A substation cross-security partition intelligent unlocking authorization generation method, device and computer program product

Abstract

The application discloses a substation cross-security partition intelligent unlocking authorization generation method and device and a computer program product, belongs to the technical field of power system safety management and control, and aims to solve the problems of difficult unlocking authorization safety transmission and high risk control of traditional universal keys under the physical isolation of the substation office business network and the safety production network. The application obtains the approved unlocking authorization information in the first security network partition, and generates an offline authorization two-dimensional code through national secret hash operation and national secret asymmetric private key digital signature. The two-dimensional code is transmitted to the second security network partition in an offline manner, and the unlocking permission is only issued to the specified unlocking object after the corresponding public key signature verification and authorization validity verification. The application does not need cross-network connection, adapts to the power safety partition protection specification, guarantees that the authorized data cannot be tampered with and forged, realizes one authorization and one interval precise control, supports local offline verification, and is suitable for the substation intelligent unlocking management and control scene.

Description

Technical Field

[0001] This invention relates to the field of power system security management and control technology, specifically to a method, device, and computer program product for generating intelligent unlocking authorizations across security zones in substations. Background Technology

[0002] Unlocking substation equipment control boxes is a crucial aspect of power system operation and maintenance. Currently, substations commonly use master keys to unlock these boxes. These keys can open all locks within the substation but lack bay-level access control, posing multiple security risks: First, the risk of accidental unlocking, where operators may accidentally unlock locks in non-target bays, potentially leading to live-line accidents; second, the risk of unauthorized unlocking, as the lack of a corresponding approval and control mechanism allows operators to bypass the approval process and unlock directly; and third, difficulty in tracing the operation, as the unlocking process is not electronically recorded, making it impossible to trace and verify the operation afterward.

[0003] To address these issues, the industry is gradually adopting smart unlocking keys to replace traditional master keys, enabling precise unlocking control with one authorization per zone. However, according to the security protection specifications for power monitoring systems, the substation office business network and the safety production five-prevention network must be physically isolated, prohibiting direct data transmission across networks and the exchange of unlocking approval data through network gateways, forward isolation devices, or other equipment. Since unlocking authorization and approval are deployed on the office business network side, while unlocking execution is deployed on the safety production network side, the secure transmission of authorization information between the two zones has become the core technical bottleneck for the implementation of smart unlocking solutions.

[0004] Existing intelligent unlocking and QR code authorization solutions for substations mostly complete approval, QR code generation, and decryption verification within the same security zone, relying on intranet network data interaction, which cannot adapt to application scenarios with cross-zone physical isolation. Some solutions that combine online pre-authorization and offline verification still rely on the online pre-authorization channel, and the authorization process cannot proceed normally when the network is interrupted. At the same time, existing solutions mostly adopt a unified key management mode within the same system, without realizing key zone-based deployment, which poses a security risk of authorization forgery; and generally lack an offline blacklist verification mechanism, making it difficult to effectively prevent the reuse of authorized QR codes.

[0005] In summary, there is currently a lack of technical solutions that can safely and efficiently achieve cross-regional transmission and local verification of unlocking authorization under the rigid constraint of physical isolation across substation safety zones. This makes it impossible to simultaneously meet the dual requirements of power safety protection standards and refined control of unlocking operations. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide a method, device and computer program product for generating intelligent unlocking authorization across safety zones in substations, so as to realize the secure transmission and verification of authorization information.

[0007] To address the aforementioned technical problems, this invention provides a method for generating intelligent unlocking authorizations across security zones in a substation. This method is applied to a first security network zone of the substation, which is physically isolated from a second security network zone used for performing on-site unlocking operations. The method includes the following steps: Obtain approved unlocking authorization information, which includes at least the target unlocking object identifier and the authorized valid time period information; The unlocking authorization information is digested using the national cryptographic hash algorithm to obtain a message digest; The message digest is digitally signed using the private key of the national cryptographic asymmetric signature algorithm pre-stored in the first secure network partition to generate signature data. The unlocking authorization information and the signature data are encoded to generate an offline authorization QR code; the offline authorization QR code is used to transmit the QR code to the second secure network partition offline, so that the unlocking verification device of the second secure network partition can complete the signature verification based on the pre-stored corresponding public key and, after passing the authorization validity verification, issue an unlocking authorization command only to the corresponding target unlocking object.

[0008] Preferably, after obtaining the approved unlocking authorization information and before performing digest calculation using the national cryptographic hash algorithm, the method further includes a step of performing multi-dimensional compliance verification on the unlocking authorization information; if the verification fails, the current authorization generation process is terminated and a correction prompt message is returned.

[0009] Preferably, the multidimensional compliance verification specifically includes: Standardized identification and error correction: By comparing with the built-in standard coding dictionary of power grid equipment, the equipment identifier in the unlocking authorization information is converted into a unified dispatch standard code. If automatic error correction cannot be completed, a manual correction prompt will be returned. Frequency risk control verification: retrieve historical unlocking ledger data, count the number of times the target unlocking object has been unlocked within a preset statistical period, and block the generation of this authorization if the number of times exceeds the preset operation and maintenance management threshold; Integrity verification: Check whether the required fields in the unlock authorization information are complete. If any fields are missing, terminate the authorization generation process.

[0010] Preferably, the private key of the national cryptographic asymmetric signature algorithm is permanently stored in the server-side hardware secure storage module of the first secure network partition, and is saved in an encrypted state and prohibited from being exported; the public key of the national cryptographic asymmetric signature algorithm corresponding to the private key is distributed through an offline storage medium and pre-installed in the secure storage area of ​​the unlocking and verification device in the second secure network partition.

[0011] Preferably, the submission of unlock authorization information and the triggering of authorization generation are executed through a web-based approval plugin deployed in the first secure network partition; the web-based approval plugin configures the interface display unit, data transmission unit, and service interface call unit, and all encryption and signature operations are executed by the server of the first secure network partition.

[0012] Preferably, before performing the digest operation, the data fields of the unlocking authorization information are first concatenated into a standardized authorization message according to a preset sorting rule; the offline authorization QR code encapsulates the standardized authorization message, signature data, and a public key hash identifier, the public key hash identifier being used by the unlocking verification device of the second secure network partition to match the corresponding verification public key.

[0013] Preferably, after the offline authorization QR code is transmitted to the second secure network partition, the unlocking verification device performs local offline verification: first, it completes digital signature verification and digest comparison using the matched public key, and then sequentially performs time validity verification, unlocking object matching verification, and blacklist verification; after all verifications pass, an unlocking authorization command is issued to the corresponding target unlocking object, and at the same time, the unique identifier of the authorization is recorded in the local blacklist database, which is independently deployed on the local unlocking verification device of the second secure network partition.

[0014] The present invention also provides an intelligent unlocking authorization generation device for a substation across security zones, applied to a first security network zone of the substation, wherein the first security network zone is physically isolated from a second security network zone used for performing on-site unlocking operations, the device comprising: The information acquisition module is used to acquire the approved unlocking authorization information, which includes at least the target unlocking object identifier and the authorization validity period information; The digest operation module is used to perform a digest operation on the unlocking authorization information using the national cryptographic hash algorithm to obtain a message digest; The digital signature module is used to digitally sign the message digest using a private key of a national cryptographic asymmetric signature algorithm pre-stored in the first secure network partition, and generate signature data. The QR code generation module is used to encode the unlocking authorization information and the signature data to generate an offline authorization QR code; the offline authorization QR code is used to transmit the QR code to the second secure network partition offline, so that the unlocking verification device of the second secure network partition can complete the signature verification based on the pre-stored corresponding public key and, after passing the authorization validity verification, issue an unlocking authorization command only to the corresponding target unlocking object.

[0015] The present invention also provides an intelligent unlocking authorization generation device for substations across safety zones, comprising: One or more processors; Memory; One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, the one or more applications being configured to execute the smart unlock authorization generation method across safety zones of the substation.

[0016] The present invention also provides a computer program product, including computer instructions, which instruct a computer device to perform operations corresponding to the intelligent unlocking authorization generation method for substations across safety zones.

[0017] The beneficial effects of this invention are as follows: Addressing the rigid constraints of physical isolation across substation security zones, this invention uses offline QR codes as the carrier for cross-zone authorization information transmission. The entire process from approval and authorization to on-site execution can be completed without cross-zone network connectivity, eliminating the need for network gateways or other network bridging devices, and fully meeting the specifications for security zone protection in power monitoring systems. This invention employs a combination of SM2 and SM3 national cryptographic algorithms for signature verification of authorization data, ensuring the integrity, immutability, and non-forgeability of the authorization data, complying with relevant national cryptographic management regulations. Combined with a key-domain deployment architecture and a zero-key, zero-encryption front-end design on the web interface, it eliminates the risk of front-end debugging leaks at the source and prevents authorization forgery from a cryptographic perspective. This invention binds authorization information to a single-interval lock, replacing the traditional master key unlocking mode, effectively avoiding security risks such as accidental or unauthorized unlocking. A blacklist management mechanism supports immediate authorization revocation and single-use verification, preventing the repeated misuse of authorization QR codes. The unlocking and verification logic is completed entirely on the production network, without relying on network connectivity with the office business network. It can stably adapt to the complex network conditions at the substation site and can still complete authorization verification and unlocking operations normally in offline mode. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating a method for generating intelligent unlocking authorization across safety zones in a substation, according to an embodiment of the present invention.

[0020] Figure 2 This is a schematic diagram of the cross-security partition offline authorization architecture in an embodiment of the present invention.

[0021] Figure 3 This is a schematic diagram of the business process in an embodiment of the present invention. Detailed Implementation

[0022] The following description of the embodiments is taken with reference to the accompanying drawings, which illustrate specific embodiments in which the invention can be implemented.

[0023] Please refer to Figure 1 As shown, Embodiment 1 of the present invention provides a method for generating intelligent unlocking authorization across security zones in a substation. This method is applied to the first security network zone of the substation, which is physically isolated from the second security network zone used for performing on-site unlocking operations. The method includes the following steps: Obtain approved unlocking authorization information, which includes at least the target unlocking object identifier and the authorized valid time period information; The unlocking authorization information is digested using the national cryptographic hash algorithm to obtain a message digest; The message digest is digitally signed using the private key of the national cryptographic asymmetric signature algorithm pre-stored in the first secure network partition to generate signature data. The unlocking authorization information and the signature data are encoded to generate an offline authorization QR code; the offline authorization QR code is used to transmit the QR code to the second secure network partition offline, so that the unlocking verification device of the second secure network partition can complete the signature verification based on the pre-stored corresponding public key and, after passing the authorization validity verification, issue an unlocking authorization command only to the corresponding target unlocking object.

[0024] like Figure 2 As shown, this invention is applied to the security protection system of a substation power monitoring system. This system includes a first security network partition and a second security network partition that are physically isolated from each other. There are no cross-regional network data transmission channels between them, and the transmission of unlocking authorization data through network switching devices such as network gateways and forward isolation devices is prohibited. In this embodiment, the first security network partition is the office business network partition (referred to as "Zone Four" in the industry), used to handle the application, approval, and generation management of unlocking authorization; the second security network partition is the safety production five-prevention network partition (referred to as "Zone Three" in the industry), used to handle the verification and execution of on-site unlocking. The fourth zone side is equipped with a power grid management platform, a web page approval plugin, and an intranet intelligent agent; the third zone side is equipped with a barcode scanner, an intelligent unlocking host, intelligent unlocking keys corresponding to different intervals, and mechanism locks. Figure 3 As shown, the overall business process in this embodiment is divided into four stages: authorization application approval, authorization verification and code generation, offline cross-regional transmission, and on-site signature verification and unlocking. The specific implementation process is described in detail below.

[0025] 1. Authorization Application and Approval Stage This phase is entirely conducted within the four-zone office business network. Maintenance personnel log into the five-prevention management module of the power grid management platform and submit an application for the use of the anti-misoperation interlocking device through the web approval plugin. The application information includes the target substation, target bay, target interlocking device, authorized time period, operator and monitoring personnel, etc.

[0026] The power grid management platform executes a step-by-step approval process according to the preset approval workflow rules. Once the approval is approved, a formal authorization record is generated, and the process proceeds to the next stage; if the approval is rejected, the application is returned to the applicant for modification.

[0027] After an application is submitted, it undergoes hierarchical approval within the power grid management platform according to pre-defined approval workflow rules. Once logged into the platform, the web-based approval plugin automatically displays pending approval items, allowing the approver to view application details and perform approval or rejection actions. Upon successful approval, the system generates a formal authorization record and stores it persistently. The web-based approval plugin is deployed on the front-end page of the power grid management platform, handling only three interface interaction functions: application information display, code generation triggering, and authorization QR code display. It does not store any keys or run any encryption or signature algorithms, thus mitigating the risk of source code leakage at the front-end level.

[0028] 2. Authorization verification and QR code generation stage This phase will be conducted entirely within the four-zone office business network.

[0029] After approval, the five-prevention management personnel manually trigger the generation operation in the web approval plugin. The plugin calls the intranet intelligent agent deployed in the fourth zone through the intranet API to transmit the approved authorization record to the intelligent agent for verification and code generation.

[0030] After receiving the authorization record, the intranet intelligent agent performs three-dimensional compliance verification in sequence: (1) Standardization identification and correction: The station name, bay name and lock number in the application information are standardized by referring to the built-in standard code dictionary of power grid equipment. Non-standard names are automatically corrected to the unified standard code of dispatching. If automatic correction is not possible, the page plugin will prompt manual correction. (2) Frequency risk control verification: retrieve historical unlocking ledgers, count the number of times the target lock has been unlocked within the preset statistical period, and if the number exceeds the operation and maintenance control threshold, intercept the current code generation request and return a risk control warning; (3) Integrity verification: Check whether the required fields such as site identifier, interval identifier, lock identifier, and authorization validity period are complete. If any field is missing, the encryption code generation process will be terminated and the user will be prompted to complete the information.

[0031] If any of the above verifications fails, a rollback prompt will be given for correction, and the administrator will need to modify the code and trigger it again. Once all verifications pass, the process will proceed to the encryption signature and QR code generation stage.

[0032] After successful verification, the intranet agent performs the encryption and signature operation. The specific process is as follows: Assemble a standardized authorization message: Arrange the unique authorization identifier, substation standard code, bay standard code, lock code, unlocking type, effective timestamp, expiration timestamp, and operator identifier in ascending order of ASCII code by field name, and concatenate them into a standardized authorization message; Calculate the message digest: The standardized authorization message is hashed using the SM3 national cryptographic hash algorithm to generate a 256-bit hexadecimal message digest; Generate digital signature: Call the private key of the SM2 national cryptographic asymmetric signature algorithm pre-stored in the secure storage area of ​​the intranet intelligent agent to digitally sign the above message digest and generate a signature value; Offline authorization QR code generation: The authorization message, signature value, and issuing public key hash are encapsulated into a data structure and encoded to generate an offline authorization QR code in QR code format. This offline authorization QR code contains substation, time, personnel, lock information, and digital signature, and can be saved offline in print or electronic file form. It should be noted that the SM2 private key is only permanently stored within the four-zone intelligent agent, is not stored in plaintext, cannot be exported, and never leaves the four-zone security boundary.

[0033] 3. Offline cross-regional transfer stage Maintenance personnel will manually carry paper documents with QR codes printed on them, or offline terminals storing QR code images, to the substation work site on the third zone side to complete the cross-zone transfer of authorization information. This transfer process involves no network data interaction and fully complies with the security protection requirements of physical isolation between the two zones.

[0034] 4. On-site verification and unlocking execution phase This phase will be carried out entirely within the three-zone safety production network.

[0035] On-site maintenance personnel align the QR code credential with the barcode scanner, scan the QR code, and parse the encrypted raw data, transmitting the data to the smart unlocking host. The smart unlocking host then performs verification sequentially according to the following process: Data decapsulation: Decapsulate the ciphertext data input from the barcode scanner to extract the authorization message, signature value, and public key hash identifier; Public key matching: Based on the hash identifier of the issued public key, the corresponding SM2 public key is matched from the local secure storage area; the SM2 public key is pre-distributed through secure offline channels such as encrypted USB flash drives and pre-installed in the smart unlocking host. The three-zone side only stores the public key and does not store the private key, so authorization cannot be forged from a cryptographic perspective. Signature integrity verification: Reconstruct the normalized message according to the field sorting rules consistent with the fourth zone side, and recalculate the message digest locally using the SM3 algorithm; at the same time, use the matched SM2 public key to verify the signature value, and compare whether the digest restored by the signature verification is consistent with the locally recalculated digest. If they are inconsistent, the unlocking request is directly rejected. Authorization validity verification: After the signature verification passes, three verifications are performed in sequence: Time window verification: Determines whether the current system time is within the authorized effective and expiration time range; if it is outside this range, unlocking is refused. Unlock object matching verification: Verify whether the lock code in the authorization message matches the lock corresponding to the smart unlock key to be operated. If they do not match, the unlocking will be refused. Blacklist verification: Query the local blacklist database to confirm that the authorized unique identifier has not been marked as canceled or revoked. If it already exists, refuse to unlock.

[0036] After all verifications pass, the smart unlocking host executes a one-code-once verification mechanism, permanently writing the unique identifier of this authorization into the local blacklist database. Repeated scanning of the same QR code will be directly rejected. Simultaneously, it issues an unlocking permission command to the smart unlocking key in the corresponding compartment. Upon receiving the command, the smart unlocking key can only open the locks of the mechanism box specified in this authorization and cannot open locks in other compartments, achieving precise control of one authorization per compartment. After the unlocking operation is completed, the smart unlocking key returns the execution result to the smart unlocking host.

[0037] It should also be noted that the local blacklist database is only deployed on the local smart unlock host in Zone 3, and the data cancellation is not transmitted back to Zone 4, thus meeting the security constraints of physical isolation throughout the process.

[0038] 5. Key and Blacklist Maintenance Mechanism Key Management: SM2 key pairs are uniformly generated, stored, and rotated by the key management module of the four-zone intranet intelligent agents. Private keys are stored in the server hardware security module or encrypted key store, never leaving the four-zone environment. Public keys are distributed offline to each of the three-zone smart unlocking hosts via encrypted storage media and are pre-installed in the host's secure storage area. A periodic key rotation strategy is implemented; during rotation, a new key pair is generated, and the old key is set to a transitional state (retaining only verification permissions and no longer used for new signatures). The smart unlocking host synchronously updates the public key store through offline channels. A public key hash identifier is issued to distinguish different key versions, ensuring accurate matching of the corresponding public key during verification.

[0039] Blacklist Update: For issued but unused authorizations, if revocation is required, the five-defense administrator can submit a revocation application in the four-zone web approval plugin. The intranet intelligent agent will add the corresponding authorization's unique identifier to the revocation blacklist. The three-zone intelligent unlocking host can synchronize incremental blacklist data during temporary network connectivity windows; when the network is interrupted, it performs verification based on the locally cached full blacklist data to ensure that revoked authorizations cannot pass verification.

[0040] Corresponding to the intelligent unlocking authorization generation method for substations across security zones in Embodiment 1 of the present invention, Embodiment 2 of the present invention also provides an intelligent unlocking authorization generation device for substations across security zones, applied to a first security network zone of the substation, wherein the first security network zone is physically isolated from a second security network zone used for performing on-site unlocking operations, and the device includes: The information acquisition module is used to acquire the approved unlocking authorization information, which includes at least the target unlocking object identifier and the authorization validity period information; The digest operation module is used to perform a digest operation on the unlocking authorization information using the national cryptographic hash algorithm to obtain a message digest; The digital signature module is used to digitally sign the message digest using a private key of a national cryptographic asymmetric signature algorithm pre-stored in the first secure network partition, and generate signature data. The QR code generation module is used to encode the unlocking authorization information and the signature data to generate an offline authorization QR code; the offline authorization QR code is used to transmit the QR code to the second secure network partition offline, so that the unlocking verification device of the second secure network partition can complete the signature verification based on the pre-stored corresponding public key and, after passing the authorization validity verification, issue an unlocking authorization command only to the corresponding target unlocking object.

[0041] Corresponding to the intelligent unlocking authorization generation method for substations across safety zones in Embodiment 1 of the present invention, Embodiment 3 of the present invention also provides an intelligent unlocking authorization generation device for substations across safety zones, comprising: One or more processors; Memory; One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, the one or more applications being configured to execute the smart unlock authorization generation method across safety zones of the substation.

[0042] Corresponding to the intelligent unlocking authorization generation method for substations across safety zones in Embodiment 1 of the present invention, Embodiment 4 of the present invention also provides a computer program product, including computer instructions, which instruct a computer device to perform the operation corresponding to the intelligent unlocking authorization generation method for substations across safety zones.

[0043] Preferably, the processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor, or the processor can be any conventional processor. The processor is the control center of the device, connecting various parts of the device through various interfaces and lines.

[0044] The memory mainly includes a program storage area and a data storage area. The program storage area can store the operating system, applications required for at least one function, etc., while the data storage area can store related data, etc. Furthermore, the memory can be a high-speed random access memory, or a non-volatile memory, such as a plug-in hard drive, a SmartMedia Card (SMC), a Secure Digital (SD) card, and a Flash Card, or other volatile solid-state storage devices.

[0045] It should be noted that the above-mentioned devices may include, but are not limited to, processors and memory, as will be understood by those skilled in the art.

[0046] For the working principle and process of the above embodiments, please refer to the description of Embodiment 1 of the present invention, which will not be repeated here.

[0047] Compared with existing technologies, this invention has the following significant advantages: Addressing the rigid constraints of physical isolation across substation security zones, this invention uses offline QR codes as the carrier for cross-zone authorization information transmission. It completes the entire process from approval and authorization to on-site execution without requiring cross-zone network connectivity, eliminating the need for network gateways or other network bridging devices, and fully meeting the specifications for security zone protection in power monitoring systems. This invention employs a combination of SM2 and SM3 national cryptographic algorithms for signature verification of authorization data, ensuring the integrity, immutability, and non-forgeability of the authorization data, complying with relevant national cryptographic management regulations. Combined with a key-domain deployment architecture and a web-based zero-key, zero-encryption front-end design, it eliminates the risk of front-end debugging leaks at the source and prevents authorization forgery from a cryptographic perspective. This invention binds authorization information to a single-interval lock, replacing the traditional master key unlocking mode, effectively avoiding security risks such as accidental or unauthorized unlocking. A blacklist management mechanism supports immediate authorization revocation and single-use verification, preventing the repeated misuse of authorization QR codes. The unlocking and verification logic is completed entirely on the production network, without relying on network connectivity with the office business network. It can stably adapt to the complex network conditions at the substation site and can still complete authorization verification and unlocking operations normally in offline mode.

[0048] The above description is merely a preferred embodiment of the present invention and should not be construed as limiting the scope of the invention. Therefore, any equivalent variations made in accordance with the claims of the present invention are still within the scope of the present invention.

Claims

1. A method for generating intelligent unlocking authorization across security zones in a substation, applied to a first security network zone of the substation, wherein the first security network zone is physically isolated from a second security network zone used for performing on-site unlocking operations, characterized in that, The method includes the following steps: Obtain approved unlocking authorization information, which includes at least the target unlocking object identifier and the authorized valid time period information; The unlocking authorization information is digested using the national cryptographic hash algorithm to obtain a message digest; The message digest is digitally signed using the private key of the national cryptographic asymmetric signature algorithm pre-stored in the first secure network partition to generate signature data. The unlocking authorization information and the signature data are encoded to generate an offline authorization QR code; the offline authorization QR code is used to transmit the QR code to the second secure network partition offline, so that the unlocking verification device of the second secure network partition can complete the signature verification based on the pre-stored corresponding public key and, after passing the authorization validity verification, issue an unlocking authorization command only to the corresponding target unlocking object.

2. The method according to claim 1, characterized in that, After obtaining the approved unlocking authorization information and before performing digest calculation using the national cryptographic hash algorithm, the process also includes a step of performing multi-dimensional compliance verification on the unlocking authorization information. If the verification fails, the current authorization generation process will be terminated and a correction prompt message will be returned.

3. The method according to claim 2, characterized in that, The multi-dimensional compliance verification specifically includes: Standardized identification and error correction: By comparing with the built-in standard coding dictionary of power grid equipment, the equipment identifier in the unlocking authorization information is converted into a unified dispatch standard code. If automatic error correction cannot be completed, a manual correction prompt will be returned. Frequency risk control verification: retrieve historical unlocking ledger data, count the number of times the target unlocking object has been unlocked within a preset statistical period, and block the generation of this authorization if the number of times exceeds the preset operation and maintenance management threshold; Integrity verification: Check whether the required fields in the unlock authorization information are complete. If any fields are missing, terminate the authorization generation process.

4. The method according to claim 1, characterized in that, The private key of the national cryptographic asymmetric signature algorithm is permanently stored in the server-side hardware secure storage module of the first secure network partition, and is saved in an encrypted state and prohibited from being exported. The public key of the national cryptographic asymmetric signature algorithm corresponding to the private key is distributed through offline storage medium and pre-installed in the secure storage area of ​​the unlocking and verification device in the second secure network partition.

5. The method according to claim 1, characterized in that, The submission of unlock authorization information and the triggering of authorization generation are executed through a web-based approval plugin deployed in the first secure network partition; the web-based approval plugin configures the interface display unit, data transmission unit, and service interface call unit, and all encryption and signature operations are executed by the server of the first secure network partition.

6. The method according to claim 1, characterized in that, Before performing the digest operation, the data fields of the unlocking authorization information are concatenated into a standardized authorization message according to a preset sorting rule; the offline authorization QR code encapsulates the standardized authorization message, signature data, and a public key hash identifier, which is used for the unlocking verification device of the second secure network partition to match the corresponding verification public key.

7. The method according to claim 1, characterized in that, After the offline authorization QR code is transmitted to the second secure network partition, the unlocking verification device performs local offline verification: first, it completes digital signature verification and digest comparison using the matched public key, and then performs time validity verification, unlocking object matching verification, and blacklist verification in sequence; after all verifications pass, an unlocking authorization command is issued to the corresponding target unlocking object, and at the same time, the unique identifier of the authorization is recorded in the local blacklist database, which is independently deployed on the unlocking verification device in the second secure network partition.

8. A smart unlocking authorization generation device for a substation across security zones, applied to a first security network zone of the substation, wherein the first security network zone is physically isolated from a second security network zone used for performing on-site unlocking operations, characterized in that, The device includes: The information acquisition module is used to acquire the approved unlocking authorization information, which includes at least the target unlocking object identifier and the authorization validity period information; The digest operation module is used to perform a digest operation on the unlocking authorization information using the national cryptographic hash algorithm to obtain a message digest; The digital signature module is used to digitally sign the message digest using a private key of a national cryptographic asymmetric signature algorithm pre-stored in the first secure network partition, and generate signature data. The QR code generation module is used to encode the unlocking authorization information and the signature data to generate an offline authorization QR code; the offline authorization QR code is used to transmit the QR code to the second secure network partition offline, so that the unlocking verification device of the second secure network partition can complete the signature verification based on the pre-stored corresponding public key and, after passing the authorization validity verification, issue an unlocking authorization command only to the corresponding target unlocking object.

9. A smart unlocking authorization generation device for substations across safety zones, characterized in that, include: One or more processors; Memory; One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the one or more processors, the one or more applications being configured to perform the substation cross-safety zone smart unlocking authorization generation method as described in any one of claims 1 to 7.

10. A computer program product, characterized in that, It includes computer instructions that instruct computer equipment to perform operations corresponding to the intelligent unlocking authorization generation method for substations across safety zones as described in any one of claims 1 to 7.

Images