A method and system for establishing a virtual private network based on security isolation

Abstract

The application provides a kind of method and system for establishing virtual private network based on security isolation, relating to the technical field of power communication network, in production control area equipment, create production virtual network equipment TUN / TAP and initialize, configure device parameters, IP address;In the management information area equipment, create management virtual network equipment TUN / TAP and initialize, configure device parameters, IP address;Production control area equipment is connected with management information area equipment by forward isolation device, and management information area equipment is connected with production control area equipment by reverse isolation device, to realize the communication connection between production control area equipment and management information area equipment based on security isolation of virtual private network.The application can ensure the smooth communication between production control area equipment and management information area equipment, realize the communication connection between power production control area and power management information area, guarantee the communication security, and meet the communication demand.

Description

Technical Field

[0001] This invention relates to the field of power communication network technology, and in particular to a method and system for establishing a virtual private network based on security isolation. Background Technology

[0002] Currently, new energy power generation has seen widespread development. New energy sources typically utilize distributed generation and can be connected to the power grid. Distributed power stations are characterized by digitalization and intelligence, enabling owners and intelligent operation and maintenance personnel to monitor them in real time. They can also perform remote power dispatch and control from the master station as needed, ensuring power quality and reducing the impact on the power grid. Information regarding the new energy power generation process can be queried from the owner's end via the internet, and new energy operation and maintenance personnel can also access the server via dedicated external lines or VPN-encrypted external networks. However, the internal production control of the power grid belongs to the management information zone equipment and has a certain security level to prevent unauthorized access; therefore, security isolation is required between different security zones.

[0003] Currently, physical isolation is the most commonly used method. The purpose of physical isolation is to protect network equipment, computer hardware, and communication links from natural disasters, human sabotage, and wiretapping attacks. Only by physically isolating the internal network from the public network can the internal information network truly be protected from hacker attacks from the internet. However, due to the complexity of related physical isolation technologies, security controls are very limited and cannot meet the power grid's data security requirements, easily leading to online analysis technologies failing to meet data security requirements. Furthermore, communication logic entities are easily stolen and manipulated. Therefore, the security between the power production control area and the power management information area cannot be guaranteed, easily causing information leakage and damage, which poses a risk to the safe operation of the power grid. Summary of the Invention

[0004] This invention provides a method for establishing a virtual private network based on secure isolation. The method enables communication connections between the power production control area and the power management information area, ensuring communication security and meeting communication needs.

[0005] The methods include:

[0006] In the production control zone equipment, create and initialize the production virtual network device TUN / TAP, and configure the device parameters and IP address;

[0007] In the management information zone equipment, create and initialize the management virtual network device TUN / TAP, and configure the device parameters and IP address;

[0008] The production control area equipment communicates with the management information area equipment through a forward isolation device, while the management information area equipment communicates with the production control area equipment through a reverse isolation device, thus realizing a secure virtual private network communication connection between the production control area equipment and the management information area equipment.

[0009] Preferably, in the method, the equipment in the production control zone starts loop thread 1;

[0010] Loop thread 1 includes: monitoring the reverse receive directory set; after the data file has been received, reading the file content, decoding it into raw data using base64, writing it to the virtual network device, and deleting the file.

[0011] Production control zone equipment restart loop thread 2;

[0012] Loop thread 2 reads data from the virtual network device and sends the received data through the file sending interface of the forward isolation device.

[0013] Preferably, in the method, the management information area device starts loop thread 1;

[0014] Loop thread 1 is set to the forward receiving directory for monitoring. After the data file is received, it reads the file content, writes it to the virtual network device, and then deletes the file.

[0015] Management Information Zone Device Startup Loop Thread 2;

[0016] Loop thread 2 reads data from the virtual network device. The received data is first encoded using base64 and then sent through the file sending interface of the reverse isolation device.

[0017] Preferably, a communication gateway is configured between the equipment in the production control area and the equipment in the management information area;

[0018] The communication gateway establishes a virtual channel to ensure the security of data transmission and communication between equipment in the production control area and equipment in the management information area.

[0019] The communication gateway also authenticates the access terminals to ensure their trustworthiness, and establishes a virtual channel using a secure communication protocol to encrypt the transmitted data.

[0020] The communication gateway controls access permissions for devices in the production control area and management information area according to preset rules, and grants permissions to users.

[0021] Preferably, the equipment in the production control zone sends files to the management information zone through a forward and reverse security isolation device;

[0022] The management information zone equipment can send any non-empty text file to the production control zone equipment through a reverse isolation device, and it also supports sending printable characters in ASCII.

[0023] Preferably, the production control area equipment and the management information area equipment use the inotify mechanism to monitor the file system, read the received data files, and send the data to be sent through the file sending interface of the isolation device.

[0024] The present invention also provides a virtual private network establishment system based on security isolation, the system comprising: a forward isolation device, a reverse isolation device, a production control area device, and a management information area device;

[0025] In the production control zone equipment, create and initialize the production virtual network device TUN / TAP, and configure the device parameters and IP address;

[0026] In the management information zone equipment, create and initialize the management virtual network device TUN / TAP, and configure the device parameters and IP address;

[0027] The production control area equipment communicates with the management information area equipment through a forward isolation device, while the management information area equipment communicates with the production control area equipment through a reverse isolation device, thus realizing a secure virtual private network communication connection between the production control area equipment and the management information area equipment.

[0028] Preferably, a virtual channel and a communication gateway are configured between the equipment in the production control area and the equipment in the management information area;

[0029] The communication gateway is used to establish a virtual channel to ensure the security of access transmission and the communication security between equipment in the production control area and equipment in the management information area;

[0030] The virtual tunnel carries the network using a dedicated line or a secure SSL-based communication protocol, and the transmitted data is encrypted and protected within the virtual tunnel.

[0031] All equipment in the production control area and management information area are embedded with national cryptographic security chips, which implement SM1, SM2, SM3 and SM4 encryption algorithms.

[0032] As can be seen from the above technical solutions, the present invention has the following advantages:

[0033] The secure isolation-based VPN establishment method provided by this invention enables the establishment of secure isolation VPN communication connections between production control area equipment and management information area equipment, facilitating data communication for users and effectively improving communication efficiency and quality. It also allows for the efficient collection, storage, and processing of data from both production control and management information area equipment, enabling real-time data interaction between the two areas. This improves data communication quality and smoothness, avoids or reduces the risk of hacker intrusion and data theft, and to a certain extent protects the network security of the power grid, controlling communication process risks. Ultimately, this ensures timely and scientific management and control of the entire communication process between production control and management information area equipment.

[0034] The VPN establishment method based on secure isolation provided by this invention ensures secure access transmission and secure communication between production control area devices and management information area devices by establishing a virtual channel. The communication gateway authenticates the accessing terminals, ensuring their trustworthiness, and establishes a virtual channel using a secure communication protocol to encrypt transmitted data, preventing interception, tampering, and damage during transmission. Access permissions for production control area devices and management information area devices are controlled according to preset rules, granting users permissions and ensuring secure communication between them. Attached Figure Description

[0035] To more clearly illustrate the technical solution of the present invention, the accompanying drawings used in the description will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 A communication diagram illustrating the method for establishing a VPN based on secure isolation;

[0037] Figure 2 A schematic diagram of establishing a virtual private network based on security isolation. Detailed Implementation

[0038] The method for establishing a secure and isolated Virtual Private Network (VPN) provided by this invention utilizes virtual network technology. By establishing a VPN communication connection and employing technologies such as sensor monitoring and data transmission, it enables secure and isolated VPN communication between equipment in the production control area and equipment in the management information area. This allows data to be transmitted from the production control area to the management information area, and vice versa, effectively ensuring smooth data flow.

[0039] In particular, according to embodiments of this disclosure, the processes described below with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication component, and / or installed from a removable medium. When the computer program is executed by a central processing unit (CPU), it performs the various functions defined in the methods and / or apparatus of this application.

[0040] The production control area equipment and management information area equipment involved in this invention can communicate based on cloud technology. Based on cloud computing business model applications, network technology, information technology, integration technology, management platform technology, application technology, etc., can form a resource pool, which can be used on demand, flexibly and conveniently.

[0041] The production control area equipment and management information area equipment are based on a cloud computing network system to meet the massive computing and storage resources required for back-end services, such as video websites, image websites, and other portal websites. With the rapid development and application of the internet industry, every item may have its own identification mark in the future, requiring transmission to the back-end system for logical processing. Data at different levels will be processed separately, and all types of industry data will require robust system support, which can only be achieved through cloud computing.

[0042] The production control area equipment and the management information area equipment each have artificial intelligence cloud services. Specifically, the AIaaS platform breaks down several common AI services and provides them as independent or packaged services in the cloud. This service model is similar to opening an AI-themed marketplace: all developers can access and use one or more AI services provided by the platform through API interfaces. Some experienced developers can also use the AI ​​framework and AI infrastructure provided by the platform to deploy and maintain their own cloud AI services.

[0043] Production control area equipment and management information area equipment can refer to backend equipment used to provide artificial intelligence services. Specifically, the recognition server is equipped with an artificial intelligence platform, and users can access or use one or more artificial intelligence services provided by the platform through API interfaces; such artificial intelligence services include image recognition services, voice recognition services, intelligent question answering services, big data processing services, etc.

[0044] Both production control area equipment and management information area equipment can be independent physical servers, server clusters or distributed systems composed of multiple physical servers, or cloud servers providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDN), and big data and artificial intelligence platforms. Production control area equipment and management information area equipment can also be camera equipment (such as monitoring equipment, cameras), smartphones, tablets, laptops, desktop computers, smart speakers, smartwatches, etc., but are not limited to these. Production control area equipment and management information area equipment can be directly or indirectly connected via wired or wireless communication methods; this application does not impose any restrictions on this.

[0045] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0046] like Figures 1 to 2 As shown, the method for establishing a virtual private network based on security isolation provided by the present invention includes:

[0047] In the production control zone equipment, create and initialize the production virtual network device TUN / TAP, and configure the device parameters and IP address;

[0048] In the management information zone equipment, create and initialize the management virtual network device TUN / TAP, and configure the device parameters and IP address;

[0049] The production control area equipment communicates with the management information area equipment through a forward isolation device, while the management information area equipment communicates with the production control area equipment through a reverse isolation device, thus realizing a secure virtual private network communication connection between the production control area equipment and the management information area equipment.

[0050] It should be noted that the production control area equipment and the management information area equipment each include a central processing unit (CPU), which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) or programs loaded from storage into random access memory (RAM). RAM also stores various programs and data required for system operation.

[0051] The production control area equipment and the management information area equipment each have I / O interfaces: These I / O interfaces connect to input components such as keyboards and mice; output components such as cathode ray tubes (CRTs), liquid crystal displays (LCDs), and speakers; storage components such as hard drives; and communication components such as network interface cards (LAN cards, modems, etc.). The communication components perform communication processing via networks such as the Internet.

[0052] In one embodiment of the present invention, a method for establishing a virtual private network based on security isolation is described below in a non-limiting manner with respect to its specific implementation.

[0053] Currently, the equipment in the production control area and the equipment in the management information area can send files through forward and reverse security isolation devices. That is, the forward isolation device can send any non-empty file, and the reverse isolation device can send any non-empty text file (supporting the sending of printable characters in ASCII). It is assumed that the forward and reverse security isolation devices only transmit files related to the virtual private network described in this article, the two communicating parties are located in the production control area and the management information area respectively, and the file receiving directory is agreed upon in advance.

[0054] The production control area equipment and the management information area equipment each create virtual network devices TUN / TAP, configure local area network addresses, use the inotify mechanism to monitor the file system, read received data files, and send data to be sent through the file sending interface of the isolation device.

[0055] The communication connection between the production control area equipment and the management information area equipment through a forward isolation device is a completely one-way communication method; one-way data is returned in 1-bit mode; virtual host IP address, hidden MAC address.

[0056] When production control area equipment transmits data to management information area equipment via a forward isolation device, the internal network host of the forward isolation device receives the data, performs protocol stripping, and writes the raw data to the storage medium. After receiving the complete exchange signal, the forward isolation device immediately disconnects the physical connection with the internal network host and initiates a physical connection to the external network host, pushing the data from the storage medium to the external network host. Upon receiving the data, the external network host immediately performs network protocol encapsulation and reassembly, and transmits the data to the management information area equipment.

[0057] The communication between the management information zone equipment and the production control zone equipment via a reverse isolation device ensures unidirectional data transmission from the management information zone to the production control zone. The management information zone centrally receives data sent to the production control zone, performs signature verification, content filtering, and validity checks, and then forwards it to the receiving program within the production control zone. During reverse communication, the information to be sent is converted into a plain text file in a preset language format and then signed.

[0058] The management information zone equipment and the external host of the reverse isolation device negotiate keys (SM2, SM3 algorithms) to establish an encrypted channel (power-specific encryption algorithm). A pre-signed language file is sent to the external host of the reverse isolation device. The external host decrypts the data, verifies the signature, and checks the E language format. The verified data is then transferred to the internal host. The reverse isolation device only responds to the UDP protocol; therefore, both negotiation and data communication messages use UDP. The internal host of the reverse isolation device then transmits the data to the production control zone equipment.

[0059] Regarding the specific implementation logic of this invention

[0060] Production control area equipment:

[0061] Create and initialize the virtual network device TUN / TAP, and configure the device parameters and IP address.

[0062] Start 2 loop threads

[0063] Thread 1: Monitors the configured reverse receive directory. After the data file is received, it reads the file content, decodes it into raw data using base64, writes it to the virtual network device, and then deletes the file.

[0064] Thread 2: Reads data (i.e., network data packets) from the virtual network device and sends the received data through the file sending interface of the forward isolation device.

[0065] Management Information Center Equipment:

[0066] Create and initialize the virtual network device TUN / TAP, and configure the device parameters and IP address.

[0067] Start 2 loop threads

[0068] Thread 1: Monitors the configured forward receive directory. After the data file is received, it reads the file content, writes it to the virtual network device, and then deletes the file.

[0069] Thread 2: Reads data (i.e., network packets) from the virtual network device. The received data is first encoded using base64 and then sent through the file sending interface of the reverse isolation device.

[0070] Furthermore, as a refinement and extension of the specific implementation of the above embodiments, the method for establishing a virtual private network based on security isolation also includes:

[0071] A communication gateway is configured between the equipment in the production control area and the equipment in the management information area;

[0072] The communication gateway establishes a virtual channel to ensure the security of data transmission and communication between equipment in the production control area and equipment in the management information area.

[0073] The communication gateway also authenticates the access terminals to ensure their trustworthiness, and establishes a virtual channel using a secure communication protocol to encrypt the transmitted data.

[0074] The communication gateway controls access permissions for devices in the production control area and management information area according to preset rules, and grants permissions to users.

[0075] Thus, this invention enables the establishment of secure, isolated virtual private network (VPN) communication connections between production control area equipment and management information area equipment, facilitating data communication for users and effectively improving communication efficiency and quality. It also allows for the efficient collection, storage, and processing of data from both production control and management information area equipment, enabling real-time data exchange between the two areas. This improves data communication quality and smoothness, avoids or reduces the risk of hacker intrusion and data theft, and to a certain extent protects the network security of the power grid, controlling communication risks. Ultimately, it achieves timely and scientific management and control of the entire communication process between production control and management information area equipment.

[0076] The following are embodiments of the secure isolation-based virtual private network (VPN) establishment system provided in this disclosure. This system and the secure isolation-based VPN establishment methods described above belong to the same inventive concept. For details not described in detail in the embodiments of the secure isolation-based VPN establishment system, please refer to the embodiments of the secure isolation-based VPN establishment methods described above.

[0077] The system includes: forward isolation devices, reverse isolation devices, production control area equipment, and management information area equipment;

[0078] In the production control zone equipment, create and initialize the production virtual network device TUN / TAP, and configure the device parameters and IP address;

[0079] In the management information zone equipment, create and initialize the management virtual network device TUN / TAP, and configure the device parameters and IP address;

[0080] The production control area equipment communicates with the management information area equipment through a forward isolation device, while the management information area equipment communicates with the production control area equipment through a reverse isolation device, thus realizing a secure virtual private network communication connection between the production control area equipment and the management information area equipment.

[0081] In one exemplary embodiment, a virtual channel and a communication gateway are configured between the production control area devices and the management information area devices. The established virtual channel ensures secure data transmission. The communication gateway ensures secure access control for intranet applications between the production control area devices and the management information area devices.

[0082] Virtual channels are used to prevent data from being eavesdropped on, tampered with, or damaged during transmission. They are used for communication between equipment in the production control area and equipment in the management information area. Virtual channels can carry networks using dedicated lines or can use SSL-based secure communication protocols, encrypting and protecting the transmitted data.

[0083] A communication gateway is used to establish a virtual channel to ensure the security of access transmission and communication between equipment in the production control area and the management information area. The communication gateway authenticates the accessing terminals to ensure their trustworthiness, while using secure communication protocols to establish a virtual channel and encrypt the transmitted data to prevent interception, tampering, and damage during transmission.

[0084] The communication gateway controls access permissions for devices in the production control area and management information area according to preset rules, grants user permissions, and ensures communication security between devices in the production control area and management information area.

[0085] Both the production control area equipment and the management information area equipment are embedded with national cryptographic security chips. These chips implement SM1, SM2, SM3, and SM4 encryption algorithms and interact using ISO7816 or SPI interfaces to achieve encrypted storage and secure encryption of data during the transmission of data from the production control area equipment and the management information area equipment.

[0086] The units and algorithm steps of the various examples described in the embodiments of the secure isolation-based virtual private network establishment method and system of the present invention can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the present invention.

[0087] The flowcharts and block diagrams illustrating the methods and systems for establishing secure virtual private networks (VPNs) based on various embodiments of this disclosure illustrate the architecture, functionality, and operation of possible implementations of devices, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in the flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the figures. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0088] In the method and system for establishing a secure virtual private network (VPN), it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the couplings or direct couplings or communication connections shown or discussed may be indirect couplings or communication connections through interfaces, devices, or units, or they may be electrical, mechanical, or other forms of connection.

[0089] Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a full understanding of embodiments of the invention. However, those skilled in the art will recognize that the technical solutions of the invention can be practiced without one or more of the specific details, or other methods, components, apparatuses, steps, etc., can be employed. In other instances, well-known methods, apparatuses, implementations, or operations are not shown or described in detail to avoid obscuring various aspects of the invention.

[0090] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for establishing a Virtual Private Network (VPN) based on secure isolation, characterized in that, The methods include: In the production control zone equipment, create and initialize the production virtual network device TUN / TAP, and configure the device parameters and IP address; In the management information zone equipment, create and initialize the management virtual network device TUN / TAP, and configure the device parameters and IP address; The production control area equipment communicates with the management information area equipment through a forward isolation device, while the management information area equipment communicates with the production control area equipment through a reverse isolation device, thus realizing a secure virtual private network communication connection between the production control area equipment and the management information area equipment. In the method, the equipment in the production control zone starts loop thread 1; Loop thread 1 includes: monitoring the reverse receive directory set; when the data file has been received, reading the file content, decoding it into raw data using base64, writing it to the virtual network device, and deleting the file; In this method, the equipment in the production control zone restarts loop thread 2; Loop thread 2 reads data from the virtual network device and sends the received data through the file sending interface of the forward isolation device; In the method, the management information area device starts loop thread 1; Loop thread 1 is set to the forward receive directory for monitoring. After the data file is received, it reads the file content, writes it to the virtual network device, and then deletes the file. In the method, the management information area device starts loop thread 2; Loop thread 2 reads data from the virtual network device. The received data is first encoded using base64 and then sent through the file sending interface of the reverse isolation device.

2. The method for establishing a virtual private network based on security isolation according to claim 1, characterized in that, A communication gateway is configured between the equipment in the production control area and the equipment in the management information area; The communication gateway establishes a virtual channel to ensure the security of data transmission and communication between equipment in the production control area and equipment in the management information area. The communication gateway also authenticates the access terminals to ensure their trustworthiness, and establishes a virtual channel using a secure communication protocol to encrypt the transmitted data. The communication gateway controls access permissions for devices in the production control area and management information area according to preset rules, and grants permissions to users.

3. The method for establishing a virtual private network based on security isolation according to claim 1, characterized in that, The equipment in the production control zone sends files to the management information zone through forward and reverse safety isolation devices. The management information zone equipment can send any non-empty text file to the production control zone equipment through a reverse isolation device, and it also supports sending printable characters in ASCII.

4. The method for establishing a virtual private network based on security isolation according to claim 1, characterized in that, The production control area equipment and the management information area equipment use the inotify mechanism to monitor the file system, read the received data files, and send the data to be sent through the file sending interface of the isolation device.

5. A virtual private network (VPN) establishment system based on secure isolation, characterized in that, The system adopts the VPN establishment method based on security isolation as described in any one of claims 1 to 4; The system includes: forward isolation devices, reverse isolation devices, production control area equipment, and management information area equipment; In the production control zone equipment, create and initialize the production virtual network device TUN / TAP, and configure the device parameters and IP address; In the management information zone equipment, create and initialize the management virtual network device TUN / TAP, and configure the device parameters and IP address; The production control area equipment communicates with the management information area equipment through a forward isolation device, while the management information area equipment communicates with the production control area equipment through a reverse isolation device, thus realizing a secure virtual private network communication connection between the production control area equipment and the management information area equipment.

6. The VPN establishment system based on security isolation according to claim 5, characterized in that, Virtual channels and communication gateways are configured between equipment in the production control area and equipment in the management information area. The communication gateway is used to establish a virtual channel to ensure the security of access transmission and the communication security between equipment in the production control area and equipment in the management information area; The virtual tunnel carries the network using a dedicated line or a secure SSL-based communication protocol, and the transmitted data is encrypted and protected within the virtual tunnel. All equipment in the production control area and management information area are embedded with national cryptographic security chips, which implement SM1, SM2, SM3 and SM4 encryption algorithms.

Images