CN112073375B - An isolation device and isolation method suitable for the client side of the power Internet of Things - Google Patents

Abstract

The invention relates to an isolation device and an isolation method suitable for an electric power Internet of things client side, which are characterized in that an external network processing module is utilized to analyze a first data message sent by received external network equipment so as to acquire key information, and protocol format conversion processing is carried out on the key information according to a data ferrying protocol so as to acquire a second data message; the isolation exchange module is used for controlling the external network processing module and the internal network processing module to be in a physical isolation state, and format verification is carried out on the second data message; and after the second data message passes the format verification, the second data message is decrypted by using an intranet processing module, and the decrypted second data message is subjected to protocol format conversion processing according to a special communication protocol of the electric power Internet of things, so that a third data message is obtained and sent to intranet equipment, the safety isolation between an open client side access network and an electric power Internet of things core network is realized, and the core service system can be effectively prevented from being illegally invaded.

Description

An isolation device and isolation method suitable for the client side of the power Internet of Things

Technical field

The present invention relates to the technical field of the Internet of Things, and more specifically, to an isolation device and an isolation method suitable for the client side of the power Internet of Things.

Background technique

With the development of new technologies such as mobile Internet and artificial intelligence, the two-way interaction between power users and smart grids is becoming more and more frequent, and users have increasingly higher requirements for the service form and service quality of the power grid. In order to meet the application needs of power users and enhance their awareness and participation in smart grids, the power Internet of Things emerged. The power Internet of Things has the characteristics of comprehensive perception of operating status, efficient information processing, convenient and flexible application, etc. It connects power users and their equipment, various enterprises and equipment, as well as people and things, and generates shared data to provide users, power grids, and power enterprises with , suppliers and social services, and use the power grid as a hub to play a platform and sharing role to provide more valuable services to the entire industry and more market entities.

In order to improve the interaction between the power Internet of Things and users, it is necessary to connect a large number of safe and uncontrolled non-grid asset equipment such as charging piles and external comprehensive energy equipment to the customer side of the power Internet of Things. These devices can be connected to various electrical equipment through convenient communication methods such as WIFI to realize the collection of power consumption data and information interaction. This inevitably changes the power network from a closed service mode to an open one, leading to a direct connection between the power Internet of Things and the public network. This greatly increases the power Internet of Things' vulnerability to counterfeit terminal access, Trojans, viruses, malicious codes, etc. The risk of network attacks makes it easier for malicious individuals to invade the entire power network through the perception layer and carry out attacks and damage. Therefore, isolation devices are needed to achieve network isolation and secure data interaction between networks. However, traditional isolation equipment or systems have relatively single functions, large equipment size and power consumption, and require relatively large amounts of computing resources. Most of them are only suitable for boundary isolation of traditional networks and cannot meet the needs of low power consumption, low cost, and multi-distribution. Information security interaction requirements for client-side uncontrolled devices at the perception layer or edge layer of the power Internet of Things.

Therefore, there is an urgent need to study IoT micro-isolation technology and develop network isolation devices that can be deployed at the perception layer or edge layer of the power IoT to safely isolate the access network open to power users from the core network of the power IoT.

Contents of the invention

The present invention proposes an isolation device and an isolation method suitable for the client side of the power Internet of Things to solve the problem of how to safely isolate the open client side access network of the Internet of Things from the core network of the power Internet of Things.

In order to solve the above problems, according to one aspect of the present invention, an isolation device suitable for the client side of the power Internet of Things is provided. The device includes:

The external network processing module is used to parse the first data message sent by the received external network device to obtain key information, and perform protocol format conversion processing on the key information according to the data ferry protocol to obtain the second data message. The file is sent to the isolation switching module;

The isolation switching module is used to control the external network processing module and the internal network processing module to be in a physically isolated state, perform format verification on the second data message, and after the second data message passes the format verification, Send the second data message to the intranet processing module;

The intranet processing module is used to decrypt the second data message, and perform protocol format conversion processing on the decrypted second data message according to the power Internet of Things dedicated communication protocol to obtain the third data message and Sent to intranet device.

Preferably, the device further includes:

The internal network processing module is used to encrypt the received fourth data message sent by the device in the network, and perform protocol format conversion processing on the encrypted fourth data according to the data ferry protocol to obtain the fifth data message and Sent to isolation switching module;

The isolation switching module is used to control the external network processing module and the internal network processing module to be in a physically isolated state, perform format verification on the fifth data message, and after the fifth data message passes the format verification, Send the fifth data message to the external network processing module;

The external network processing module is configured to perform protocol format conversion processing on the fifth data message according to the communication protocol of the external network device, so as to obtain the sixth data message and send it to the external network device.

Preferably, the external network processing module further includes:

Format verification unit, used to verify whether the message format of the first data message meets the power Internet of Things access requirements; wherein, if the verification passes, the first data message is parsed; if the verification If the verification fails, the data transmission request of the external network device will be rejected;

The flow monitoring unit is used to monitor whether the data flow of the external network equipment meets the power Internet of Things access requirements and whether there is an abnormal data flow; if there is an abnormal data flow, the data transmission request of the external network equipment is rejected; if not If there is an abnormal data flow, the data transmission request of the external network device is allowed.

Preferably, the isolation switching module, controlling the external network processing module and the internal network processing module to be in a physically isolated state include:

Control the external network processing module and the internal network processing module to be in a physically disconnected state at the same time; wherein, if one of the external network processing module and the internal network processing module is performing data interaction with the logical isolation unit, then The logical isolation unit is in a disconnected state from another module. After one module performing data interaction completes the data interaction and releases the isolation control signal, the other module can perform data interaction with the logical isolation unit.

Preferably, the isolation switching module uses the following method to perform format verification, including:

Verify whether the format of the data message to be transmitted conforms to the data ferry protocol; if the format verification passes, the data message to be transmitted is transmitted; if the format verification fails, the data to be transmitted is rejected message.

Preferably, the intranet processing module further includes:

The identity recognition unit is used to obtain the identity information of the external network device to be accessed based on the decrypted second data message, and perform identity authentication based on the identity information of the external network device to be accessed; wherein, if the identity authentication is successful , then the off-network device to be accessed is allowed to access the power Internet of Things for information exchange; if the identity authentication fails, the off-network device to be accessed is denied access to the power Internet of Things for information exchange; where the key The information includes: identity information of external network devices.

Preferably, the identity recognition unit performs identity authentication based on the identity information of the external network device to be accessed, including:

According to the identity information of the external device to be accessed, the device fingerprint and the operating environment fingerprint are generated respectively according to the preset fingerprint generation strategy, and the device fingerprint and operating environment fingerprint and the preset device are admitted to the devices in the white list The fingerprint is compared with the environmental fingerprint for identity authentication; wherein, the identity information includes: device parameter information and operating environment parameter information; the device parameter information includes: MAC address, IP, communication protocol, valid Data and data format; the operating environment parameter information includes: energy consumption changes, signal strength changes and traffic changes of external network equipment.

Preferably, the intranet processing module further includes:

An access control unit, configured to perform access control on the external network device according to a preset access control policy and determine the access rights of the external network device;

A business monitoring unit is used to monitor the process in the intranet processing module, and when an abnormal event occurs, process the abnormal event in a timely manner to maintain the normal service of the intranet processing module;

Log recording unit, used to record various operation logs and communication logs;

The key certificate import unit is used to interface with the power unified cryptography infrastructure to realize the distribution of external network equipment keys and the application and issuance of digital certificates.

According to another aspect of the present invention, an isolation method suitable for the client side of the power Internet of Things is provided, and the method includes:

Parse the first data message sent by the received external network device to obtain key information, and perform protocol format conversion processing on the key information according to the data ferry protocol to obtain the second data message;

Control the external network processing module and the internal network processing module to be in a physically isolated state, and perform format verification on the second data message;

After the second data message passes the format check, the second data message is decrypted, and the decrypted second data message is converted into a protocol format according to the power Internet of Things dedicated communication protocol, so as to Obtain the third data packet and send it to the intranet device.

Preferably, the method further includes:

Encrypt the received fourth data message sent by the device in the network, and perform protocol format conversion on the encrypted fourth data according to the data ferry protocol to obtain the fifth data message;

Control the external network processing module and the internal network processing module to be in a physically isolated state, and perform format verification on the fifth data message;

After the fifth data message passes the format check, a protocol format conversion process is performed on the fifth data message according to the communication protocol of the external network device to obtain the sixth data message and send it to the external network device.

Preferably, the method further includes:

Before parsing the first data message sent by the received external network device, verify whether the message format of the first data message meets the power Internet of Things access requirements; wherein, if the verification passes, all The first data message is parsed; if the verification fails, the data transmission request of the external network device is rejected;

Monitor whether the data flow of the external network equipment meets the power Internet of Things access requirements and whether there is an abnormal data flow; if there is an abnormal data flow, the data transmission request of the external network equipment is rejected; if there is no abnormal data flow, then Allow data transmission requests from the external network device.

Preferably, the control external network processing module and the internal network processing module are in a physically isolated state, including:

Control the external network processing module and the internal network processing module to be in a physically disconnected state at the same time; wherein, if one of the external network processing module and the internal network processing module is performing data interaction with the logical isolation unit, then The logical isolation unit is in a disconnected state from another module. After one module performing data interaction completes the data interaction and releases the isolation control signal, the other module can perform data interaction with the logical isolation unit.

Preferably, the method uses the following method to perform format verification, including:

Verify whether the format of the data message to be transmitted conforms to the data ferry protocol; if the format verification passes, the data message to be transmitted is transmitted; if the format verification fails, the data to be transmitted is rejected message.

Preferably, the method further includes:

According to the decrypted second data message, the identity information of the external network device to be accessed is obtained, and identity authentication is performed based on the identity information of the external network device to be accessed; wherein, if the identity authentication is successful, the identity information of the external network device to be accessed is allowed. The connected off-network device is connected to the electric power Internet of Things for information exchange; if the identity authentication fails, the off-network device to be accessed is refused to be connected to the electric power Internet of Things for information exchange; the key information includes: external network equipment identity information.

Preferably, the identity authentication based on the identity information of the external network device to be accessed includes:

According to the identity information of the external device to be accessed, the device fingerprint and the operating environment fingerprint are generated respectively according to the preset fingerprint generation strategy, and the device fingerprint and operating environment fingerprint and the preset device are admitted to the devices in the white list The fingerprint is compared with the environmental fingerprint for identity authentication; wherein, the identity information includes: device parameter information and operating environment parameter information; the device parameter information includes: MAC address, IP, communication protocol, valid Data and data format; the operating environment parameter information includes: energy consumption changes, signal strength changes and traffic changes of external network equipment.

Preferably, the method further includes:

Perform access control on the external network device according to the preset access control policy, and determine the access rights of the external network device;

Monitor the processes in the intranet processing module, and when abnormal events occur, handle the abnormal events in a timely manner to maintain the normal service of the intranet processing module;

Record various operation logs and communication logs;

Connect with the power unified cryptography infrastructure to realize the distribution of external network device keys and the application and issuance of digital certificates.

The present invention provides an isolation device and an isolation method suitable for the client side of the power Internet of Things. The external network processing module is used to analyze the first data message sent by the received external network device to obtain key information and ferry the data according to the data flow. The protocol performs protocol format conversion processing on the key information to obtain the second data message; the isolation switching module is used to control the external network processing module and the internal network processing module to be in a physically isolated state, and format the second data message. Verification; and after the second data message passes the format verification, the intranet processing module is used to decrypt the second data message, and the decrypted second data message is processed according to the power Internet of Things dedicated communication protocol. The protocol format conversion process is performed on the document to obtain the third data message and send it to the intranet device, realizing the safe isolation of the open client-side access network and the core network of the power Internet of Things, which can effectively prevent the core business system from being illegally intruded.

Description of the drawings

A more complete understanding of exemplary embodiments of the invention may be obtained by reference to the following drawings:

Figure 1 is a schematic structural diagram of an isolation device 100 suitable for the client side of the power Internet of Things according to an embodiment of the present invention;

Figure 2 is a logical architecture diagram of a network isolation device according to an embodiment of the present invention;

Figure 3 is a flow chart of identity authentication according to an embodiment of the present invention;

Figure 4 is a read and write logic diagram of an isolation device according to an embodiment of the present invention;

Figure 5 is a schematic diagram of application layer data exchange based on the transparent proxy mode according to an embodiment of the present invention;

Figure 6 is a flow chart of an isolation method 600 suitable for the client side of the power Internet of Things according to an embodiment of the present invention.

Detailed ways

Exemplary embodiments of the present invention will now be described with reference to the accompanying drawings. However, the present invention may be embodied in many different forms and is not limited to the embodiments described herein. These embodiments are provided so that this disclosure will be thorough and complete. invention, and fully convey the scope of the invention to those skilled in the art. The terminology used in the exemplary embodiments represented in the drawings does not limit the invention. In the drawings, identical units/elements use the same reference numerals.

Unless otherwise defined, the terms (including scientific and technical terms) used herein have the commonly understood meaning to one of ordinary skill in the art. In addition, it is understood that terms defined in commonly used dictionaries should be understood to have consistent meanings in the context of their relevant fields and should not be understood as having an idealized or overly formal meaning.

Figure 1 is a schematic structural diagram of an isolation device 100 suitable for the client side of the power Internet of Things according to an embodiment of the present invention. As shown in Figure 1, the isolation device suitable for the client side of the power Internet of Things provided by the present invention realizes the safe isolation of the open client-side access network and the core network of the power Internet of Things, and can effectively prevent the core business system from being illegally intruded. The isolation device 100 provided by the embodiment of the present invention and suitable for the client side of the power Internet of Things includes: an external network processing module 101, an isolation switching module 102 and an internal network processing module 103.

Preferably, the external network processing module 101 is used to parse the first data message sent by the received external network device to obtain key information, and perform protocol format conversion processing on the key information according to the data ferry protocol, To obtain the second data packet and send it to the isolation switching module.

Preferably, the external network processing module 101 also includes:

Format verification unit, used to verify whether the message format of the first data message meets the power Internet of Things access requirements; wherein, if the verification passes, the first data message is parsed; if the verification If the verification fails, the data transmission request of the external network device will be rejected;

The flow monitoring unit is used to monitor whether the data flow of the external network equipment meets the power Internet of Things access requirements and whether there is an abnormal data flow; if there is an abnormal data flow, the data transmission request of the external network equipment is rejected; if not If there is an abnormal data flow, the data transmission request of the external network device is allowed.

Figure 2 is a logical architecture diagram of a micro network isolation device according to an embodiment of the present invention. As shown in Figure 2, in the embodiment of the present invention, the external network processing module includes: an external network communication sub-module and an external network service processing sub-module.

Among them, the external network communication sub-module includes: HPLC interface unit, WIFI interface unit and external Ethernet interface unit; external network equipment can achieve network access through WIFI, HPLC and Ethernet.

Among them, the external network business processing sub-module mainly includes an external network data transceiver unit, a format verification unit, a traffic monitoring unit, an external network protocol conversion unit and an external network upgrade management unit. The external network data transceiver unit is used to receive the first data message sent by the external network device. The format verification unit is used to verify whether the message format of the first data message meets the power Internet of Things access requirements; wherein, if the verification passes, the first data message is parsed; if the verification If it does not pass, the data transmission request of the external network device is rejected. The flow monitoring unit is used to monitor whether the data flow of the external network equipment meets the power Internet of Things access requirements and whether there is an abnormal data flow; if there is an abnormal data flow, the data transmission request of the external network equipment is rejected; if not If there is an abnormal data flow, the data transmission request of the external network device is allowed. The external network protocol conversion unit is used to parse the first data message to obtain key information, perform transport layer protocol processing on the key information and encapsulate the key information according to the data ferry protocol to obtain The second data packet is sent to the isolation switching module. Among them, the key information includes: device MAC information, IP address, valid instruction data sent by the device and other information. The data message format before protocol conversion processing conforms to the communication protocol of the external network device, and the data after protocol conversion processing conforms to the data ferry protocol. The external network upgrade management unit is mainly responsible for upgrading and maintaining the software of the external network processing module.

Preferably, the isolation switching module 102 is used to control the external network processing module and the internal network processing module to be in a physically isolated state, perform format verification on the second data message, and perform a format check on the second data message. After passing the format check, the second data message is sent to the intranet processing module.

Preferably, the isolation switching module 102 controls the external network processing module and the internal network processing module to be in a physically isolated state, including:

Control the external network processing module and the internal network processing module to be in a physically disconnected state at the same time; wherein, if one of the external network processing module and the internal network processing module is performing data interaction with the logical isolation unit, then The logical isolation unit is in a disconnected state from another module. After one module performing data interaction completes the data interaction and releases the isolation control signal, the other module can perform data interaction with the logical isolation unit.

Preferably, the isolation switching module uses the following method to perform format verification, including:

Verify whether the format of the data message to be transmitted conforms to the data ferry protocol; if the format verification passes, the data message to be transmitted is transmitted; if the format verification fails, the data to be transmitted is rejected message.

As shown in Figure 2, in the embodiment of the present invention, the isolation switching module includes: an isolation switching main controller MCU and a network isolation sub-module; the network isolation sub-module includes: a logical isolation unit and a data switching unit.

Among them, the external network processing module and the internal network processing module are controlled by the logical isolation unit to process the physical isolation status, and the data exchange module is used to perform format verification on the second data message and the second data message passes the format verification. Finally, the operation of sending the second data message to the intranet processing module completes the data transmission. Among them, the logical isolation unit in the isolation switching module is used to control the external network processing module and the internal network processing module to be in a physically disconnected state at the same time; wherein, if one of the external network processing module and the internal network processing module The module is performing data interaction with the logical isolation unit, and the logical isolation unit is in a disconnected state from another module. After one module performing data interaction completes the data interaction and releases the isolation control signal, the other module can communicate with the logical isolation unit. Isolate units for data interaction. When verifying whether the format of the second data message conforms to the data ferry protocol, if the format verification passes, the data message to be transmitted is transmitted; if the format verification fails, the data message to be transmitted is rejected. arts.

Among them, the isolation switching main controller MCU includes at least three CPUs, two of which are used to process intranet services and external network services respectively, and the other CPU is used to manage system configuration and security policy settings.

Preferably, the intranet processing module 103 is used to decrypt the second data message, and perform protocol format conversion on the decrypted second data message according to the power Internet of Things dedicated communication protocol to obtain The third data message is sent to the intranet device.

Preferably, the intranet processing module further includes:

The identity recognition unit is used to obtain the identity information of the external network device to be accessed based on the decrypted second data message, and perform identity authentication based on the identity information of the external network device to be accessed; wherein, if the identity authentication If successful, the off-network device to be accessed is allowed to access the power Internet of Things for information exchange; if the identity authentication fails, the off-network device to be accessed is denied access to the power Internet of Things for information exchange; wherein the Key information includes: identity information of external network devices.

Preferably, the identity recognition unit performs identity authentication based on the identity information of the external network device to be accessed, including:

According to the identity information of the external device to be accessed, the device fingerprint and the operating environment fingerprint are generated respectively according to the preset fingerprint generation strategy, and the device fingerprint and operating environment fingerprint and the preset device are admitted to the devices in the white list The fingerprint is compared with the environmental fingerprint for identity authentication; wherein, the identity information includes: device parameter information and operating environment parameter information; the device parameter information includes: MAC address, IP, communication protocol, valid Data and data format; the operating environment parameter information includes: energy consumption changes, signal strength changes and traffic changes of external network equipment.

Preferably, the intranet processing module further includes:

An access control unit, configured to perform access control on the external network device according to a preset access control policy and determine the access rights of the external network device;

A business monitoring unit is used to monitor the process in the intranet processing module, and when an abnormal event occurs, process the abnormal event in a timely manner to maintain the normal service of the intranet processing module;

Log recording unit, used to record various operation logs and communication logs;

The key certificate import unit is used to interface with the power unified cryptography infrastructure to realize the distribution of external network equipment keys and the application and issuance of digital certificates.

As shown in Figure 2, in the embodiment of the present invention, the intranet processing module includes: an intranet communication sub-module, a cryptographic operation sub-module and an intranet business processing sub-module. Among them, the intranet communication sub-module includes: power private network interface unit and intranet Ethernet interface unit. The cryptographic operation sub-module includes: key management unit and algorithm operation unit. The intranet business processing sub-module includes: intranet data transceiver unit, intranet protocol conversion unit, identity recognition unit, business monitoring unit, access control unit, key certificate import unit, log recording unit and intranet upgrade management unit.

In the embodiment of the present invention, the key management unit is responsible for the security management of the entire life cycle of the key. The algorithm operation unit is used to perform operations on national secret cryptographic algorithms such as SM1, SM2, SM3, SM4, SM7 and SM9, and decrypt the second data message to obtain the decrypted second data message. After receiving the second message data sent by the isolation switching module through the intranet data transceiver module, the intranet processing module decrypts the second data message through the algorithm operation module, and uses the intranet protocol conversion unit to communicate according to the power Internet of Things dedicated The protocol performs protocol format conversion processing on the decrypted second data message to obtain the third data message, and uses the intranet data transceiver unit to send the protocol converted and encapsulated third data message to the intranet device. Among them, the data message format before protocol conversion processing conforms to the data ferry protocol; the data after protocol conversion processing conforms to the power Internet of Things dedicated communication protocol. In addition, the internal network processing module also uses the identity recognition unit to perform identity authentication based on the identity information of the external network device to be accessed; if the identity authentication is successful, the external network device to be included is allowed to access; if the identity authentication If it fails, access to the external network device to be accessed is denied. Specifically, the identity authentication process is shown in Figure 3, including:

(1) The sensing device or user electrical device sends its MAC, IP, communication protocol _Pr , valid data _Dv , data format _Df and other device parameter information to the intranet processing module. The intranet processing module analyzes its legality and validity. If it meets the Internet of Things environment access requirements, it forms a "device fingerprint" D _fp and feeds the verification results back to the sensing device or user electrical equipment.

(2) The sensing device or user electrical device sends environmental parameter information such as energy consumption change Ec, signal strength change Sc, traffic change Fc, etc. to the intranet processing module. The isolation device generates the "operating environment fingerprint" E _fp and feeds back the received results to the sensing device or the user's electrical equipment.

(3) The intranet processing module transmits the collected fingerprint information to the background centralized management platform and establishes a sensing device access whitelist W _l .

(4) When the device to be accessed is connected to the isolation device through WIFI, HPLC or Ethernet, the internal network processing module will again generate fingerprints based on the identity information of the device to be accessed outside the network according to the preset fingerprint generation strategy. Device fingerprints and operating environment fingerprints, and comparing the device fingerprints and operating environment fingerprints with the device fingerprints and environment fingerprints in the preset device admission whitelist for identity authentication; wherein the identity information includes: Equipment parameter information and operating environment parameter information.

The isolation device in the embodiment of the present invention mainly implements business data/instruction encryption protection through two-way identity authentication, data encryption encapsulation and data integrity verification. The two-way identity authentication process is: using national cryptographic algorithms such as SM1, SM2 and SM3, and conducting two-way identity authentication with the main station business application system based on mechanisms such as challenge response and digital certificate signature verification. The data encryption and encapsulation process is: encapsulation and data encryption of business data and control instructions based on a dedicated secure communication protocol for the power Internet of Things. The data integrity verification process is to ensure the integrity of business data and control instructions through message authentication code, digital signature and data timeliness verification.

In an embodiment of the present invention, the access control unit is configured to perform access control on the external network device according to a preset access control policy and determine the access rights of the external network device. The intranet upgrade management unit is used to upgrade and maintain the software of the intranet processing module. The key certificate import unit is responsible for connecting with the power unified cryptography infrastructure to realize the distribution of external network equipment keys and the application and issuance of digital certificates. The logging unit is used to record various operation logs, communication logs and other information for subsequent analysis and traceability.

Preferably, the device further includes:

The internal network processing module is used to encrypt the received fourth data message sent by the device in the network, and perform protocol format conversion processing on the encrypted fourth data according to the data ferry protocol to obtain the fifth data message and Sent to isolation switching module;

The isolation switching module is used to control the external network processing module and the internal network processing module to be in a physically isolated state, perform format verification on the fifth data message, and after the fifth data message passes the format verification, Send the fifth data message to the external network processing module;

The external network processing module is configured to perform protocol format conversion processing on the fifth data message according to the communication protocol of the external network device, so as to obtain the sixth data message and send it to the external network device.

In the embodiment of the present invention, when transmitting data from the internal network to the external network, the internal network processing module is also used to use the algorithm operation unit to encrypt the received fourth data message sent by the device in the network, and use The intranet protocol conversion unit performs protocol format conversion processing on the encrypted fourth data according to the data ferry protocol of the isolation switching module to obtain the fifth data message, and sends it to the isolation switching module using the intranet data transceiver unit. Among them, the data messages before the protocol conversion process conform to the special communication protocol of the power Internet of Things, and the data messages after the protocol conversion process conform to the data ferry protocol of the isolation switching module. The isolation switching module is also used to control the external network processing module and the internal network processing module to be in a physically isolated state, perform format verification on the fifth data message, and after the fifth data message passes the format verification , sending the fifth data message to the external network processing module. The external network processing module is also configured to use the external network protocol conversion unit to perform protocol format conversion processing on the fifth data message according to the communication protocol of the external network device, so as to obtain the sixth data message and send it using the external network data transceiver unit. to external network equipment. Among them, the data packet before protocol conversion processing conforms to the data ferry protocol; the data packet after protocol conversion processing conforms to the communication protocol of the external network device.

Figure 4 is a read and write logic diagram of an isolation device according to an embodiment of the present invention. As shown in Figure 4, the isolation device in the embodiment of the present invention mainly uses independent internal and external network read and write channels and an information ferry mechanism to achieve safe isolation and information security interaction between internal and external networks. The objects exchanged between the internal and external network processing modules are not IP data messages, but application layer data messages encapsulated by a dedicated internal protocol. It is impossible for any original IP data message to pass through this channel. The isolation device shown can completely disconnect two networks or hosts at the physical layer of the network, ensuring that it is responsible for "ferrying" safe network data when the external network interface and the internal network interface are physically disconnected at the same time. If one end of the network exchanges data through the isolation device, the isolation device and the other end of the network are disconnected. After the end has completed data interaction and released the isolation control signal, the other end can interact with the isolation device. The data at both ends will be stored in the buffer of the isolation device. Check the status before writing to the buffer. If the status allows, write the data to the buffer, otherwise wait. Check the status before reading the buffer. Read the data in the buffer if the status allows, otherwise wait. The specific data reading and writing process is: If the internal network processing module and the external network processing module want to send data from one end of the network to the other end of the network, the data will be written to the sending FIFO module. At this time, the FIFO receiving module will be closed, and only the writing channel is connected. status; if data is to be read from another processing unit, the data will be written to the FIFO receiving module, and the FIFO sending module will be closed at this time, and only the reading channel is in the connected state.

Figure 5 is a schematic diagram of application layer data exchange based on the transparent proxy mode according to an embodiment of the present invention. As shown in Figure 5, in the embodiment of the present invention, the isolation device mainly uses the transparent proxy mode to implement application layer data exchange. The transparent proxy includes two parts: a proxy engine and a proxy stub, which are respectively located on different network processing units. The proxy stub is mainly used for network connection request inspection. The proxy engine is mainly used to call the transmission interface and exchange the information returned by the external network to the network processing unit through the high-speed switching channel. The agent engine and agent stub perform dialogue and data communication based on high-speed switching channels and dedicated protocols.

In terms of data confidentiality and integrity protection, the isolation device according to the embodiment of the present invention mainly implements business data/instruction encryption protection through two-way identity authentication, data encryption encapsulation and data integrity verification. The two-way identity authentication process is: using national cryptographic algorithms such as SM1, SM2 and SM3, and conducting two-way identity authentication with the main station business application system based on mechanisms such as challenge response and digital certificate signature verification. The data encryption and encapsulation process is: encapsulation and data encryption of business data and control instructions based on a dedicated secure communication protocol for the power Internet of Things. The data integrity verification process is to ensure the integrity of business data and control instructions through message authentication code, digital signature and data timeliness verification.

The isolation device in the embodiment of the present invention realizes the safe isolation of the open client-side access network and the core network of the power Internet of Things, and can effectively prevent the core business system from being illegally invaded.

Figure 6 is a flow chart of an isolation method 600 suitable for the client side of the power Internet of Things according to an embodiment of the present invention. As shown in Figure 6, the isolation method 600 provided by the embodiment of the present invention and suitable for the client side of the power Internet of Things starts from step 601. In step 601, the first data message sent by the received external network device is parsed to Obtain key information, and perform protocol format conversion processing on the key information according to the data ferry protocol to obtain the second data message.

Preferably, the method further includes:

Before parsing the first data message sent by the received external network device, verify whether the message format of the first data message meets the power Internet of Things access requirements; wherein, if the verification passes, all The first data message is parsed; if the verification fails, the data transmission request of the external network device is rejected;

Monitor whether the data flow of the external network equipment meets the power Internet of Things access requirements and whether there is an abnormal data flow; if there is an abnormal data flow, the data transmission request of the external network equipment is rejected; if there is no abnormal data flow, then Allow data transmission requests from the external network device.

In step 602, control the external network processing module and the internal network processing module to be in a physically isolated state, and perform format verification on the second data message.

In step 603, after the second data message passes the format check, the second data message is decrypted, and the decrypted second data message is formatted according to the power Internet of Things dedicated communication protocol. Conversion processing to obtain the third data packet and send it to the intranet device.

Preferably, the method further includes:

According to the decrypted second data message, the identity information of the external network device to be accessed is obtained, and identity authentication is performed based on the identity information of the external network device to be accessed; wherein, if the identity authentication is successful, the identity information of the external network device to be accessed is allowed. The connected off-network device is connected to the electric power Internet of Things for information exchange; if the identity authentication fails, the off-network device to be accessed is refused to be connected to the electric power Internet of Things for information exchange; the key information includes: external network equipment identity information.

Preferably, the identity authentication based on the identity information of the external network device to be accessed includes:

According to the identity information of the external device to be accessed, the device fingerprint and the operating environment fingerprint are generated respectively according to the preset fingerprint generation strategy, and the device fingerprint and operating environment fingerprint and the preset device are admitted to the devices in the white list The fingerprint is compared with the environmental fingerprint for identity authentication; wherein, the identity information includes: device parameter information and operating environment parameter information; the device parameter information includes: MAC address, IP, communication protocol, valid Data and data format; the operating environment parameter information includes: energy consumption changes, signal strength changes and traffic changes of external network equipment.

Preferably, the method further includes:

Encrypt the received fourth data message sent by the device in the network, and perform protocol format conversion on the encrypted fourth data according to the data ferry protocol to obtain the fifth data message;

Control the external network processing module and the internal network processing module to be in a physically isolated state, and perform format verification on the fifth data message;

After the fifth data message passes the format check, a protocol format conversion process is performed on the fifth data message according to the communication protocol of the external network device to obtain the sixth data message and send it to the external network device.

Preferably, the control external network processing module and the internal network processing module are in a physically isolated state, including:

Control the external network processing module and the internal network processing module to be in a physically disconnected state at the same time; wherein, if one of the external network processing module and the internal network processing module is performing data interaction with the logical isolation unit, then The logical isolation unit is in a disconnected state from another module. After one module performing data interaction completes the data interaction and releases the isolation control signal, the other module can perform data interaction with the logical isolation unit.

Preferably, the method uses the following method to perform format verification, including:

Verify whether the format of the data message to be transmitted conforms to the data ferry protocol; if the format verification passes, the data message to be transmitted is transmitted; if the format verification fails, the data to be transmitted is rejected message.

Preferably, the method further includes:

Perform access control on the external network device according to the preset access control policy, and determine the access rights of the external network device;

Monitor the processes in the intranet processing module, and when abnormal events occur, handle the abnormal events in a timely manner to maintain the normal service of the intranet processing module;

Record various operation logs and communication logs;

Connect with the power unified cryptography infrastructure to realize the distribution of external network device keys and the application and issuance of digital certificates.

The isolation method 600 suitable for the client side of the electric power Internet of Things in the embodiment of the present invention corresponds to the isolation device 100 suitable for the client side of the electric power Internet of Things according to another embodiment of the present invention, and will not be described again here.

The invention has been described with reference to a few embodiments. However, it is known to those skilled in the art that other embodiments than those disclosed above are equally within the scope of the present invention.

Generally, all terms used are to be interpreted according to their ordinary meaning in the technical field, unless otherwise expressly defined therein. All references to "a/the/the [means, component, etc.]" are to be construed openly to mean at least one instance of the said means, component, etc., unless expressly stated otherwise. The steps of any method disclosed herein are not necessarily performed in the exact order disclosed unless explicitly stated.

Those skilled in the art will understand that embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions executed by the processor of the computer or other programmable data processing device produce a use A device for realizing the functions specified in one process or multiple processes of the flowchart and/or one block or multiple blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions The device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device. Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that the present invention can still be modified. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention shall be included in the protection scope of the present invention.

Claims (8)

1. An isolation device suitable for the client side of the power Internet of Things, characterized in that the device includes: The external network processing module is used to parse the first data message sent by the received external network device to obtain key information, and perform protocol format conversion processing on the key information according to the data ferry protocol to obtain the second data message. The file is sent to the isolation switching module; The isolation switching module is used to control the external network processing module and the internal network processing module to be in a physically isolated state, perform format verification on the second data message, and after the second data message passes the format verification, Send the second data message to the intranet processing module; The intranet processing module is used to decrypt the second data message, and perform protocol format conversion processing on the decrypted second data message according to the power Internet of Things dedicated communication protocol to obtain the third data message and Send to intranet device; Wherein, the device also includes: The intranet processing module is used to encrypt the received fourth data message sent by the intranet device, and perform protocol format conversion processing on the encrypted fourth data according to the data ferry protocol to obtain the fifth data message and Sent to isolation switching module; The isolation switching module is used to control the external network processing module and the internal network processing module to be in a physically isolated state, perform format verification on the fifth data message, and after the fifth data message passes the format verification, Send the fifth data message to the external network processing module; The external network processing module is used to perform protocol format conversion processing on the fifth data message according to the communication protocol of the external network device, so as to obtain the sixth data message and send it to the external network device; Among them, the intranet processing module also includes: The identity recognition unit is used to obtain the identity information of the external network device to be accessed based on the decrypted second data message, and perform identity authentication based on the identity information of the external network device to be accessed; wherein, if the identity authentication is successful , then the external network device to be accessed is allowed to access the power Internet of Things for information exchange; if the identity authentication fails, the external network device to be accessed is denied access to the power Internet of Things for information exchange; where the key The information includes: identity information of external network devices; The identity authentication process includes: (1) The sensing device or user electrical device sends its MAC, IP, communication protocol P _r , valid data D _v and data format D _f device parameter information to the intranet processing module; the intranet processing module analyzes its legality and validity , if it meets the Internet of Things environment access requirements, form a "device fingerprint" D _fp and feed back the verification results to the sensing device or user electrical equipment; (2) The sensing device or user electrical equipment sends the environmental parameter information of energy consumption change Ec, signal strength change Sc, and flow change Fc to the intranet processing module; the isolation device generates the "operating environment fingerprint" E _fp and feeds back the received results. to sensing devices or user electrical devices; (3) The intranet processing module transmits the collected fingerprint information to the background centralized management platform, and establishes a sensing device access whitelist W _l ; (4) When the device to be accessed is connected to the isolation device through WIFI, HPLC or Ethernet, the internal network processing module will again generate fingerprints based on the identity information of the external network device to be accessed according to the preset fingerprint generation strategy. Device fingerprints and operating environment fingerprints, and comparing the device fingerprints and operating environment fingerprints with the device fingerprints and environment fingerprints in the preset device admission whitelist for identity authentication; wherein the identity information includes: Equipment parameter information and operating environment parameter information; Wherein, the identity recognition unit performs identity authentication based on the identity information of the external network device to be accessed, including: According to the identity information of the external network device to be accessed according to the preset fingerprint generation strategy, the device fingerprint and the operating environment fingerprint are respectively generated, and the device fingerprint and operating environment fingerprint and the preset device are admitted to the devices in the white list The fingerprint is compared with the environmental fingerprint for identity authentication; wherein, the identity information includes: device parameter information and operating environment parameter information; the device parameter information includes: MAC address, IP, communication protocol, valid Data and data format; the operating environment parameter information includes: energy consumption changes, signal strength changes and traffic changes of external network equipment; Among them, the isolation switching module controls the external network processing module and the internal network processing module to be in a physically isolated state, including: Control the external network processing module and the internal network processing module to be in a physically disconnected state at the same time; wherein, if one of the external network processing module and the internal network processing module is performing data interaction with the logical isolation unit, then The logical isolation unit is in a disconnected state from another module. After one module performing data interaction completes the data interaction and releases the isolation control signal, the other module can perform data interaction with the logical isolation unit. 2. The device according to claim 1, characterized in that the external network processing module further includes: Format verification unit, used to verify whether the message format of the first data message meets the power Internet of Things access requirements; wherein, if the verification passes, the first data message is parsed; if the verification If the verification fails, the data transmission request of the external network device will be rejected; The flow monitoring unit is used to monitor whether the data flow of the external network equipment meets the power Internet of Things access requirements and whether there is an abnormal data flow; if there is an abnormal data flow, the data transmission request of the external network equipment is rejected; if not If there is an abnormal data flow, the data transmission request of the external network device is allowed. 3. The device according to claim 1, wherein the isolation switching module performs format verification in the following manner, including: Verify whether the format of the data message to be transmitted conforms to the data ferry protocol; if the format verification passes, the data message to be transmitted is transmitted; if the format verification fails, the data to be transmitted is rejected message. 4. The device according to claim 1, characterized in that the intranet processing module further includes: An access control unit, configured to perform access control on the external network device according to a preset access control policy and determine the access rights of the external network device; A business monitoring unit is used to monitor the process in the intranet processing module, and when an abnormal event occurs, process the abnormal event in a timely manner to maintain the normal service of the intranet processing module; Log recording unit, used to record various operation logs and communication logs; The key certificate import unit is used to interface with the power unified cryptography infrastructure to realize the distribution of external network equipment keys and the application and issuance of digital certificates. 5. An isolation method suitable for the client side of the power Internet of Things, characterized in that the method includes: Parse the first data message sent by the received external network device to obtain key information, and perform protocol format conversion processing on the key information according to the data ferry protocol to obtain the second data message; Control the external network processing module and the internal network processing module to be in a physically isolated state, and perform format verification on the second data message; After the second data message passes the format check, the second data message is decrypted, and the decrypted second data message is converted into a protocol format according to the power Internet of Things dedicated communication protocol, so as to Obtain the third data packet and send it to the intranet device; Wherein, the method also includes: Encrypt the received fourth data message sent by the internal network device, and perform protocol format conversion on the encrypted fourth data according to the data ferry protocol to obtain the fifth data message; Control the external network processing module and the internal network processing module to be in a physically isolated state, and perform format verification on the fifth data message; After the fifth data message passes the format check, perform protocol format conversion processing on the fifth data message according to the communication protocol of the external network device to obtain the sixth data message and send it to the external network device; Wherein, the method also includes: According to the decrypted second data message, the identity information of the external network device to be accessed is obtained, and the identity is authenticated based on the identity information of the external network device to be accessed; wherein, if the identity authentication is successful, the The external network equipment to be accessed is connected to the electric power Internet of Things for information exchange; if the identity authentication fails, the external network equipment to be accessed is refused to be connected to the electric power Internet of Things for information exchange; the key information includes: external network Identity information of the device; The identity authentication process includes: (1) The sensing device or user electrical device sends its MAC, IP, communication protocol P _r , valid data D _v and data format D _f device parameter information to the intranet processing module; the intranet processing module analyzes its legality and validity , if it meets the Internet of Things environment access requirements, form a "device fingerprint" D _fp and feed back the verification results to the sensing device or user electrical equipment; (2) The sensing device or user electrical equipment sends the environmental parameter information of energy consumption change Ec, signal strength change Sc, and flow change Fc to the intranet processing module; the isolation device generates the "operating environment fingerprint" E _fp and feeds back the received results. to sensing devices or user electrical devices; (3) The intranet processing module transmits the collected fingerprint information to the background centralized management platform, and establishes a sensing device access whitelist W _l ; (4) When the device to be accessed is connected to the isolation device through WIFI, HPLC or Ethernet, the internal network processing module will again generate fingerprints based on the identity information of the external network device to be accessed according to the preset fingerprint generation strategy. Device fingerprints and operating environment fingerprints, and comparing the device fingerprints and operating environment fingerprints with the device fingerprints and environment fingerprints in the preset device admission whitelist for identity authentication; wherein the identity information includes: Equipment parameter information and operating environment parameter information; Among them, the identity authentication based on the identity information of the external network device to be accessed includes: According to the identity information of the external network device to be accessed according to the preset fingerprint generation strategy, the device fingerprint and the operating environment fingerprint are respectively generated, and the device fingerprint and operating environment fingerprint and the preset device are admitted to the devices in the white list The fingerprint is compared with the environmental fingerprint for identity authentication; wherein, the identity information includes: device parameter information and operating environment parameter information; the device parameter information includes: MAC address, IP, communication protocol, valid Data and data format; the operating environment parameter information includes: energy consumption changes, signal strength changes and traffic changes of external network equipment; Wherein, the control external network processing module and the internal network processing module are in a physically isolated state, including: Control the external network processing module and the internal network processing module to be in a physically disconnected state at the same time; wherein, if one of the external network processing module and the internal network processing module is performing data interaction with the logical isolation unit, then The logical isolation unit is in a disconnected state from another module. After one module performing data interaction completes the data interaction and releases the isolation control signal, the other module can perform data interaction with the logical isolation unit. 6. The method according to claim 5, characterized in that the method further comprises: before parsing the first data message sent by the external network device, verifying the first data message. Whether the text format meets the power Internet of Things access requirements; wherein, if the verification passes, the first data message is parsed; if the verification fails, the data transmission request of the external network device is rejected; Monitor whether the data flow of the external network equipment meets the power Internet of Things access requirements and whether there is an abnormal data flow; if there is an abnormal data flow, the data transmission request of the external network equipment is rejected; if there is no abnormal data flow, then Allow data transmission requests from the external network device. 7. The method according to claim 5, characterized in that the method uses the following methods to perform format verification, including: Verify whether the format of the data message to be transmitted conforms to the data ferry protocol; if the format verification passes, the data message to be transmitted is transmitted; if the format verification fails, the data to be transmitted is rejected message. 8. The method according to claim 5, characterized in that, the method further comprises: Perform access control on the external network device according to the preset access control policy, and determine the access rights of the external network device; Monitor the processes in the intranet processing module, and when abnormal events occur, handle the abnormal events in a timely manner to maintain the normal service of the intranet processing module; Record various operation logs and communication logs; Connect with the power unified cryptography infrastructure to realize the distribution of external network device keys and the application and issuance of digital certificates.