A system and method for encapsulating ipsec frame structure using ppp protocol

Abstract

The present invention relates to a kind of system that adopts ppp agreement to encapsulate IPsec frame structure, described system comprises user space and kernel space, and described user space comprises management module, business module, key agreement module and dial-up module; Described kernel space comprises Kernel driver module, kernel task module, kernel configuration and state storage module, kernel interface, and kernel algorithm scheduling module. The invention also relates to a method for sending and receiving business data using the IPsec frame structure system. The system and method adopt the SM series algorithm of the State Cryptography Administration to realize the IPsec frame structure based on ppp protocol encapsulation, thereby realizing the communication security of industrial terminals; in addition, it can realize various forms such as network port type, serial port type, and industrial bus The security protection of business terminal equipment is not limited to the protection of traditional network equipment or network master stations, so it has the advantage of being widely used.

Description

technical field

[0001] The invention relates to the field of information security, in particular to a system and method for encapsulating an IPsec frame structure using the ppp protocol. Background technique

[0002] Information systems are widely used in all walks of life. For example, in multi-level production monitoring systems such as power grids and rail transit, it is necessary to collect, analyze and diagnose faults on the operation data of important equipment belonging to the system. Due to the high cost of wired network construction and inflexible access points, wireless (such as GPRS) is widely used in industrial production systems (especially data acquisition systems) as a supplement to wired networks; PPP protocol is currently the main dial-up communication of wireless GPRS protocol.

[0003] However, in order to ensure data integrity, confidentiality and non-repudiation based on wireless GPRS (it can be confirmed that the sender of the message is the only possi...

Examples

Embodiment 1

[0044] Embodiment 1: Network port service terminal deployment

[0045] see image 3 , which is a schematic diagram of deploying a network port service terminal using the above-mentioned IPsec frame structure system 100. In this embodiment, the IPsec frame structure system 100 integrates a GPRS wireless dial-up module, and the service collection terminal 200 is connected through an Ethernet port (ethernet ) for interconnection, the interface applicable to the service collection terminal is an application scenario of an Ethernet port.

[0046] The service collection terminal 200 and the IPsec frame structure system 100 are respectively configured with IP, and in this embodiment, the devices are configured in routing mode. In terms of specific implementation, the IPsec frame structure system 100 establishes a VPN tunnel with the master station device by encapsulating IPsec through the ppp protocol. The service collection terminal 200 establishes a TCP long connection with the f...

Embodiment 2

[0051] Embodiment 2: Deployment of serial port service terminals

[0052] see Figure 6 , which is a schematic diagram of deploying a serial service terminal adopting the above-mentioned IPsec framework structure system 100 . In this embodiment, the service collection terminal 200 is interconnected with the IPsec frame structure system 100 through the serial port RS232 ("the serial binary data exchange interface technical standard between the data terminal equipment (DTE) and the data communication equipment (DCE)"), and the service collection terminal 200 does not need to be configured with an IP address, but the IPsec frame structure system 100 needs to be configured with an IP address. In addition, the device of the present invention encapsulates IPsec with the ppp protocol to establish a VPN tunnel with the master station device, and establishes a TCP long connection with the front-end device to transmit business collection. data.

[0053] The business data sending and r...

technical field

[0001] The invention relates to the field of information security, in particular to a system and method for encapsulating an IPsec frame structure using the ppp protocol. Background technique

[0002] Information systems are widely used in all walks of life. For example, in multi-level production monitoring systems such as power grids and rail transit, it is necessary to collect, analyze and diagnose faults on the operation data of important equipment belonging to the system. Due to the high cost of wired network construction and inflexible access points, wireless (such as GPRS) is widely used in industrial production systems (especially data acquisition systems) as a supplement to wired networks; PPP protocol is currently the main dial-up communication of wireless GPRS protocol.

[0003] However, in order to ensure data integrity, confidentiality and non-repudiation based on wireless GPRS (it can be confirmed that the sender of the message is the only possi...

Examples

Embodiment 1

[0044] Embodiment 1: Network port service terminal deployment

[0045] see image 3 , which is a schematic diagram of deploying a network port service terminal using the above-mentioned IPsec frame structure system 100. In this embodiment, the IPsec frame structure system 100 integrates a GPRS wireless dial-up module, and the service collection terminal 200 is connected through an Ethernet port (ethernet ) for interconnection, the interface applicable to the service collection terminal is an application scenario of an Ethernet port.

[0046] The service collection terminal 200 and the IPsec frame structure system 100 are respectively configured with IP, and in this embodiment, the devices are configured in routing mode. In terms of specific implementation, the IPsec frame structure system 100 establishes a VPN tunnel with the master station device by encapsulating IPsec through the ppp protocol. The service collection terminal 200 establishes a TCP long connection with the f...

Embodiment 2

[0051] Embodiment 2: Deployment of serial port service terminals

[0052] see Figure 6 , which is a schematic diagram of deploying a serial service terminal adopting the above-mentioned IPsec framework structure system 100 . In this embodiment, the service collection terminal 200 is interconnected with the IPsec frame structure system 100 through the serial port RS232 ("the serial binary data exchange interface technical standard between the data terminal equipment (DTE) and the data communication equipment (DCE)"), and the service collection terminal 200 does not need to be configured with an IP address, but the IPsec frame structure system 100 needs to be configured with an IP address. In addition, the device of the present invention encapsulates IPsec with the ppp protocol to establish a VPN tunnel with the master station device, and establishes a TCP long connection with the front-end device to transmit business collection. data.

[0053] The business data sending and r...

Images