A multi-tenant management method, system, medium and device of a micro-grid platform

Abstract

The application discloses a kind of micro-grid platform's multi-tenant management method, system, medium and equipment, method includes: for multiple tenants respectively create digital identity and routing space, obtain the device certificate of tenant's edge gateway and tenant's isolated routing space;In response to the start of target edge gateway, according to the device certificate of target edge gateway determine the target tenant corresponding to target edge gateway, and according to the isolated routing space of target tenant establish data uplink route and control downlink route;Target edge gateway obtains equipment data, and writes into the isolated storage area of target tenant by data uplink route;According to equipment data, generate control instruction in the isolated control channel of target tenant, and issue to target edge gateway for execution by control downlink route;According to equipment data, generate site event, and execute fault switching or limit control operation to the control link of site event. It can ensure that the control link of different tenants is independent, to avoid the problem of cross-tenant control.

Description

Technical Field

[0001] This invention relates to the field of microgrid cloud management technology, and in particular to a multi-tenant management method, system, medium and device for a microgrid platform. Background Technology

[0002] Microgrids typically consist of photovoltaic (PV) systems, energy storage, meters, energy storage converters (PCS), battery management systems (BMS), inverters, controllable loads, environmental sensors, protection devices, and edge gateways. Microgrid control differs from the request processing of typical Internet Software as a Service (SaaS). Its control objects are on-site energy storage, PV systems, grid connection points, and load equipment. Control results affect voltage, current, frequency, energy storage state of charge (SOC), grid connection power, reverse current prevention status, and equipment safety interlock status. Control commands need to form a closed loop between cloud-based strategy calculations, regional node scheduling, local verification at the edge gateway, and execution by on-site equipment, satisfying both real-time requirements and grid connection constraints and safety protection requirements.

[0003] However, traditional microgrid platforms are mostly deployed in a single customer, single project, single region or private manner. Each project requires separate deployment of servers, databases, control policies, permission systems and control channels. As the number of overseas customers increases, microgrid platforms are deployed in cloud regions in different overseas regions to enable different tenants in Europe, Asia, North America, Oceania and other regions to access the same microgrid platform with low latency.

[0004] Therefore, the microgrid platform must ensure that the control links of different tenants are independent to avoid cross-tenant control issues. Summary of the Invention

[0005] In order to overcome the shortcomings of the prior art, the present invention aims to provide a multi-tenant management method, system, medium and device for a microgrid platform, which can ensure that the control links of different tenants are independent and avoid cross-tenant control problems.

[0006] This invention is implemented according to the following scheme: A multi-tenant management method for a microgrid platform is provided, including: Create digital identities and routing spaces for multiple tenants respectively, and obtain the device certificates of the edge gateways of the tenants and the isolated routing spaces of the tenants; In response to the startup of the target edge gateway, the target tenant corresponding to the target edge gateway is determined according to the device certificate of the target edge gateway, and the data uplink route and control downlink route of the target edge gateway are established according to the isolated routing space of the target tenant; The target edge gateway obtains device data from multiple devices under the target tenant and writes it to the isolated storage area of ​​the target tenant through the data uplink route; Based on the device data, control commands are generated within the isolation control channel of the target tenant and sent to the target edge gateway for execution via the control downlink route; Based on the device data, a site event is generated, and a fault switching or restriction control operation is performed on the control link of the site event based on a preset isolation routing policy.

[0007] Optionally, digital identities and routing spaces are created for multiple tenants respectively, obtaining the edge gateway device certificate of each tenant and the isolated routing space of each tenant, including: Obtain the account opening information for each tenant; A unique tenant identifier is generated for each tenant based on the account opening information; Based on the account opening information, determine the primary and backup regional nodes for each tenant; The isolated routing space is obtained based on the tenant identifier, the primary area node, and the backup area node; Based on the tenant identifier, the device certificate of the tenant's edge gateway is obtained.

[0008] Optionally, in response to the startup of the target edge gateway, the target tenant corresponding to the target edge gateway is determined based on the device certificate of the target edge gateway, including: Responding to the startup of the target edge gateway; The device certificate of the target edge gateway is parsed to obtain the target tenant identifier; Based on the target tenant identifier, determine the target tenant corresponding to the target edge gateway and the regional node of the target tenant, and establish a connection between the target edge gateway and the regional node.

[0009] Optionally, the isolated routing space includes tenant routing rules; Based on the isolated routing space of the target tenant, establish the data uplink route and control downlink route for the target edge gateway, including: Obtain the tenant identifier and site identifier of the target tenant, and the gateway identifier of the target edge gateway; Based on the tenant identifier, the site identifier, the gateway identifier, and the tenant routing rules, determine the uplink data topic used by the target edge gateway for publishing data and the downlink data topic used for subscribing to data; The uplink data route is established based on the uplink data topic, and the downlink control route is established based on the downlink data topic.

[0010] Optionally, the target edge gateway obtains device data from multiple devices under the target tenant and writes it to the isolated storage area of ​​the target tenant through the data uplink route, including: The target edge gateway acquires device data from multiple devices under the target tenant; Obtain tenant envelope information including the tenant identifier and site identifier of the target tenant, the gateway identifier of the target edge gateway, the region identifier of the region node connected to the target edge gateway, the current timestamp, and the sequence number; The target edge gateway constructs a tenant envelope including the device data based on the tenant envelope information; The target edge gateway publishes the tenant envelope to the regional nodes connected to the target edge gateway via the data uplink route; The regional node verifies the validity of the tenant envelope. If the verification is successful, the device data is written to the isolated storage area of ​​the target tenant based on the tenant identifier.

[0011] Optionally, based on the device data, control commands are generated within the isolation control channel of the target tenant, including: In response to a user control request or a policy task triggered by the device data, a control intent is generated within the isolated routing channel of the target tenant; The control intent is verified by a security access control system. If the verification passes, a control instruction is generated that includes the tenant identifier and site identifier of the target tenant.

[0012] Optionally, based on a preset isolation routing policy, perform failover or restriction control operations on the control link of the site event, including: Based on the device data, determine the event level of the site event; When the event level is a preset level, a restriction control operation is performed on the control link of the target tenant; When the primary area node of the target tenant fails, a failover is performed based on the preset isolation routing policy, switching the control link of the target tenant from the primary area node to the backup area node of the target tenant.

[0013] A multi-tenant management system for a microgrid platform is also provided, and the multi-tenant management method for a microgrid platform described above includes: The tenant creation module is used to create digital identities and routing spaces for multiple tenants respectively, and obtain the device certificate of the edge gateway of the tenant and the isolated routing space of the tenant; The edge gateway startup module, in response to the startup of the target edge gateway, determines the target tenant corresponding to the target edge gateway based on the device certificate of the target edge gateway, and establishes the data uplink route and control downlink route of the target edge gateway based on the isolated routing space of the target tenant; The data isolation module is used for: The target edge gateway obtains device data from multiple devices under the target tenant and writes it to the isolated storage area of ​​the target tenant through the data uplink route; Based on the device data, control commands are generated within the isolation control channel of the target tenant and sent to the target edge gateway for execution via the control downlink route; Based on the device data, a site event is generated, and a fault switching or restriction control operation is performed on the control link of the site event based on a preset isolation routing policy.

[0014] A computer-readable storage medium is also provided, which is a computer-readable storage medium storing a computer program thereon, wherein the computer program, when executed, implements the multi-tenant management method for a microgrid platform.

[0015] A computer device is also provided, including a processor and a memory, wherein the memory stores at least one instruction, at least one program, code set or instruction set, and the at least one instruction, at least one program, code set or instruction set is loaded and executed by the processor to implement the multi-tenant management method of the microgrid platform.

[0016] Compared with the prior art, the beneficial effects of the multi-tenant management method for a microgrid platform of the present invention are as follows: By creating an independent digital identity and isolated routing space for each tenant, and associating a unique device certificate with the edge gateway of the tenant, each edge gateway can be accurately identified and its corresponding target tenant based on its device certificate when it starts up. This allows the establishment of a dedicated data uplink route and control downlink route for the edge gateway, enabling device data to be directly written to the isolated storage area of ​​the corresponding tenant via the data uplink route. Control commands are generated in the isolated control channel of the corresponding tenant and sent to the edge gateway of the tenant for execution via the control downlink route. This achieves tenant-level mandatory isolation throughout the entire process of data acquisition, storage, control decision-making, and command issuance. Attached Figure Description

[0017] Figure 1 This is a flowchart of the management method of the present invention. Detailed Implementation

[0018] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0019] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of this application are not limited to the described order of actions, because according to the embodiments of this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by the embodiments of this application.

[0020] In the following description, when referring to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims. In the description of this application, it should be understood that the terms "first," "second," "third," etc., are used only to distinguish similar objects and are not necessarily used to describe a specific order or sequence, nor should they be construed as indicating or implying relative importance. Those skilled in the art can understand the specific meaning of the above terms in this application according to the specific circumstances.

[0021] See Figure 1 As shown, a multi-tenant management method for a microgrid platform according to the present invention includes: S1: Create digital identities and routing spaces for multiple tenants respectively, and obtain the device certificates of the tenant's edge gateway and the tenant's isolated routing space, including: obtaining the account opening information of each tenant; generating a unique tenant identifier for each tenant based on the account opening information; determining the primary area node and backup area node for each tenant based on the account opening information; obtaining the isolated routing space based on the tenant identifier, primary area node and backup area node; and obtaining the device certificate of the tenant's edge gateway based on the tenant identifier.

[0022] In one embodiment of the present invention, the account opening information includes, but is not limited to, the continent of the customer where the customer is located for preliminary determination of the range of deployable regional nodes, the location of the site for determining the data residency compliance requirements and network latency optimization direction, the data compliance requirements for forcibly selecting specific regional nodes, the network latency requirements for ensuring the real-time performance of control commands, the cloud node health status for avoiding faulty or overloaded nodes, the service capacity for balancing the load of each node, and the customer-specified region for meeting the customer's special deployment preferences. This invention generates a unique tenant identifier (tenant_id) for each tenant, which uniquely identifies the tenant within the microgrid platform. This allows all data, control commands, policy tasks, and audit logs to be identified and forcibly isolated through the tenant identifier.

[0023] In one embodiment of the present invention, the primary and backup regional nodes for each tenant are determined based on account opening information. This includes: selecting the optimal primary regional node and the second-best backup regional node from globally deployed regional nodes based on the customer's continent, site location, data compliance requirements, network latency requirements, cloud node health status, service capacity, and the customer's designated region, as well as the globally deployed regional nodes. The globally deployed regional nodes include regional nodes deployed in different overseas regions. The primary regional node is used for device access, data processing, and control command issuance under normal circumstances to ensure low latency and high availability. The backup regional node is used to take over control services in the event of a primary regional node failure, network interruption, or active switching, ensuring uninterrupted business operations. The present invention selects primary and backup regional nodes based on account opening information to allocate the optimal cloud service region to tenants while meeting legal and regulatory requirements and real-time requirements.

[0024] In one embodiment of the present invention, the isolated routing space includes a tenant area routing table, a data namespace, a control namespace, a message queue space, a database storage space, a control session space, and an audit log space. Based on the tenant identifier, the primary area node, and the backup area node, the isolated routing space is obtained by: first, creating a tenant area routing table exclusive to that tenant using the tenant identifier as the core key value. This tenant area routing table records the tenant identifier, the node address of the primary area node, the node address of the backup area node, a list of sites, a list of edge gateways, a control namespace identifier, a control lease status, and a routing version number. Then, based on the tenant identifier, the data namespace, control namespace, message queue space, database storage space, control session space, and audit log space are established. The present invention ensures that the real-time data, control tasks, control commands, and execution receipts of different tenants are physically or logically isolated from each other through the aforementioned isolated routing space. No tenant's data and control flow can be illegally accessed or misoperated by other tenants, thereby achieving complete isolation of cross-tenant control links.

[0025] In one embodiment of the present invention, the edge gateway cannot be used across tenants. A tenant can own multiple edge gateways, but an edge gateway can only serve one tenant. The present invention provides each edge gateway with a unique digital identity credential through a device certificate, so as to forcibly bind the edge gateway to a unique tenant when it registers, and to forcibly bind all field devices under the edge gateway to the same tenant. The present invention also uses the device certificate to perform identity verification, establish a secure communication channel, and digitally sign the transmitted data and control commands when the edge gateway accesses the platform, so as to prevent the forgery of edge gateways or data tampering.

[0026] S2: In response to the startup of the target edge gateway, determine the target tenant corresponding to the target edge gateway based on the device certificate of the target edge gateway, and establish the data uplink route and control downlink route of the target edge gateway based on the isolated routing space of the target tenant; In one embodiment of the present invention, in response to the startup of the target edge gateway, determining the target tenant corresponding to the target edge gateway based on the device certificate of the target edge gateway includes: in response to the startup of the target edge gateway; parsing the device certificate of the target edge gateway to obtain a target tenant identifier; determining the target tenant and the regional node of the target edge gateway based on the target tenant identifier, and establishing a connection between the target edge gateway and the regional node.

[0027] In one embodiment of the present invention, the device certificate of the edge gateway is obtained based on the tenant identifier and the site identifier. When the target edge gateway starts up and presents its device certificate, the microgrid platform can read the target tenant identifier and the target site identifier pre-written into the device certificate by parsing the device certificate. Based on the tenant identifier, the platform queries the tenant area routing table of the isolated routing space to obtain the node address of the pre-allocated primary area node from the tenant area routing table corresponding to the target tenant. If the primary area node has an abnormal health status or fails, the node address of the backup area node can be automatically returned based on the health check result of the primary area node, thereby realizing rapid redirection in case of failure.

[0028] This invention establishes a connection between the edge gateway and the regional node of the target tenant, creating a persistent, bidirectional, low-latency communication channel for subsequent data reporting and control command issuance. This avoids re-authentication and routing queries for each interaction, thereby meeting the real-time requirements of microgrid control.

[0029] In one embodiment of the present invention, the isolated routing space includes tenant routing rules; establishing data uplink routes and control downlink routes for the target edge gateway based on the isolated routing space of the target tenant includes: obtaining the tenant identifier and site identifier of the target tenant, and the gateway identifier of the target edge gateway; determining the uplink data topic used by the target edge gateway for publishing data and the downlink data topic used for subscribing to data based on the tenant identifier, site identifier, gateway identifier, and tenant routing rules; establishing data uplink routes based on the uplink data topics, and establishing control downlink routes based on the downlink data topics.

[0030] In one embodiment of the present invention, the site identifier site_id is used to further define the physical microgrid project to which the data and control commands belong, so that data from different sites (different projects) under the same tenant can be distinguished and isolated; the gateway identifier gateway_id is used to uniquely identify the edge gateway, ensuring that control commands can be accurately sent to the correct edge gateway and not be incorrectly received by other edge gateways.

[0031] In one embodiment of the present invention, an uplink data topic is used to enable regional nodes subscribed to the topic to receive device data published by the edge gateway when the edge gateway publishes device data; a downlink control topic is used by regional nodes to publish control commands, enabling edge gateways subscribed to the topic to receive the control commands published by the regional nodes; the present invention achieves logical separation and physical isolation of data flow and control flow through uplink data topics and downlink data topics, ensuring that uplink data will not interfere with downlink control, and at the same time, it uses tenant-level topic namespaces to prevent cross-tenant message crosstalk.

[0032] S3: The target edge gateway obtains device data from multiple devices under the target tenant and writes it to the isolated storage area of ​​the target tenant through data uplink routing. This includes: the target edge gateway obtaining device data from multiple devices under the target tenant; obtaining tenant envelope information including the tenant identifier and site identifier of the target tenant, the gateway identifier of the target edge gateway, the area identifier of the area node connected to the target edge gateway, the current timestamp, and the sequence number; the target edge gateway constructing a tenant envelope including device data based on the tenant envelope information; the target edge gateway publishing the tenant envelope to the area node connected to the target edge gateway through data uplink routing; the area node verifying the validity of the tenant envelope, and if the verification is successful, writing the device data to the isolated storage area of ​​the target tenant based on the tenant identifier.

[0033] In one embodiment of the present invention, the data uplink routing has a three-layer isolation mechanism to ensure that data from different tenants is isolated throughout the entire process from access to storage. The three-layer isolation mechanism includes: The first layer involves tenant identification routing isolation. After receiving the tenant envelope published by the target edge gateway, the microgrid platform parses the tenant envelope to obtain the tenant identifier (tenant_id) in the tenant envelope. Based on the tenant identifier, the platform dynamically routes the device data in the tenant envelope to the isolated storage area of ​​the corresponding regional node of the target tenant. Even if the device data of different tenants are within the same regional node, they are routed to different processing channels, thus achieving tenant-level separation from the entry point.

[0034] The second layer of message queue isolation, at the message middleware level, involves the microgrid platform assigning independent topics, message partitions, or message channels with target tenant prefixes to different tenants. For example, tenant A's data is forced to be written to the topic / data / tenant_A, and tenant B's data is written to the topic / data / tenant_B. Alternatively, the data of the same tenant can be fixed in a specific partition using a consistent hashing algorithm. This invention ensures that the message consumer of any tenant cannot read data from other tenants across topics or partitions through this layer of message queue isolation.

[0035] The third layer of database storage isolation, at the data persistence level, involves the microgrid platform configuring an independent database instance, an independent database schema, and an independent table partition for each tenant. Alternatively, the tenant identifier (tenant_id) can be forcibly included as a partition key or filter condition in tables within the shared time-series database. For example, an independent database db_tenant_A can be created for tenant A, or WHERE tenant_id='A' can be used as a mandatory condition for all queries in the shared database.

[0036] This invention ensures end-to-end tenant isolation of device data from access, transmission to persistence through a three-layer isolation mechanism: the first layer of tenant identification routing isolation, the second layer of message queue isolation, and the third layer of database storage isolation.

[0037] In one embodiment of the present invention, the regional node verifies the validity of the tenant envelope, including: verifying whether the device certificate belongs to the tenant and whether the device belongs to the site, to ensure that the target edge gateway and the device publishing the device data are bound to the target tenant and the site; then verifying whether the region identifier region_id in the tenant envelope is consistent with the region identifier of the current regional node, to prevent the device data from being sent to the wrong regional node due to routing errors or malicious tampering; verifying whether the sequence number sequence in the tenant envelope is consecutive with the sequence number in the previous tenant envelope, to detect whether the device data is lost or out of order; finally verifying whether the device data hash value payload_hash in the tenant envelope is consistent with the received device data hash value, to confirm that the device data has not been tampered with during transmission; when all the above verifications pass, the verification is successful, and the tenant envelope is valid.

[0038] S4: Based on the device data, a control command is generated within the isolated control channel of the target tenant and sent to the target edge gateway for execution via a control downlink route. This invention restricts the generation and distribution of control commands to the isolated control channel dedicated to the target tenant, and sends them to the target edge gateway that is forcibly bound to the target tenant via a control downlink route established only for that target tenant. This ensures that control commands from different tenants are completely isolated in the cloud and on the transmission link, avoiding the risk of cross-tenant miscontrol. At the same time, the control downlink route ensures that the control commands can reach the correct field devices quickly and accurately, meeting the microgrid's requirements for control real-time performance and security.

[0039] In one embodiment of the present invention, a control instruction is generated in the isolated control channel of the target tenant based on device data, including: generating a control intent in the isolated routing channel of the target tenant in response to a user control request or a policy task triggered by device data; performing security access control verification on the control intent; and generating a control instruction including the tenant identifier and site identifier of the target tenant if the verification passes.

[0040] In one embodiment of the present invention, the user control request is a control action that the user manually sets within the scope of their authority, such as device mode, power, SOC target of energy storage battery, start / stop status or control parameters, or a control action that the user sets to be executed during a timed period, such as peak shaving and valley filling during weekdays, off-peak charging at night, and anti-reverse current priority control action on weekends. That is, the user control request is a control request that is actively issued under the user's manual control mode or a control request that is issued at a timed interval under the time template control mode.

[0041] In one embodiment of the present invention, the policy task triggered by device data is generated under a fully automatic algorithm control mode, including: the microgrid platform generates a policy package based on the policy template and device data pre-configured by the target tenant, including policy version number, applicable site, applicable device, effective time window, effective execution time, triggering condition, priority, mutual exclusion rule, control boundary and rollback condition; then, based on the effective time window and triggering condition in the policy package, the policy task is dynamically generated when the condition is met, and the policy task is added to the task queue of the target tenant.

[0042] When multiple policy tasks exist, they are sorted to determine their execution priority. This includes: grouping policy tasks based on tenant identifiers to prevent cross-tenant task mixing; sending policy tasks to the corresponding region nodes based on region identifiers; determining the execution order of policy tasks within the same site based on site identifiers, and determining the execution order of policy tasks on the same device based on device identifiers to avoid concurrent conflicts on the same device; then sorting policy tasks in descending order of priority within the policy package, with accident protection and local security interlocking having the highest priority, followed by manual emergency control, then backflow prevention and demand control, then time template policy, and finally ordinary automatic optimization policy; and finally, removing expired policy tasks based on their effective execution time in the policy package to ensure that high-priority policy tasks are processed first, thereby guaranteeing that critical control tasks can be executed in a timely manner.

[0043] In one embodiment of the present invention, when the same device simultaneously has control requests under manual control mode, control requests under time template control mode, and strategy tasks generated under fully automatic algorithm control mode, the microgrid platform coordinates according to preset priority rules, including: fault protection and local safety interlocking are not strategy tasks under ordinary fully automatic algorithm control mode, but independent safety protection constraint strategy tasks, which have the highest priority and can directly block or cover any control commands issued from the cloud; manual emergency control is a manual control request under manual control mode, which has a lower priority than safety protection tasks but higher than strategy tasks or control requests under all automatic control modes; anti-reverse flow control and demand control are constraint-type automatic control strategy tasks used to prevent backfeeding from the grid connection point or exceeding the maximum demand limit, which have a higher priority than economic optimization automatic control strategy tasks; control requests under time template control mode are conventional strategies executed according to daily or weekly plans, which have a lower priority than the above-mentioned constraint-type strategy tasks; ordinary automatic optimization strategies are economic optimization automatic algorithms, which usually aim to reduce electricity costs, increase photovoltaic consumption, or optimize energy storage revenue, which have the lowest priority.

[0044] This invention ensures that only one control intent can enter the control security access control for security access control verification at any given time by using mutex locks or device-level serial queues under the same tenant identifier, the same site identifier, and the same device identifier. When a low-priority control intent encounters a high-priority control intent, the low-priority control intent is delayed, canceled, or converted to a pending confirmation state, thereby avoiding control conflicts and ensuring the priority execution of critical control tasks.

[0045] S5: Generate site events based on device data, and perform failover or restriction control operations on the control links of site events based on preset isolation routing policies, including: determining the event level of the site event based on device data; when the event level is a preset level, performing restriction control operations on the control links of the target tenant; when the primary area node of the target tenant fails, performing failover based on preset isolation routing policies, switching the control links of the target tenant from the primary area node to the backup area node of the target tenant.

[0046] In one embodiment of the present invention, the event levels of site events include four levels: normal events, alert events, alarm events, and incident events. The normal event level indicates that the operating parameters of the device and site are within acceptable ranges, such as normal data reporting, normal policy execution, and completed revenue settlement, requiring no special attention. The alert event level indicates events that require attention but have not yet affected operational safety, such as short-term device offline, energy storage state of charge (SOC) approaching the policy threshold, increased communication latency, and automatic retries after report generation failure, reminding maintenance personnel to handle the situation as appropriate. The alarm event level indicates operational indicators... If the warning threshold is exceeded or the control effect is abnormal, such as battery temperature exceeding the warning value, grid connection point power approaching the backfeeding limit, energy storage SOC below the alarm threshold, policy execution failure, or edge gateway offline for a long time, timely intervention is required. The "accident event" level is used to indicate a serious state that may affect microgrid safety or grid connection compliance, such as energy storage converter PCS failure, serious alarm of battery management system (BMS), protection device operation, grid connection point backfeeding exceeding the limit, fire protection or over-temperature protection triggering, or abnormal equipment status after control command execution. These site events must be handled immediately and an event summary must be automatically generated and sent to the designated contact person via email.

[0047] In one embodiment of the present invention, the microgrid platform maintains a control lease for each site or edge gateway under each tenant. The control lease includes at least the tenant identifier, site identifier, edge gateway identifier, current master control area identifier, control epoch, fencing token, lease start time, lease expiration time, and lease status. Under normal circumstances, only the area node (master area node) holding a valid control lease has the right to issue control commands to the site or edge gateway.

[0048] In one embodiment of the present invention, when the network quality of the primary area node is lower than a set threshold or the tenant configuration requires switching, it is considered a primary area node failure. Failover is performed based on a preset isolation routing strategy, switching the target tenant's control link from the primary area node to the target tenant's backup area node. This includes: the global tenant control plane first freezes the control tasks to be issued by the primary area node and marks any incomplete control instructions as pending takeover status; then, it initiates a lease takeover request to the backup area node. Before takeover, the backup area node, based on the tenant area routing table, the online status of the edge gateway, and the most recent execution receipt, generates a new control generation and a new protection token by incrementing the original generation, and writes the updated control lease into the control lease table. At this time, the backup area node begins issuing control instructions to the edge gateway. After receiving the control instructions, the edge gateway verifies whether the control generation is greater than the locally accepted control generation and whether the protection token is consistent with the current lease, and only executes the instructions if the verification passes.

[0049] When the primary region node recovers, because it still holds the old control hierarchy and the old protection token, any control commands it issues will be rejected by the edge gateway; the original primary region must reapply for a lease from the global tenant control plane and obtain a new control hierarchy and protection token before it can regain control.

[0050] When a primary area node fails, this invention transfers the control lease from the primary area node to a backup area node, generates a new control generation and protection token, and updates the lease record. The backup area node can only take over control services after successfully acquiring a valid control lease. Even if the old primary area node recovers and remains connected, its control commands will be rejected by the edge gateway because its control generation has expired. It can only regain control of the site equipment after acquiring a new control generation and protection token. In other words, this invention ensures that only one area node has control at any given time during multi-area failover through control leases, preventing the primary area node and the backup area node from controlling the same site equipment.

[0051] In one embodiment of the present invention, the management method further includes: Without affecting the real-time control isolation link, revenue statistics and operation reports are generated based on tenant, site, and period. These tasks are low-priority operational auxiliary tasks and are independently scheduled by the multi-tenant task scheduling module outside of control tasks. Specifically, revenue statistics calculate electricity cost savings, energy storage revenue, anti-backflow revenue, and carbon emission reduction based on electricity price rules, energy storage charging and discharging data, grid connection power, and carbon emission factors. The operation report includes a real-time operation summary, event log, strategy execution log, control command log, and execution receipt. Based on detailed records from tenants, including real-time data access, control intent generation, security access control verification, control command issuance, edge gateway local verification, device execution receipts, control revocation, control retry, control lease changes, and area switching records, this system fully demonstrates that each control command always flows in a closed loop within its respective tenant, site, device, and effective control area. This provides an immutable audit basis for post-event traceability, security compliance analysis, and fault diagnosis.

[0052] The following section uses the company's deployment of EMS regional nodes in regions A, B, C, D, and E as an example to illustrate the multi-tenant management method of this invention in detail: A European customer A owns two microgrid sites in region A, an Asian customer B owns sites in regions B and C, a North American customer C owns a site in region D, and an Oceania customer D owns a site in region E. All four customers use the same microgrid platform, and the microgrid platform establishes an independent tenant for each customer.

[0053] After customer A is created, the microgrid platform assigns a tenant identifier tenant_A to it and designates the primary area node as node A and the backup area node as node B. When the edge gateway of customer A in region A starts up, it first resolves the tenant identifier according to the device certificate of the edge gateway and queries the tenant area routing table to return the access address of node A (the primary area node). After the edge gateway establishes a connection with node A (the main area node), it uploads device data such as real-time power, SOC, voltage, current, frequency, and device status to node A (the main area node). Node A verifies the validity of the tenant identifier tenant_A, site identifier site_A1, gateway identifier gateway_A1, and device certificate. Then, it writes the device data to the isolated storage area of ​​tenant_A, which has message topics and time-series databases, through the tenant identifier.

[0054] Although Customer B uses the same microgrid platform page and underlying services, its tenant_B's data namespace, control namespace, message queue, database partition, policy tasks, control queue, control receipts, and audit logs are all isolated from tenant_A. Customer B's users cannot read any data stored in tenant_A, and Customer A's control commands will not enter tenant_B's control queue.

[0055] Regarding access control, the group administrator of Customer A can view the real-time status and historical trends of the two power plants under its name; the operation and maintenance personnel of site A1 can only view the data of site_A1; the dispatcher can issue control commands to the authorized energy storage converter PCS; and read-only personnel can only view the operating data and cannot issue any control commands.

[0056] If customer A has configured a strategy template for the energy storage system at site_A1, for example, using a peak shaving and valley filling strategy from 8:00 to 22:00 on weekdays and an off-peak charging strategy from 22:00 to 6:00 the next day; when the backflow power at the grid connection point is close to the threshold, the priority of the anti-reverse current strategy is set higher than that of the ordinary peak shaving and valley filling strategy; when the customer selects fully automatic algorithm control, the platform automatically adjusts the energy storage charging and discharging power by combining time-of-use pricing, load forecasting, photovoltaic power forecasting, and energy storage SOC.

[0057] If customer A's policy task triggers energy storage discharge control at a certain moment, a control task is generated in the context of tenant_A, and the control intent is written into the control namespace of tenant_A. Then, the following checks are performed: whether the policy belongs to tenant_A, whether it applies to site_A1, whether the target PCS belongs to site_A1, whether the current SOC is within the allowed range, whether the current event level allows cloud control, whether the edge gateway is online, and whether node A is the main control area. When all checks pass, the microgrid platform generates a control instruction with a digital signature, validity period, serial number, and idempotent key.

[0058] If the edge gateway gateway_A1 only subscribes to control topics that match its own tenant_A, site_A1, and gateway_A1, then it can only receive authorized control commands from tenant_A. After receiving the control command, the edge gateway verifies the tenant identifier, site identifier, gateway identifier, and digital signature to confirm that the command has not been executed repeatedly and that the device is not in a faulty state. Then, it converts the cloud control command into a PCS protocol message and sends it to the energy storage converter PCS. After the energy storage converter PCS executes the command, it returns status information. The edge gateway gateway_A1 uploads the execution receipt to node A (the main area node). At this time, node A writes the control result into the audit log of tenant_A.

[0059] If a site event occurs at site_A1, which is a PCS failure of the energy storage converter, the site event will be identified as an accident event. The microgrid platform will automatically send an email notification to the pre-designated contact person of customer A. In the accident state, the normal automatic optimization strategy is suspended, and only safety protection, rollback or control actions after manual confirmation are allowed to continue to be executed.

[0060] If node A (the primary area node) fails, the control service endpoint of customer A will be switched to node B (the backup area node). Before taking over control, the backup area node first acquires the control lease of the edge gateway_A1 and generates a new control generation and protection token. After that, the edge gateway_A1 will only accept control commands from node B (the backup area node) that carry the new control generation and the new protection token.

[0061] When node A (the primary area node) recovers, any control commands it issues will be rejected by the edge gateway gateway_A1 because it still holds the old control generation and the old protection token. This avoids the risk of two area nodes simultaneously issuing control commands to the same site device.

[0062] This invention creates an independent digital identity and isolated routing space for each tenant and associates a unique device certificate with the tenant's edge gateway. This enables each edge gateway to be accurately identified and its corresponding target tenant based on its device certificate upon startup. This allows the establishment of a dedicated data uplink route and control downlink route for the edge gateway. Device data is then directly written to the isolated storage area of ​​the corresponding tenant via the data uplink route, while control commands are generated within the isolated control channel of the corresponding tenant and sent to the tenant's edge gateway for execution via the control downlink route. This achieves tenant-level mandatory isolation throughout the entire process of data acquisition, storage, control decision-making, and command issuance.

[0063] The present invention provides a multi-tenant management system for a microgrid platform, which applies the aforementioned multi-tenant management method for a microgrid platform, including: The tenant creation module is used to create digital identities and routing spaces for multiple tenants, and obtain the edge gateway device certificate and the tenant's isolated routing space. The edge gateway startup module responds to the startup of the target edge gateway, determines the target tenant corresponding to the target edge gateway based on the device certificate of the target edge gateway, and establishes the data uplink route and control downlink route of the target edge gateway based on the isolated routing space of the target tenant. The data isolation module is used for: The target edge gateway obtains device data from multiple devices under the target tenant and writes it to the isolated storage area of ​​the target tenant through the data uplink route; Based on the device data, control commands are generated within the isolated control channel of the target tenant and sent to the target edge gateway for execution via the control downlink route; Site events are generated based on device data, and fault switching or restriction control operations are performed on the control links of site events based on preset isolation routing policies.

[0064] This invention discloses a computer-readable storage medium storing a computer program thereon, which, when executed, implements the multi-tenant management method of the microgrid platform.

[0065] Optionally, the computer-readable storage medium may include: read-only memory (ROM), random access memory (RAM), solid-state drives (SSDs), or optical discs, etc. The random access memory may include resistive random access memory (ReRAM) and dynamic random access memory (DRAM).

[0066] The computer device of the present invention includes a processor and a memory. The memory stores at least one instruction, at least one program, code set, or instruction set. The at least one instruction, at least one program, code set, or instruction set is loaded and executed by the processor to implement the multi-tenant management method of the microgrid platform described above.

[0067] The processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0068] The memory can be used to store the computer programs or modules. The processor implements various functions of the multi-tenant management method of the microgrid platform by running or executing the computer programs or modules stored in the memory and calling the data stored in the memory. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, applications required for at least one function, etc.; the data storage area may store data created based on the use of the mobile phone, etc. In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital card (SD), flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0069] The above are merely preferred embodiments of this application and are not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A multi-tenant management method for a microgrid platform, characterized in that, include: Create digital identities and routing spaces for multiple tenants respectively, and obtain the device certificates of the edge gateways of the tenants and the isolated routing spaces of the tenants; In response to the startup of the target edge gateway, the target tenant corresponding to the target edge gateway is determined according to the device certificate of the target edge gateway, and the data uplink route and control downlink route of the target edge gateway are established according to the isolated routing space of the target tenant; The target edge gateway obtains device data from multiple devices under the target tenant and writes it to the isolated storage area of ​​the target tenant through the data uplink route; Based on the device data, control commands are generated within the isolation control channel of the target tenant and sent to the target edge gateway for execution via the control downlink route; Based on the device data, a site event is generated, and a fault switching or restriction control operation is performed on the control link of the site event based on a preset isolation routing policy.

2. The multi-tenant management method for a microgrid platform according to claim 1, characterized in that, Create digital identities and routing spaces for multiple tenants respectively, and obtain the edge gateway device certificate and isolated routing space of each tenant, including: Obtain the account opening information for each tenant; A unique tenant identifier is generated for each tenant based on the account opening information; Based on the account opening information, determine the primary and backup regional nodes for each tenant; The isolated routing space is obtained based on the tenant identifier, the primary area node, and the backup area node; Based on the tenant identifier, the device certificate of the tenant's edge gateway is obtained.

3. The multi-tenant management method for a microgrid platform according to claim 1, characterized in that, In response to the startup of the target edge gateway, the target tenant corresponding to the target edge gateway is determined based on the device certificate of the target edge gateway, including: In response to the startup of the target edge gateway; The device certificate of the target edge gateway is parsed to obtain the target tenant identifier; Based on the target tenant identifier, determine the target tenant corresponding to the target edge gateway and the regional node of the target tenant, and establish a connection between the target edge gateway and the regional node.

4. The multi-tenant management method for a microgrid platform according to claim 1, characterized in that, The isolated routing space includes tenant routing rules; Based on the isolated routing space of the target tenant, establish the data uplink route and control downlink route for the target edge gateway, including: Obtain the tenant identifier and site identifier of the target tenant, and the gateway identifier of the target edge gateway; Based on the tenant identifier, the site identifier, the gateway identifier, and the tenant routing rules, determine the uplink data topic used by the target edge gateway for publishing data and the downlink data topic used for subscribing to data; The uplink data route is established based on the uplink data topic, and the downlink control route is established based on the downlink data topic.

5. The multi-tenant management method for a microgrid platform according to claim 3, characterized in that, The target edge gateway acquires device data from multiple devices under the target tenant and writes it to the isolated storage area of ​​the target tenant through the data uplink route, including: The target edge gateway acquires device data from multiple devices under the target tenant; Obtain tenant envelope information including the tenant identifier and site identifier of the target tenant, the gateway identifier of the target edge gateway, the region identifier of the region node connected to the target edge gateway, the current timestamp, and the sequence number; The target edge gateway constructs a tenant envelope including the device data based on the tenant envelope information; The target edge gateway publishes the tenant envelope to the regional nodes connected to the target edge gateway via the data uplink route; The regional node verifies the validity of the tenant envelope. If the verification is successful, the device data is written to the isolated storage area of ​​the target tenant based on the tenant identifier.

6. The multi-tenant management method for a microgrid platform according to claim 1, characterized in that, Based on the device data, control commands are generated within the isolation control channel of the target tenant, including: In response to a user control request or a policy task triggered by the device data, a control intent is generated within the isolated routing channel of the target tenant; The control intent is verified by a security access control system. If the verification passes, a control instruction is generated that includes the tenant identifier and site identifier of the target tenant.

7. The multi-tenant management method for a microgrid platform according to claim 1, characterized in that, Based on a preset isolation routing policy, the control link of the site event is subjected to failover or restriction control operations, including: Based on the device data, determine the event level of the site event; When the event level is a preset level, a restriction control operation is performed on the control link of the target tenant; When the primary area node of the target tenant fails, a failover is performed based on the preset isolation routing policy, switching the control link of the target tenant from the primary area node to the backup area node of the target tenant.

8. A multi-tenant management system for a microgrid platform, employing the multi-tenant management method for a microgrid platform as described in any one of claims 1-7, characterized in that, include: The tenant creation module is used to create digital identities and routing spaces for multiple tenants respectively, and obtain the device certificate of the edge gateway of the tenant and the isolated routing space of the tenant; The edge gateway startup module, in response to the startup of the target edge gateway, determines the target tenant corresponding to the target edge gateway based on the device certificate of the target edge gateway, and establishes the data uplink route and control downlink route of the target edge gateway based on the isolated routing space of the target tenant; The data isolation module is used for: The target edge gateway obtains device data from multiple devices under the target tenant and writes it to the isolated storage area of ​​the target tenant through the data uplink route; Based on the device data, control commands are generated within the isolation control channel of the target tenant and sent to the target edge gateway for execution via the control downlink route; Based on the device data, a site event is generated, and a fault switching or restriction control operation is performed on the control link of the site event based on a preset isolation routing policy.

9. A computer-readable storage medium, characterized in that, It is a computer-readable storage medium on which a computer program is stored, which, when executed, implements a multi-tenant management method for a microgrid platform as described in any one of claims 1-7.

10. A computer device, characterized in that, The computer device includes a processor and a memory, the memory storing at least one instruction, at least one program, code set, or instruction set, the at least one instruction, at least one program, code set, or instruction set being loaded and executed by the processor to implement a multi-tenant management method for a microgrid platform as described in any one of claims 1 to 7.

Images