequentially executes the steps of lock identity matching verification, time validity verification, and digital signature verification. The lock identity matching and verification step involves verifying whether the parsed target lock identifier matches the identifier of this lock. The time validity verification step involves verifying whether the current time is within the valid time window. The digital signature verification step involves using the pre-stored public key of the smart lock management platform to verify the signature data and recalculating the hash value of the plaintext data to verify the validity of the signature. The main controller inside the lock will drive the lock body to perform the unlocking action only if all verifications pass.

[0018] The beneficial effects of this invention are as follows: Through the above design, compared with the prior art, this invention achieves refined dynamic authorization, dynamically binding permissions to specific work tasks, strict time windows, and specific physical cabinets, realizing "one authorization per task, one key per cabinet, and expiration upon expiration," technically constraining the scope of operations and preventing operations beyond the scope; ensuring full traceability, the system automatically and completely records the entire process of permission application, authorization, unlocking to locking electronic logs, making all operational behaviors transparent, achieving precise accountability, and meeting security audit requirements; and improving system security. The system employs national cryptographic algorithms for encryption and digital signatures, combined with random number replay attack prevention, ensuring the security of authorization credentials during generation, transmission, and verification, effectively preventing forgery and duplication. It also enables real-time visual status management; through sensors built into the locks, the backend can monitor the opening and closing status of all cabinet doors across the entire station in real time, improving operational efficiency and security response speed. Furthermore, it promotes a closed-loop management process; through deep integration with the electronic work order system, it seamlessly connects online approval processes with offline physical operations, achieving informatization, automation, and mandatory compliance in operational security management.

[0019] Furthermore, the design principle of this invention is reliable, the structure is simple, and it has a very wide range of application prospects.

[0020] Therefore, it is evident that the present invention has outstanding substantive features and significant progress compared with the prior art, and the beneficial effects of its implementation are also obvious. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0022] Figure 1 This is a schematic diagram of the overall architecture of an intelligent lock control system for substation secondary cabinets based on dynamic permission management, provided by the present invention.

[0023] Figure 2 This is a flowchart of an intelligent lock control method for substation secondary cabinets based on dynamic permission management, provided by the present invention. Detailed Implementation

[0024] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. The following embodiments are explanations of the present invention, but the present invention is not limited to the following implementation methods.

[0025] Example 1: This invention discloses an intelligent lock control system for substation secondary cabinets based on dynamic access control, such as... Figure 1 As shown, the system includes: an intelligent lock control management platform and at least one group of field terminal devices.

[0026] The intelligent lock control management platform is deployed in the substation monitoring center and includes a work order interface module and a dynamic permission management module.

[0027] The work order interface module is used to communicate with an external electronic work order system to obtain work order data containing information on the work time range, work equipment range, and work personnel.

[0028] The dynamic access control module is used to respond to unlocking requests from mobile authorization terminals and dynamically generate unlocking authorization credentials based on work order data. The on-site terminal equipment group includes smart locks installed on the secondary cabinet and mobile authorization terminals held by users, which are connected to the smart lock control management platform through a wireless communication network.

[0029] Among them, the mobile authorization terminal is used to send unlocking requests to the smart lock control management platform and to receive and forward unlocking authorization credentials to the target smart lock.

[0030] Smart locks are used to locally verify the received unlocking authorization credentials, and execute the unlocking operation after successful verification. At the same time, the operation status information is transmitted back to the smart lock control management platform through the communication network.

[0031] Furthermore, the smart lock also includes a status sensing module, which includes a door magnetic sensor and a bolt position sensor; Door magnetic sensors are used to detect the open and closed status of cabinet doors; A bolt position sensor is used to detect whether the bolt is in the fully locked position; The smart lock is configured to report changes in the door status and bolt status to the smart lock control management platform in real time.

[0032] As a preferred embodiment, the smart lock also includes a locking logic control module, which is connected to the door magnetic sensor and the bolt position sensor, and is configured as follows: A locking signal is generated only when the door magnetic sensor outputs the first signal indicating that the door is closed; Furthermore, upon receiving feedback indicating that the locking action is complete, if the bolt position sensor outputs a second signal indicating that the bolt is in position, then a "locked" status message is sent to the intelligent lock control management platform.

[0033] As one implementation method, the dynamic access control module dynamically generates unlocking authorization credentials as follows: Verify the legality of the unlocking request based on the work order data; After successful verification, a dynamic access token is generated as an unlocking authorization credential. The dynamic access token contains at least the user identifier, the target lock identifier, the valid time window, and a digital signature based on an asymmetric encryption algorithm.

[0034] Furthermore, the process by which the dynamic permission management module generates a dynamic permission token includes: The user identifier, target lock identifier, start and end time of the effective time window, associated work ticket identifier, and a random number are concatenated according to a predetermined rule to form plaintext data. Use a hash algorithm to calculate the hash value of the plaintext data; The hash value is signed using the private key of the smart lock management platform to generate signature data; The plaintext data and signature data are combined and encoded to output a dynamic permission token.

[0035] As one implementation method, the process of local verification of unlocking authorization credentials by a smart lock includes: Receive and decode dynamic permission tokens, separating plaintext data and signature data; parse the target lock identifier and valid time window from the plaintext data; Verify whether the parsed target lock identifier matches the identifier of this lock; Verify whether the current time is within a valid time window; The signature data is verified using the pre-stored public key of the smart lock management platform, and the hash value of the plaintext data is recalculated to verify the validity of the signature. The unlock operation is performed only if all checks pass.

[0036] Furthermore, the hash algorithm is the Chinese national standard SM3 algorithm, and the asymmetric encryption algorithm is the Chinese national standard SM2 algorithm.

[0037] Example 2: This invention also provides a method for intelligent lock control of substation secondary switchgear based on dynamic access control, which specifically includes the following steps: Step S1, the step of sending an unlock request, in which: The mobile authorized terminal sends an unlocking request to the intelligent lock control management platform. The request includes a user identifier, a target lock identifier, and an associated work order identifier. Step S2, the step of verifying the validity of the request, in which: The intelligent lock control management platform verifies the legitimacy of the request and, upon successful verification, dynamically generates a time-sensitive unlocking authorization credential and sends it to the mobile authorization terminal. Step S3, the step of transmitting the unlocking authorization certificate, in which: The mobile authorization terminal transmits the unlocking authorization credential to the target smart lock; Step S4, verifying the unlocking authorization credential and unlocking the lock, in which: The target smart lock decodes and parses the received credentials; it then sequentially performs the steps of lock identity matching verification, time validity verification, and digital signature verification; after all verifications are successful, the main controller inside the lock drives the lock body to perform the unlocking action. Step S5, the information feedback step, in which: The target smart lock will transmit the unlocking event and subsequent door and lock status information back to the smart lock control management platform.

[0038] Furthermore, step S1 specifically includes: The mobile authorization terminal is used to send the unlocking request to the smart lock control management platform, and to receive and forward the unlocking authorization certificate to the target smart lock; The intelligent lock control management platform specifically includes a work order interface module and a dynamic permission management module; Furthermore, the work order interface module is used to communicate with an external electronic work order system to obtain work order data containing information on the work time range, work equipment range, and work personnel. Furthermore, the dynamic permission management module is used to respond to unlocking requests from the mobile authorization terminal and dynamically generate unlocking authorization credentials based on the work order data; Furthermore, step S2 specifically includes: Verify the legality of the unlocking request based on the work order data; Furthermore, after successful verification, the intelligent lock control management platform generates a dynamic permission token as an unlocking authorization credential; the dynamic permission token includes at least a user identifier, a target lock identifier, a valid time window, and a digital signature based on an asymmetric encryption algorithm. Furthermore, the dynamic permission token is created in the following way: The user identifier, the target lock identifier, the start and end times of the effective time window, the associated work order identifier, and a random number are concatenated according to a predetermined rule to form plaintext data. The hash value of the plaintext data is calculated using a hash algorithm; The hash value is signed using the private key of the smart lock management platform to generate signature data; The plaintext data and the signature data are combined and encoded to output the dynamic permission token.

[0039] Furthermore, the hash algorithm is the Chinese national standard SM3 algorithm; the asymmetric encryption algorithm is the Chinese national standard SM2 algorithm.

[0040] Furthermore, step S3 specifically includes: The smart lock is used to locally verify the unlocking authorization certificate generated in step S2, and to perform the unlocking operation after the verification is successful. At the same time, the operation status information is transmitted back to the smart lock control management platform through the communication network.

[0041] Furthermore, the smart lock also includes a status sensing module, which includes a door magnetic sensor and a bolt position sensor; Furthermore, the door magnetic sensor is used to detect the open and closed state of the cabinet door; Furthermore, the bolt position sensor is used to detect whether the bolt is in the fully locked position; Furthermore, the smart lock is configured to report changes in the door status and bolt status to the smart lock control management platform in real time.

[0042] Furthermore, the smart lock also includes a locking logic control module, which is connected to the door magnetic sensor and the bolt position sensor, and is configured as follows: A locking signal is generated only when the door magnetic sensor outputs a first signal indicating that the door is closed; and after receiving feedback indicating that the locking action is completed, if the bolt position sensor outputs a second signal indicating that the bolt is in position, a "locked" status message is sent to the intelligent lock control management platform.

[0043] Furthermore, step S4 specifically includes: The target smart lock decodes and parses the received unlocking authorization credential, separating plaintext data and signature data; it parses the target lock identifier and valid time window from the plaintext data; and then sequentially executes the steps of lock identity matching verification, time validity verification, and digital signature verification. The lock identity matching and verification step involves verifying whether the parsed target lock identifier matches the identifier of this lock. The time validity verification step involves verifying whether the current time is within the valid time window. The digital signature verification step involves using the pre-stored public key of the smart lock management platform to verify the signature data and recalculating the hash value of the plaintext data to verify the validity of the signature. The main controller inside the lock will drive the lock body to perform the unlocking action only if all verifications pass.

[0044] Application examples: Step S1, the step of sending an unlock request, in which: Employee A selects the target lock (identified as "Lock_A") on the mobile authorized terminal and submits an unlocking request. The request includes the user identifier (employee A's employee number), the target lock identifier (Lock_A), and the associated work ticket identifier (such as Ticket_20231025_001).

[0045] Step S2, the step of verifying the validity of the request, in which: After receiving a request, the dynamic permission management module of the intelligent lock control management platform first verifies its legality: checking whether the work order status is valid, whether employee A is authorized to operate Lock_A, and whether the current time is within the work time window.

[0046] After successful verification, an unlocking authorization credential (dynamic access token) is dynamically generated. The generation process is as follows: The user identifier (employee ID), target lock identifier (Lock_A), effective time window (start and end time 202310250900-202310251200), work ticket identifier (Ticket_20231025_001), and a random number (such as R12345) are concatenated according to the rule "user identifier|lock identifier|start time|end time|work ticket identifier|random number" to form plaintext data.

[0047] Use the national cryptographic algorithm SM3 to calculate the hash value of plaintext data (e.g., generate a 256-bit hash value H1).

[0048] The hash value H1 is signed using the platform's private key (based on the national cryptographic algorithm SM2) to generate signature data Sig1.

[0049] Combine plaintext data with Sig1 and perform Base64 encoding to output a dynamic permission token (such as the string "Token_ABC123").

[0050] Existing electronic lock systems often use fixed passwords or pre-distributed tokens, making them vulnerable to replay attacks. This invention dynamically generates tokens, introduces random numbers and time windows to ensure the uniqueness of each request, and employs the national cryptographic SM2 / SM3 algorithm for signing and hashing to enhance resistance to cracking.

[0051] Furthermore, traditional systems rely on a central platform for real-time verification, and network delays or interruptions can cause unlocking failures. In contrast, the tokens of this invention can be verified offline, using local public keys for signature verification, ensuring reliable operation even in signal blind spots of substations.

[0052] Step S3, the step of transmitting the unlocking authorization certificate, in which: The mobile authorization terminal transmits the token to the target smart lock (Lock_A) via Bluetooth or NFC.

[0053] Step S4, verifying the unlocking authorization certificate, in which: The local verification process for smart locks specifically includes: Decode the token to separate the plaintext data from the signature data.

[0054] Parse the target lock identifier and valid time window in the plaintext data, verify whether the lock identifier is consistent with this lock (i.e., whether it is Lock_A), and verify whether the current time is between 9:00 and 12:00 on October 25, 2023.

[0055] The pre-stored platform public key is used to verify the signature data Sig1, and the SM3 hash value of the plaintext data is recalculated and compared with the hash value in the signature to see if they are consistent.

[0056] If all checks pass, the main controller drives the lock body to perform the unlocking operation.

[0057] The smart lock of this invention emphasizes "localization" in its verification logic, reducing reliance on the network. When verification fails (e.g., token expires or signature is invalid), the lock records the event and reports it to the platform for easy auditing. Compared to existing technologies, traditional electronic locks require continuous network access for authorization verification, while this invention ensures security in offline environments through digital signatures and hash verification, making it particularly suitable for environments with strong electromagnetic interference and unstable networks, such as substations.

[0058] Step S5, the information feedback step, in which: After unlocking, the smart lock's status sensing module operates in real time: The door magnetic sensor detects the opening and closing status of the cabinet door (e.g., outputs a low-level signal when the door is open).

[0059] The latch position sensor detects whether the latch is fully locked (outputs a high-level signal when the latch is in position).

[0060] The locking logic control module is connected to the sensor signal and is configured to generate a locking signal only when the door magnetic sensor outputs a signal that the door is closed; after the locking action is completed, if the bolt position sensor outputs a bolt position signal, it sends a "locked" status information to the platform.

[0061] Traditional mechanical locks lack status feedback, requiring maintenance personnel to confirm locking on-site, which can easily lead to safety hazards due to oversights. This invention achieves closed-loop management through status perception and locking logic control, ensuring the door is properly closed before locking and reporting only when locking is complete. In this embodiment, if employee A does not fully close the door after work, the door magnetic sensor will continuously output a "door not closed" status, and the platform can issue an alarm to prevent small animals from entering or misoperation. Furthermore, status information is transmitted back to the platform in real time, forming an electronic log that replaces manual recording and improves traceability reliability.

[0062] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. The methods disclosed in the embodiments are described simply because they correspond to the systems disclosed in the embodiments; relevant details can be found in the method section.

[0063] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0064] In the embodiments provided by this invention, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between systems or units may be electrical, mechanical, or other forms.

[0065] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0066] In addition, the functional modules in the various embodiments of the present invention can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit.

[0067] Similarly, in the various embodiments of the present invention, each processing unit can be integrated into a functional module, or each processing unit can exist physically, or two or more processing units can be integrated into a functional module.

[0068] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0069] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0070] The above-disclosed embodiments are merely preferred embodiments of the present invention, but the present invention is not limited thereto. Any non-creative variations that can be conceived by those skilled in the art, as well as any improvements and modifications made without departing from the principles of the present invention, should fall within the protection scope of the present invention.

Claims

1. A substation secondary switchgear intelligent lock control system based on dynamic access control, characterized in that, Includes an intelligent lock control management platform and at least one set of field terminal devices; The field terminal equipment group includes smart locks installed on the secondary screen cabinet and mobile authorization terminals held by users; The intelligent lock control management platform includes a work order interface module and a dynamic permission management module; The work order interface module is used to communicate with an external electronic work order system to obtain work order data containing information on the work time range, work equipment range, and work personnel. The dynamic permission management module is used to respond to unlocking requests from the mobile authorization terminal and dynamically generate unlocking authorization credentials based on the work order data. The mobile authorization terminal is used to send the unlocking request to the smart lock control management platform, and to receive and forward the unlocking authorization certificate to the target smart lock; The smart lock is used to locally verify the received unlocking authorization credential, and after successful verification, to perform the unlocking operation, while simultaneously transmitting the operation status information back to the smart lock control management platform through the communication network.

2. The system according to claim 1, characterized in that, The dynamic generation of unlocking authorization credentials in the dynamic access control module is as follows: Verify the legality of the unlocking request based on the work order data; After successful verification, a dynamic permission token is generated as the unlocking authorization credential. The dynamic permission token includes at least a user identifier, a target lock identifier, a valid time window, and a digital signature based on an asymmetric encryption algorithm.

3. The system according to claim 2, characterized in that, The process of generating a dynamic permission token in the dynamic permission management module includes: The user identifier, the target lock identifier, the start and end times of the effective time window, the associated work order identifier, and a random number are concatenated according to a predetermined rule to form plaintext data. The hash value of the plaintext data is calculated using a hash algorithm; The hash value is signed using the private key of the smart lock management platform to generate signature data; The plaintext data and the signature data are combined and encoded to output the dynamic permission token.

4. The system according to claim 3, characterized in that, The process by which a smart lock locally verifies the unlocking authorization credential includes: Receive and decode the dynamic permission token, and separate the plaintext data and the signature data; The target lock identifier and effective time window are parsed from the plaintext data; Verify whether the parsed target lock identifier matches the identifier of this lock; Verify whether the current time is within the valid time window; The signature data is verified using the pre-stored public key of the smart lock management platform, and the hash value of the plaintext data is recalculated to verify the validity of the signature. The unlock operation is performed only if all checks pass.

5. The system according to claim 4, characterized in that, The hash algorithm is the Chinese national standard SM3 algorithm, and the asymmetric encryption algorithm is the Chinese national standard SM2 algorithm.

6. The system according to claim 5, characterized in that, The smart lock also includes a status sensing module, which includes a door magnetic sensor and a bolt position sensor; The door magnetic sensor is used to detect the open and closed status of the cabinet door; The latch position sensor is used to detect whether the latch is in the fully locked position; The smart lock is configured to report changes in the door status and bolt status to the smart lock control management platform in real time.

7. The system according to claim 6, characterized in that, The smart lock also includes a locking logic control module, which is connected to the door magnetic sensor and the bolt position sensor, and is configured as follows: A locking signal is generated only when the door magnetic sensor outputs a first signal indicating that the door is closed; Furthermore, upon receiving feedback indicating that the locking action is complete, if the bolt position sensor outputs a second signal indicating that the bolt is in position, then a "locked" status message is sent to the intelligent lock control management platform.

8. A method for intelligent interlocking control of secondary switchgear in substations based on dynamic access control, characterized in that, Includes the following steps: Step S1, the step of sending an unlock request, in which: The mobile authorized terminal sends an unlocking request to the intelligent lock control management platform. The request includes a user identifier, a target lock identifier, and an associated work order identifier. Step S2, the step of verifying the validity of the request, in which: The intelligent lock control management platform verifies the legitimacy of the request and, upon successful verification, dynamically generates a time-sensitive unlocking authorization credential and sends it to the mobile authorization terminal. Step S3, the step of transmitting the unlocking authorization certificate, in which: The mobile authorization terminal transmits the unlocking authorization credential to the target smart lock; Step S4, verifying the unlocking authorization credential and unlocking the lock, in which: The target smart lock decodes and parses the received credentials; it then sequentially performs the steps of lock identity matching verification, time validity verification, and digital signature verification; after all verifications are successful, the main controller inside the lock drives the lock body to perform the unlocking action. Step S5, the information feedback step, in which: The target smart lock will transmit the unlocking event and subsequent door and lock status information back to the smart lock control management platform.

9. The method according to claim 8, characterized in that, Step S2 specifically includes: The legality of the unlocking request is verified. After the verification is successful, the smart lock control management platform generates a dynamic permission token as an unlocking authorization credential. The dynamic permission token is created in the following way: The user identifier, the target lock identifier, the start and end times of the effective time window, the associated work order identifier, and a random number are concatenated according to a predetermined rule to form plaintext data. The hash value of the plaintext data is calculated using a hash algorithm; the hash algorithm is the Chinese national cryptographic SM3 algorithm. The hash value is signed using the private key of the smart lock management platform to generate signature data; The plaintext data and signature data are combined and encoded to output the dynamic permission token.

10. The method according to claim 9, characterized in that, The local verification in step S4 includes: The target smart lock decodes and parses the received unlocking authorization credential, separating plaintext data and signature data; it parses the target lock identifier and valid time window from the plaintext data; and then sequentially executes the steps of lock identity matching verification, time validity verification, and digital signature verification. The lock identity matching and verification step involves verifying whether the parsed target lock identifier matches the identifier of this lock. The time validity verification step involves verifying whether the current time is within the valid time window. The digital signature verification step involves using the pre-stored public key of the smart lock management platform to verify the signature data and recalculating the hash value of the plaintext data to verify the validity of the signature. The main controller inside the lock will drive the lock body to perform the unlocking action only if all verifications pass.

Images