A passive unidirectional data relay system across network regions

Abstract

The application discloses a passive one-way data relay system across network areas and relates to the technical field of data relay across network areas.The system comprises a first local area network, a second local area network and an isolation gateway; a data acquisition module, an encryption module and a sending module are arranged in the first local area network; a transmission relay module is arranged in the isolation gateway; a receiving module and an external network database are arranged in the second local area network; the data security and reversibility are ensured through graphical encryption technology in the first local area network; efficient and reliable data relay is realized through physical isolation and intelligent transmission optimization in the isolation gateway; the data integrity and availability are ensured through accurate decryption in the second local area network; the three work together to realize efficient, reliable and one-way transmission of power operation and maintenance data under the condition of strict security isolation, and effectively balance the contradiction between network security and transmission efficiency.

Description

Technical Field

[0001] This invention relates to the field of cross-network area data relay technology, and in particular to a passive one-way data relay system across network areas. Background Technology

[0002] While traditional firewalls and network gateways are security devices, they are based on allow or deny policies and essentially establish a two-way communication channel, which is vulnerable to being bypassed by advanced network attacks. Passive one-way data transmission, on the other hand, can effectively prevent reverse communication from the physical level or the protocol layer. Therefore, passive one-way data transmission is an important high-guarantee isolation method and is essential for data transmission in critical fields (such as the power industry).

[0003] While current passive one-way data transmission can transmit data from the first local area network to the second local area network to isolate network attacks, there is still a risk of data transfer if the second local area network environment is insecure, leading to the risk of data exposure. Summary of the Invention

[0004] Therefore, it is necessary to provide a passive one-way data relay system across network regions to address the problems mentioned in the background technology.

[0005] The objective of this invention can be achieved through the following technical solutions:

[0006] A passive one-way data relay system spanning network regions includes: a first local area network, a second local area network, and an isolation gateway;

[0007] The first local area network is used to collect real-time power operation and maintenance data, encrypt it into ciphertext, and transmit it to the isolation network gate;

[0008] The isolation gateway is used to receive encrypted messages and relay them to a second local area network.

[0009] The second local area network receives ciphertext from the isolation gateway and decrypts it to obtain the original power operation and maintenance data.

[0010] In some embodiments, the first local area network is used to collect real-time generated power operation and maintenance data, encrypt it to form ciphertext, and transmit it to the isolation gateway:

[0011] The first local area network has a built-in data acquisition module, encryption module, and transmission module;

[0012] The data acquisition module is used to collect real-time generated power operation and maintenance data, package it into data packets, and send the data packets to the encryption module;

[0013] The encryption module performs graphical encryption on the data packet to form ciphertext, and then sends it to the sending module.

[0014] The sending module is used to send encrypted messages to the isolation gateway.

[0015] In some embodiments, graphic encryption forms ciphertext:

[0016] 301. Extract the data packet, parse the power operation and maintenance data in the data packet into binary, and then divide the binary data into data blocks of fixed length m, where m is a positive integer. Convert each binary data block into a decimal numerical sequence.

[0017] 302. Normalize each value in the decimal value sequence to convert the decimal value sequence into a mapping data block, thereby splitting the data packet into several mapping data blocks; the normalization is to select the maximum value in the decimal value sequence and then divide each value in the selected decimal value sequence by the maximum value M.

[0018] 303. Construct a polar coordinate system with the center of the canvas as the origin, defining the polar radius range and angle range. The polar radius range is 0 - Rmax = 0; the angle range is 0 - 2π. Map the first (m / 2) values ​​in each mapped data block to angles, i.e., multiply the values ​​by 2π to obtain the polar angle θ. Map the last (m / 2) values ​​in the mapped data block to radius R, i.e., multiply the values ​​by Rmax to obtain the polar radius R. Then pair the angles and radii one by one in sequence to form (m / 2) polar coordinate points (R, θ). Thus, each mapped data block is transformed into (m / 2) polar coordinate points, and each polar coordinate is transformed into Cartesian coordinates (x, y), specifically x = R × cos(θ), y = R × sin(θ), forming a set of (m / 2) discrete points.

[0019] 304. Based on the discrete point set, the convex hull algorithm is used to output the minimum convex hull indicator map corresponding to each discrete point set. Then, the minimum convex hull indicator map of all mapped data blocks of the data packet is used again to obtain the ciphertext.

[0020] In some embodiments, the process of outputting the minimum convex hull indicator graph is as follows:

[0021] The points of the discrete point set are plotted in Cartesian coordinates. Then, the minimum convex hull containing all the discrete points is drawn based on the convex hull algorithm. The discrete points in the minimum convex hull are connected sequentially in Cartesian coordinate order to obtain the minimum convex hull indicator map. For any finite set of points on the plane, there exists one and only one minimum convex polygon that contains all these discrete points. Therefore, the minimum convex hull indicator map is unique and definite. Thus, each mapped data block of the data packet corresponds to a minimum convex hull indicator map.

[0022] In some embodiments, the ciphertext generation process is as follows:

[0023] Calculate the area of ​​each minimum convex hull indicator graph, extract the sequential number of the Cartesian coordinates to which the minimum convex hull index graph belongs as the x-axis, and then construct the two-dimensional coordinates of the minimum convex hull index graph using the area of ​​the minimum convex hull index graph as the y-axis. Draw the minimum convex hull indicator graph on the canvas according to its corresponding two-dimensional coordinates, so that the center position of the minimum convex hull indicator graph coincides with its corresponding two-dimensional coordinate. At the same time, mark the center point position of the maximum value M of the mapped data block to which the minimum convex hull indicator graph belongs. In this way, all minimum convex hull indicator graphs can be drawn on the canvas, and different minimum convex hull index graphs are marked with different colors. Use the convex hull algorithm again to obtain the minimum convex hull including all minimum convex hull index graphs to obtain the final convex hull. Use all the individual minimum convex hull index graphs in the final convex hull as the filling graph of the minimum convex hull, and use the final convex hull and its filling graph as the ciphertext of the data packet.

[0024] In some embodiments, the isolation gateway is used to receive encrypted messages and relay them to a second local area network:

[0025] The isolation gate is equipped with a transmission relay module, which includes a congestion prediction unit and a transmission optimization unit.

[0026] The congestion prediction unit analyzes the ciphertext status received by the isolation gateway to determine whether congestion exists. If congestion exists, the transmission optimization unit is executed.

[0027] The transmission optimization unit is used to optimize the transmission of encrypted messages to be relayed by the isolation gateway.

[0028] In some embodiments, the presence of congestion is determined by analyzing the ciphertext status received by the isolation gateway:

[0029] The system receives all encrypted data in real time and records the reception time and data volume. It then calculates the total data volume received within each time period according to a preset time granularity and plots a bar chart with the time period as the x-axis and the data volume as the y-axis. For each bar, the system takes its midpoint and connects these midpoints sequentially to create a curve. Tangent lines are drawn at each point on the curve, and the slope of the tangent lines is calculated using the least squares method. Slopes greater than zero are summed to obtain the increase rate, while slopes less than zero are summed to obtain the decrease rate. The increase rate is then divided by the decrease rate to obtain the increase / decrease ratio. A preset data volume threshold is used; if the data volume corresponding to a bar exceeds this threshold, the bar is marked as a congested bar. The area of ​​all congested bars is calculated and summed to obtain the congested area. The area of ​​all bars in the bar chart is summed to obtain the total area, and the congested area is divided by the total area to obtain the congestion ratio. The increase / decrease ratio s and the congestion ratio d are then calculated using the formula... The congestion value C is calculated, where λ is the nonlinear adjustment coefficient with a value range of 0.1-0.3, and β is the trend sensitivity coefficient with a value range of 0.5-1.5. A preset congestion threshold is set. If the congestion value is greater than or equal to the preset congestion threshold, it is determined that congestion exists, and the transmission optimization unit is executed.

[0030] In some embodiments, the ciphertext to be relayed by the isolation gateway is optimized for relaying:

[0031] Step 1: Obtain the ciphertext waiting for relay within the isolation gate. Extract the data volume of the ciphertext and the time the ciphertext entered the isolation gate, recording this as the receiving time. Calculate the waiting time by the time difference between the receiving time and the current system time. Select the maximum data volume from the ciphertexts waiting for relay within the isolation gate and divide the data volume of all ciphertexts by the maximum data volume to obtain the data volume ratio of each ciphertext. Then, select the maximum waiting time from the ciphertexts waiting for relay within the isolation gate and divide the waiting time of all ciphertexts by the maximum waiting time to obtain the waiting time ratio. Obtain the power operation and maintenance data type corresponding to the ciphertext. Preset each type of power operation and maintenance data corresponds to a key value. Compare the power operation and maintenance data type corresponding to the ciphertext with all preset power operation and maintenance data types to match the corresponding key value. Calculate the data volume ratio Q, waiting time ratio T, and key value G using the formula... The queue value P of the ciphertext is calculated, where α and η are adjustment parameters used to control the influence intensity of waiting time and data volume, respectively, with values ​​of 1.5 and 1.1; γ and δ are nonlinear exponents of the waiting time ratio and data volume ratio, respectively, used to adjust the sensitivity of waiting time and data volume, with values ​​of 1.2 and 1.0. The ciphertexts are sorted in descending order of queue value to obtain the ciphertext sorting, and the ciphertext with the first sort is selected as the relay ciphertext.

[0032] Step 2: Presumably, several threads are simultaneously performing encrypted relay transmission. The historical relay records for each thread are obtained, including the number of encrypted messages relayed, the data size of each message, and the relay duration. The relay speed of a single message is obtained by dividing the data size of the message by the relay duration. This yields the relay speed and relay time of all previously relayed encrypted messages for each thread, denoted as vi, where i represents the index of any historical encrypted message relay. Based on the relay speeds from the historical records, the thread's relay capability is deeply analyzed to obtain the thread's relay value.

[0033] Step 3: Sort all threads in descending order of their corresponding relay values, select the thread ranked first as the relay thread, and assign the relay transmission task of the relay ciphertext to the relay thread. At the same time, increment the number of ciphertexts b currently waiting to be processed by this relay thread by one and update it to Step 2.

[0034] Step four: Repeat steps one through three until all ciphertext has been relayed.

[0035] In some embodiments, the thread relay capability is analyzed in depth to obtain the thread relay value:

[0036] S2-1, the transfer speed vi from the historical transfer records is calculated using the formula... The speed-related value Hv of the thread is calculated, where n is the total number of historical transfers of the thread, i∈n; and μ is the attenuation factor.

[0037] S2-2, calculate the standard deviation of the transfer speed based on all historical transfer records, denoted as σ. Simultaneously, calculate the mean transfer speed of all historical transfer records to obtain the mean speed, denoted as ω. Then, use the formula... Calculate the stability correlation value Hσ of the thread, where ρ is the autocorrelation coefficient, a value that measures the temporal stability of the transfer speed. ;

[0038] S2-3, the velocity correlation value Hv and the stability correlation value Hσ are expressed using the formula... The cooperative amplification factor ζ is calculated, where is the amplification factor and k is the cooperative threshold;

[0039] S2-4, then the cooperative amplification factor ζ, velocity correlation value Hv, and stability correlation value Hσ are expressed using the formula The transfer value is calculated, from which the transfer value Z of all threads can be obtained, where g is the load sensitivity coefficient, a1 and a2 are the weight coefficients of the speed-related value Hv and the stability-related value Hσ, respectively, and a1+a2=1.

[0040] Compared with the prior art, the beneficial effects of the present invention are:

[0041] 1. The first local area network collects power operation and maintenance data in real time through the data acquisition module. The encryption module uses graphical encryption technology to convert the power operation and maintenance data into graphical ciphertext based on polar coordinate mapping and convex hull algorithm. This encryption process not only achieves effective data protection, but also ensures the reversibility of encryption by retaining all internal points, sequential connection and labeling key parameters (such as the maximum value M). At the same time, the graphical ciphertext formed by encryption has unique determinism and can accurately reflect the characteristics of the original data, providing a solid foundation for subsequent secure transmission and decryption. This encryption method not only meets the security requirements of power operation and maintenance data, but also creates conditions for cross-network transmission.

[0042] 2. The isolation gateway serves as the core security barrier, ensuring physical one-way data transmission through a one-way gateway, fundamentally eliminating the risk of reverse network attacks. Its built-in transmission relay module monitors the ciphertext reception status in real time through a congestion prediction unit. Using time series analysis and nonlinear calculation of congestion values, it can accurately identify the congestion status of thread relays. If congestion exists, the transmission optimization unit is executed. The transmission optimization unit calculates the ciphertext queue value through multi-dimensional parameters and obtains the thread relay value based on in-depth analysis of thread historical performance. Then, based on the queue value and relay value, ciphertext relay tasks are allocated to achieve intelligent load balancing, dynamically optimize transmission order and resource allocation, improve relay efficiency, and effectively avoid network congestion and data transmission delays.

[0043] 3. The second local area network reliably receives ciphertext from the isolation gateway through the receiving module and executes a complete decryption process to accurately restore the graphical ciphertext to the original data packet. Since all necessary parameters and connection order are fully preserved during the encryption process, the decryption process can accurately reconstruct the original power operation and maintenance data, ensuring the integrity and availability of the data. The decrypted data is stored in the external network database, providing high-quality data support for subsequent data analysis, monitoring and early warning, and operation and maintenance decision-making.

[0044] Attached image description.

[0045] To more clearly illustrate the technical solutions in the embodiments of this application or the conventional technology, the drawings used in the description of the embodiments or the conventional technology will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 This is a schematic diagram of the system module connections of the present invention;

[0047] Figure 2 This is a bar graph showing the amount of data transferred in this invention. Detailed Implementation

[0048] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Many specific details are set forth in the following description to provide a thorough understanding of the present invention. However, the present invention can be practiced in many other ways different from those described herein, and those skilled in the art can make similar modifications without departing from the spirit of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0049] like Figure 1As shown, a passive unidirectional data relay system across network areas includes: a first local area network (LAN), a second LAN, and an isolation gateway. The first LAN contains a data acquisition module, an encryption module, and a transmission module; the isolation gateway contains a transmission relay module; and the second LAN contains a receiving module and an external network database. It should be noted that power data is transmitted unidirectionally from the first LAN to the second LAN, separated by the isolation gateway. The isolation gateway is a fiber optic unidirectional gateway, meaning that data transmission does not depend on the active request from the target network (second LAN), but is pushed by the source network (first LAN), and unidirectionality is ensured through physical or logical isolation. Therefore, power data can only be transmitted unidirectionally from the first LAN to the second LAN via the isolation gateway. In this application scenario, the first LAN is the internal power network, and the second LAN is the external power network.

[0050] The first local area network transmits real-time generated power operation and maintenance data to the isolation gateway. The data acquisition module in the first local area network collects power operation and maintenance data in real time, packages it into data packets, encrypts it through the encryption module to form ciphertext, and finally sends it to the isolation gateway by the sending module.

[0051] The encryption process is as follows: Data packets are extracted, and the power operation and maintenance data within them is parsed into binary data. The binary data is then divided into data blocks of fixed length *m*, where *m* is a positive integer; for example, a data block length of 128 bits. Each binary data block is converted into a decimal value sequence, and then each value in the decimal value sequence is normalized to transform the decimal value sequence into a mapped data block. This allows the data packet to be split into several mapped data blocks. The normalization process involves selecting the maximum value in the decimal value sequence and then dividing each value in the selected decimal value sequence by the maximum value *M*, thus mapping each value in the selected decimal value sequence to [0, 1]. Between [the canvas center and the radius]; construct a polar coordinate system with the canvas center as the origin, defining the polar radius range and angle range. The polar radius range is 0-Rmax, where Rmax is determined according to the canvas size; the angle range is 0-2π; map the first (m / 2) values ​​(i.e., 128 / 2=64) in each mapped data block to angles, i.e., multiply the values ​​by 2π to obtain the polar angle θ; map the last (m / 2) values ​​in the mapped data block to radius R, i.e., multiply the values ​​by Rmax to obtain the polar radius R; then pair the angles and radii sequentially to form (m / 2) polar coordinate points (R, θ). Specifically: the first angle θ is paired with the first radius value R to form a polar coordinate point, the second angle value is paired with the second radius value to form a polar coordinate point. This process continues until the (m / 2)th polar coordinate point (R, θ). Thus, each mapped data block is transformed into (m / 2) polar coordinate points, and each polar coordinate is converted into Cartesian coordinates (x, y), specifically x = R × cos(θ), y = R × sin(θ), forming a (m / 2) discrete point set. The points in each discrete point set are plotted in Cartesian coordinates, and then a minimum convex hull including all discrete points is drawn based on the convex hull algorithm. The discrete points in the minimum convex hull are then connected sequentially according to Cartesian coordinate order to obtain the minimum convex hull indicator map. It should be noted that, according to the above processing of the mapped data blocks, for any finite set of points on the plane, there exists one and only one minimum convex hull. The polygon contains all these discrete points, so the minimum convex hull indicator graph is unique and definite; thus, each mapped data block of the data packet corresponds to a minimum convex hull indicator graph. Calculate the area of ​​each minimum convex hull indicator graph (the area of ​​the minimum convex hull indicator graph refers to the closed area of ​​the minimum convex hull within it), extract the sequential number of the Cartesian coordinates to which the minimum convex hull indicator graph belongs as the abscissa, and then use the area of ​​the minimum convex hull indicator graph as the ordinate to construct the two-dimensional coordinates of the minimum convex hull indicator graph. Draw the minimum convex hull indicator graph on the canvas according to its corresponding two-dimensional coordinates, so that the center position of the minimum convex hull indicator graph coincides with its corresponding two-dimensional coordinates. At the same time, mark the center point position with the maximum value M of the mapped data block to which the minimum convex hull indicator graph belongs.This allows all minimum convex hull index graphs to be drawn on the canvas, with different minimum convex hull index graphs marked with different colors to prevent overlap and confusion; the convex hull algorithm is then used again to obtain the minimum convex hull including all minimum convex hull index graphs to obtain the final convex hull, and all individual minimum convex hull index graphs in the final convex hull are used as the filling graph of the minimum convex hull, and the final convex hull and its filling graph are used as the ciphertext of the data packet.

[0052] It should be noted that all internal points are preserved in the minimum convex hull indicator graph and connected into lines in order. Furthermore, all minimum convex hull indicator graphs are preserved in the final convex hull and marked with different colors. The horizontal axis represents the order of the minimum convex hull indicator graphs. In addition, the center point of each minimum convex hull indicator graph is marked with the maximum value M used during normalization. Under this encryption and marking, the original data packet can be deduced from the ciphertext of the data packet.

[0053] The first local area network collects power operation and maintenance data in real time through the data acquisition module. The encryption module uses graphical encryption technology to convert the power operation and maintenance data into graphical ciphertext based on polar coordinate mapping and convex hull algorithm. This encryption process not only effectively protects the data, but also ensures the reversibility of encryption by retaining all internal points, sequentially connecting them, and labeling key parameters (such as the maximum value M). At the same time, the graphical ciphertext formed by encryption has unique determinism and can accurately reflect the characteristics of the original data, providing a solid foundation for subsequent secure transmission and decryption. This encryption method not only meets the security requirements of power operation and maintenance data, but also creates conditions for cross-network transmission.

[0054] The isolation gateway is equipped with a transmission relay module that optimizes transmission relay based on all received ciphertext to send the ciphertext to the receiving module of the second local area network, thereby significantly improving relay efficiency. Specifically:

[0055] The transmission relay module includes a congestion prediction unit and a transmission optimization unit. The congestion prediction unit analyzes the ciphertext status received by the isolation gateway to determine whether there is congestion. If there is congestion, the transmission optimization unit is executed to alleviate congestion and improve relay efficiency.

[0056] The process of analyzing the ciphertext status received by the isolation gateway to determine whether congestion exists involves: receiving all ciphertext in real time, recording the reception time and data volume, and calculating the total amount of data received within each time period according to a preset time granularity (e.g., every minute or 3 minutes). Figure 2As shown, a bar chart is plotted with time period as the x-axis and data volume as the y-axis. The midpoint of the top of each bar is taken, and a curve is used to connect these midpoints sequentially to create a curve. Tangent lines are drawn to the curve at each point, and the slope of the tangent lines is calculated using the least squares method. It should be noted that the slope represents the trend of the curve at that point. If the slope is greater than zero, it indicates that the data volume at that point is increasing; if the slope is less than zero, it indicates that the data volume at that point is decreasing; if the slope is equal to zero, it indicates that the data volume at that point is stable. The slopes greater than zero are summed to obtain the degree of increase, and the slopes less than zero are summed to obtain the degree of decrease. The increase is then divided by the decrease to obtain the increase / decrease ratio, denoted as s. The preset data volume is used. The data volume threshold is set by those skilled in the art based on the upper limit of the system's transfer processing capacity and historical performance data. Specifically, it is determined by the data volume distribution during different time periods in historical normal operation, combined with the system's maximum throughput and business needs. The data volume threshold is set at approximately 70% to 80% of the system's theoretical capacity to reserve a safety margin for handling sudden traffic surges. If the data volume corresponding to a bar exceeds the data volume threshold, it indicates that enough ciphertext received during this time period will cause data transmission congestion. This bar is then marked as a congested bar. The area of ​​all congested bars is calculated and summed to obtain the congested area. The total area is obtained by summing the areas of all bars in the bar chart, and the congestion ratio, denoted as d, is obtained by dividing the congestion area by the total area. The formula is used to calculate the congestion ratio. The congestion value C is calculated, where λ is the nonlinear adjustment coefficient, ranging from 0.1 to 0.3, and β is the trend sensitivity coefficient, ranging from 0.5 to 1.5; the nonlinear amplification term in the formula... The exponential deterioration characteristic of congestion is reflected by using a quadratic term to amplify the impact of extreme cases, consistent with the avalanche effect of network congestion. When the increase / decrease ratio s or the congestion ratio d is large, congestion deteriorates at a superlinear rate, and this term can sensitively capture this nonlinear characteristic; trend-sensitive term. The risk amplification caused by the trend deviating from the equilibrium point is emphasized. When s=1, |s-1|=0, exp(0)=1, this term does not have an amplification effect. When s≠1, s-1>0, producing an exponential amplification effect. When s-1<0, an exponential shrinkage effect is produced. The preset congestion threshold is set by those skilled in the art based on the statistical analysis of the system performance inflection point in historical congestion events and the tolerance of the business to the reliability and real-time performance of data transmission (such as the maximum allowable delay of power control commands). Specifically, the critical point of the congestion value C is calibrated by machine learning or statistical models (such as regression analysis) so that when C exceeds the congestion threshold, it reflects that the congestion has accumulated from quantitative change to qualitative change, triggering the risk of nonlinear deterioration. This threshold is usually set at a specific quantile of the congestion value C (such as the 90th percentile) to ensure that optimization is started in time before the system performance deteriorates significantly, avoiding transmission interruption caused by the avalanche effect. If the congestion value is greater than or equal to the preset congestion threshold, it indicates that there is a large congestion in the relay data transmission of the isolation gateway, and relay transmission optimization needs to be performed. Then the transmission optimization unit is executed.

[0057] The transmission optimization process of the transmission optimization unit is as follows: Step 1: Obtain the ciphertext waiting for relay within the isolation gate, extract the data volume of the ciphertext and the time when the ciphertext enters the isolation gate as the receiving time, and calculate the waiting time by the time difference between the receiving time and the current system time; Select the maximum data volume from the ciphertext waiting for relay within the isolation gate, and divide the data volume of all ciphertexts by the maximum data volume to obtain the data volume ratio of each ciphertext, denoted as Q; Then select the maximum waiting time from the ciphertext waiting for relay within the isolation gate, and divide the waiting time of all ciphertexts by the maximum waiting time to obtain the waiting time ratio, denoted as T; Obtain the power operation and maintenance data type corresponding to the ciphertext, and preset each type. Each power operation and maintenance (O&M) data point corresponds to a key value. It's important to note that different types of O&M data have varying importance and corresponding key values; a higher key value indicates greater importance. The key values ​​for O&M data are determined by those skilled in the art based on the data's impact on the safety and stability of the power grid. For example, control command data (such as circuit breaker operations) directly affects real-time grid control; delays can lead to accidents, thus assigning a high key value. These key values ​​range from 0 to 1. The encrypted O&M data type is compared with all preset O&M data types to match the corresponding key value, denoted as G. The formula is then used to... The queue value P of the encrypted data is calculated, where α and η are adjustment parameters, used to control the impact of waiting time and data volume, respectively, with values ​​of 1.5 and 1.1; γ and δ are nonlinear exponents of the waiting time ratio and data volume ratio, respectively, used to adjust the sensitivity of waiting time and data volume, with values ​​of 1.2 and 1.0; in this formula, the key value G is used as a multiplication factor to directly scale the queue value P, ensuring that important data always receives high priority, even with short waiting times and large data volumes, in order to meet the security requirements of power operation and maintenance. The numerator... This causes the queue value to grow rapidly as the ratio of waiting time increases, with the exponent γ > 1 creating non-linear growth: when T is small, the growth is slow; when T approaches 1, the growth is rapid, avoiding data starvation, and data with long waiting times will receive higher priority, reducing the average waiting time; denominator term This design causes the queue value P to decrease as the data volume ratio increases. The larger the data volume, the lower the queue value, which tends to prioritize the transmission of smaller data volumes, thereby quickly releasing buffer resources and improving system throughput. The formula dynamically balances the impact of waiting time and data volume through the ratio structure of the numerator and denominator. For example, even if the data volume is very large (Q≈1), if the waiting time is long (T≈1) and the critical value is high, the queue value may still be high. This design is to prevent important big data from being delayed indefinitely. From this, the queue value of all waiting ciphertexts within the isolation gateway can be obtained. The ciphertexts are sorted in descending order of queue value, and the ciphertext with the highest queue value is selected as the relay ciphertext.

[0058] Step 2: Assuming several threads simultaneously perform encrypted text relay transmission, obtain the historical relay records for each thread. These records include the number of relayed encrypted texts, the data size of each encrypted text, and the relay duration. Divide the data size of a single encrypted text by the relay duration to obtain its relay speed. This yields the relay speed and time for all historically relayed encrypted texts for each thread, denoted as vi, where i represents the index of any historical encrypted text relay. Based on the relay speed recorded in the historical records, perform a deep analysis of the thread's relay capability to obtain its relay value. The specific process for this deep analysis of the thread's relay capability is as follows:

[0059] S2-1, the transfer speed vi from the historical transfer records is calculated using the formula... The thread's speed-related value Hv is calculated, where n is the total number of historical thread jumps, i∈n; μ is the attenuation factor, obtained through the attenuation term in the formula. Give higher weight to recent transfer records to more accurately reflect the transfer speed of threads;

[0060] S2-2, calculate the standard deviation of the transfer speed based on all historical transfer records, denoted as σ. Simultaneously, calculate the mean transfer speed of all historical transfer records to obtain the mean speed, denoted as ω. Then, use the formula... Calculate the stability correlation value Hσ of the thread, where ρ is the autocorrelation coefficient, a value that measures the temporal stability of the transfer speed. The autocorrelation coefficient is introduced to quantify the rate of change, and the closer the stable correlation value Hσ is to 1, the higher the stability.

[0061] S2-3, the velocity correlation value Hv and the stability correlation value Hσ are expressed using the formula... The synergistic amplification factor ζ is calculated, where is the amplification factor, with a value range of [0, 1], which controls the upper limit of the extra reward that high-quality threads (threads with both large speed-related values ​​Hv and stability-related values ​​Hσ) can obtain, and k is the synergistic threshold, representing the minimum capability requirement to trigger the synergistic effect, with a value range of [0, 1]. Specifically: when Hv × Hσ < k, a penalty is imposed, and when Hv × Hσ > k, a reward is obtained. The formula uses a smooth sigmoid saturation function with tanh (hyperbolic tangent function), and the output range of the synergistic amplification factor ζ is [-1, 1]. It is linear near 0 and saturates at both ends, which can provide a smooth transition of the synergistic effect and avoid abrupt changes.

[0062] S2-4, then the cooperative amplification factor ζ, velocity correlation value Hv, and stability correlation value Hσ are expressed using the formula The relay value is calculated, from which the relay value Z of all threads can be obtained, where b is the number of ciphertexts currently waiting to be processed by the thread, g is the load sensitivity coefficient, which takes a value of 0.1-0.3, and the numerator is avoided to avoid division by zero to control the degree of load penalty; a1 and a2 are the weighting coefficients of the speed-related value Hv and the stability-related value Hσ, respectively, and a1+a2=1; this formula achieves a fine evaluation of the thread relay capability through multi-parameter coordination, considering both the performance of a single dimension and the synergistic effect between dimensions, avoiding abrupt changes in capability values, and ensuring the stability of load distribution;

[0063] Step 3: Sort all threads in descending order of their corresponding relay values, select the thread ranked first as the relay thread, and assign the relay transmission task of the relay ciphertext to the relay thread. At the same time, increment the number of ciphertexts b currently waiting to be processed by this relay thread by one and update it to Step 2.

[0064] Step 4: Repeat steps 1 to 3 above until all ciphertext is successfully transmitted.

[0065] As a core security barrier, the isolation gateway ensures physical unidirectional data transmission through a one-way gateway, fundamentally eliminating the risk of reverse network attacks. Its built-in transmission relay module monitors the ciphertext reception status in real time through a congestion prediction unit. Using time series analysis and nonlinear calculation of congestion values, it can accurately identify the congestion status of thread relays. If congestion is found, the transmission optimization unit is executed. The transmission optimization unit calculates the ciphertext queue value through multi-dimensional parameters and obtains the thread relay value based on in-depth analysis of thread historical performance. Then, based on the queue value and relay value, ciphertext relay tasks are allocated to achieve intelligent load balancing, dynamically optimize transmission order and resource allocation, improve relay efficiency, and effectively avoid network congestion and data transmission delays.

[0066] The second local area network receives ciphertext from the isolation gateway through its built-in receiving module, decrypts the ciphertext (i.e., the reverse encryption process) to obtain the corresponding data packet, and sends the data packet to the external network database for storage.

[0067] The second local area network reliably receives ciphertext from the isolation gateway through the receiving module and executes a complete decryption process to accurately restore the graphical ciphertext to the original data packet. Since all necessary parameters and connection order are fully preserved during the encryption process, the decryption process can accurately reconstruct the original power operation and maintenance data, ensuring the integrity and availability of the data. The decrypted data is stored in the external network database, providing high-quality data support for subsequent data analysis, monitoring and early warning, and operation and maintenance decision-making.

[0068] While current passive unidirectional data transmission can transfer data from a first local area network (LAN) to a second LAN to isolate it from network attacks, it still carries the risk of data transfer and exposure if the second LAN environment is insecure. To address this issue, this solution constructs a complete cross-network area passive unidirectional data relay system. In the first LAN, graphical encryption technology ensures data security and reversibility. In the isolation gateway, physical isolation and intelligent transmission optimization achieve efficient and reliable data relay. In the second LAN, precise decryption ensures data integrity and usability. These three systems work together to achieve efficient, reliable, and unidirectional transmission of power operation and maintenance data under strict security isolation conditions, effectively balancing the contradiction between network security and transmission efficiency.

[0069] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0070] The formula described above is an example of an empirical formula defined by an expert in the field. Any formula that conforms to the relationship between the parameters of this application is acceptable. The specific size of the weighting factors in the formula shall be reasonably set by a person skilled in the art based on actual use.

[0071] The above embodiments merely illustrate several implementation methods of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of this invention patent should be determined by the appended claims.

Claims

1. A passive one-way data relay system across network regions, characterized in that, include: First LAN, second LAN, and isolation gateway; The first local area network is used to collect real-time power operation and maintenance data, encrypt it into ciphertext, and transmit it to the isolation network gate; The isolation gateway is used to receive ciphertext and relay it to a second local area network; the ciphertext is formed by graphic encryption.

301. Extract the data packet, parse the power operation and maintenance data in the data packet into binary, and then divide the binary data into data blocks of fixed length m, where m is a positive integer. Convert each binary data block into a decimal numerical sequence.

302. Normalize each value in the decimal value sequence to convert the decimal value sequence into a mapping data block, thereby splitting the data packet into several mapping data blocks; the normalization is to select the maximum value in the decimal value sequence and then divide each value in the selected decimal value sequence by the maximum value M.

303. Construct a polar coordinate system with the center of the canvas as the origin, defining the polar radius range and angle range. The polar radius range is 0-Rmax, where Rmax is determined according to the canvas size; the angle range is 0-2π. Map the first (m / 2) values ​​in each mapped data block to angles, i.e., multiply the values ​​by 2π to obtain the polar angle θ; map the last (m / 2) values ​​in the mapped data block to radius R, i.e., multiply the values ​​by Rmax to obtain the polar radius R; then pair the angles and radii one by one in sequence to form (m / 2) polar coordinate points (R, θ). Thus, each mapped data block is transformed into (m / 2) polar coordinate points, and each polar coordinate is converted into Cartesian coordinates (x, y), specifically x=R×cos(θ), y=R×sin(θ), forming a set of (m / 2) discrete points.

304. Based on the discrete point set, the convex hull algorithm is used to output the minimum convex hull indicator map corresponding to each discrete point set. Then, the minimum convex hull indicator map of all mapped data blocks of the data packet is used again to obtain the ciphertext. The isolation gate is equipped with a transmission relay module, which includes a congestion prediction unit and a transmission optimization unit. The congestion prediction unit analyzes the relay status of ciphertext received by the isolation gateway to determine whether congestion exists. If congestion is found, the transmission optimization unit is executed. The transmission optimization unit optimizes the relay of ciphertext to be relayed by the isolation gateway, specifically as follows: Step 1: Obtain the ciphertext waiting for relay within the isolation gateway, extract the data volume of the ciphertext and the time when the ciphertext entered the isolation gateway and record it as the receiving time, and calculate the waiting time by the time difference between the receiving time and the current system time; select the maximum data volume among the ciphertexts waiting for relay within the isolation gateway, and divide the data volume of all ciphertexts by the maximum data volume to obtain the data volume ratio of each ciphertext. Then, select the maximum waiting time from the ciphertexts waiting for relay within the isolation gate, and divide the waiting time of all ciphertexts by the maximum waiting time to obtain the waiting time ratio; Obtain the power operation and maintenance data type corresponding to the ciphertext. Preset a key value for each type of power operation and maintenance data. Compare the power operation and maintenance data type corresponding to the ciphertext with all preset power operation and maintenance data types to match the corresponding key value. Formulate calculation and analysis of data volume ratio, waiting time ratio and key value to obtain the queue value of the ciphertext. From this, the queue value of all waiting relay ciphertexts in the isolation gate can be obtained. Sort the ciphertexts in descending order of queue value to obtain the ciphertext sorting. Select the ciphertext with the first sorted value as the relay ciphertext. Step 2: Presuppose that several threads are simultaneously performing encrypted relay transmission. Obtain the historical relay record of each thread. The historical relay record includes the number of encrypted messages relayed, the data size of each encrypted message, and the relay duration. Dividing the data size of a single ciphertext by the transit time yields the transit speed of that single ciphertext. From this, the transit speed and transit time of all historical ciphertexts transited by the thread can be obtained and denoted as vi, where i represents the index of any historical ciphertext transit. Based on the transit speed of historical transit records, the thread's transit capability is deeply analyzed to obtain the thread's transit value. Step 3: Sort all threads in descending order of their corresponding relay values, select the thread ranked first as the relay thread, and assign the relay transmission task of the relay ciphertext to the relay thread. At the same time, increment the number of ciphertexts b currently waiting to be processed by this relay thread by one and update it to Step 2. Step 4: Repeat steps 1 to 3 above until all ciphertext is successfully transmitted. The second local area network receives ciphertext from the isolation gateway and decrypts it to obtain the original power operation and maintenance data.

2. The passive one-way data relay system across network regions according to claim 1, characterized in that, The first local area network has a built-in data acquisition module, encryption module, and transmission module; The data acquisition module is used to collect real-time generated power operation and maintenance data, package it into data packets, and send the data packets to the encryption module; The encryption module performs graphical encryption on the data packet to form ciphertext, and then sends it to the sending module. The sending module is used to send encrypted messages to the isolation gateway.

3. A passive one-way data relay system across network regions according to claim 1, characterized in that, The output process of the minimum convex hull indicator graph: The points of the discrete point set are plotted in Cartesian coordinates. Then, the minimum convex hull containing all the discrete points is drawn based on the convex hull algorithm. The discrete points in the minimum convex hull are connected sequentially in Cartesian coordinate order to obtain the minimum convex hull indicator map. For any finite set of points on the plane, there exists one and only one minimum convex polygon that contains all these discrete points. Therefore, the minimum convex hull indicator map is unique and definite. Thus, each mapped data block of the data packet corresponds to a minimum convex hull indicator map.

4. A passive one-way data relay system across network regions according to claim 3, characterized in that, The process of generating ciphertext: Calculate the area of ​​each minimum convex hull indicator graph, extract the sequential number of the Cartesian coordinates to which the minimum convex hull indicator graph belongs as the x-axis, and then use the area of ​​the minimum convex hull indicator graph as the y-axis to construct the two-dimensional coordinates of the minimum convex hull indicator graph. Draw the minimum convex hull indicator graph on the canvas according to its corresponding two-dimensional coordinates, so that the center position of the minimum convex hull indicator graph coincides with its corresponding two-dimensional coordinates. At the same time, mark the center point position of the maximum value M of the mapped data block to which the minimum convex hull indicator graph belongs. In this way, all minimum convex hull indicator graphs can be drawn on the canvas, and different minimum convex hull indicator graphs are marked with different colors. The convex hull algorithm is used again to obtain the minimum convex hull including all minimum convex hull indicator graphs to obtain the final convex hull. All individual minimum convex hull indicator graphs in the final convex hull are used as the filling graph of the minimum convex hull, and the final convex hull and its filling graph are used as the ciphertext of the data packet.

5. A passive one-way data relay system across network regions according to claim 1, characterized in that, The presence of congestion is determined by analyzing the ciphertext relay status received by the isolation gateway. All encrypted messages are received in real time, and the reception time and data volume of the encrypted messages are recorded. The total amount of data received in each time period is statistically analyzed according to the preset time granularity, and a bar chart is drawn with the time period as the horizontal axis and the data volume as the vertical axis. The midpoint of the top of each bar is taken, and a curve is drawn to connect the midpoint of the top of each bar in sequence to draw a curve. Tangent lines of the curve are drawn at each point of the curve, and the slope of the tangent line is calculated using the least squares method. The slopes greater than zero are summed to obtain the increase, and the slopes less than zero are summed to obtain the decrease. The increase is then divided by the decrease to obtain the increase / decrease ratio. A preset data volume threshold is set. If the data volume corresponding to a column is greater than the data volume threshold, the column is marked as a congested column. The area of ​​all congested columns is then calculated and summed to obtain the congested area. The total area is calculated by summing the areas of all bars in the bar chart. The congestion ratio is then obtained by dividing the congested area by the total area. The congestion value is obtained by formulaically calculating and analyzing the increase / decrease ratio and the congestion ratio. A preset congestion threshold is set. If the congestion value is greater than or equal to the preset congestion threshold, it is determined that congestion exists, and the transmission optimization unit is executed.

Images