Data acquisition methods, data receiving methods, devices, and data communication systems

Abstract

This invention relates to the field of communication technology, specifically providing a data acquisition method, a data receiving method, an apparatus, and a data communication system. The data acquisition method is applied to a data acquisition device in a data communication system. The data acquisition device and the data receiving device in the data communication system are connected through a forward isolation gateway. The data acquisition method includes the following steps: sending a key message to the data receiving device so that the data receiving device can verify the key message; in response to receiving a key verification success byte sent by the data receiving device, acquiring the data to be transmitted; encrypting the data to be transmitted to generate an encrypted data message, and sending it to the data receiving device. Through the above methods, this application can improve the security of data acquisition through a forward isolation gateway.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to data acquisition methods, data receiving methods, devices, and data communication systems. Background Technology

[0002] In communication systems that transmit data through a forward isolation gateway, only unidirectional data transmission from the data acquisition end to the data receiving end is allowed, and the data receiving end can only reply with a single byte. However, currently, commonly used data acquisition protocols cannot properly acquire data through a forward isolation gateway, nor can the security of data acquisition be guaranteed. Summary of the Invention

[0003] In view of this, the present invention provides a secure method for data acquisition using a data acquisition method, a data receiving method, an apparatus, and a data communication system, which enables data acquisition through a forward isolation gateway.

[0004] To address the aforementioned technical problems, this invention provides a data acquisition method applied to a data acquisition device in a data communication system. The data acquisition device and a data receiving device in the data communication system are connected via a forward isolation gateway. The data acquisition method includes the following steps: sending a key message to the data receiving device to enable the data receiving device to verify the key message; in response to receiving a key verification success byte sent by the data receiving device, acquiring the data to be transmitted; encrypting the data to be transmitted to generate an encrypted data message, and sending it to the data receiving device.

[0005] According to some embodiments of the present invention, the step of encrypting the data to be transmitted and generating an encrypted data message includes: encrypting the data to be transmitted using a key in a key message to obtain encrypted data; and encapsulating the encrypted data in a custom message format to generate an encrypted data message.

[0006] Secondly, embodiments of the present invention provide a data receiving method applied to a data receiving device in a data communication system. The data receiving device and a data acquisition device in the data communication system are connected through a forward isolation gateway. The data receiving method includes the following steps: receiving a key message sent by the data acquisition device; verifying the key message; in response to successful key message verification, generating a key verification success byte and sending it to the data acquisition device, so that the data acquisition device, in response to receiving the key verification success byte, acquires data to be transmitted, encrypts the data to be transmitted, generates an encrypted data message, and sends it to the data receiving device; receiving the encrypted data message sent by the data acquisition device; and decrypting the encrypted data message to obtain the data to be transmitted.

[0007] According to some embodiments of the present invention, the step of verifying a key message includes: verifying the key message based on the key type and message format in the key message; and determining that the key message verification is successful in response to the key type being a preset type and the message format being a custom message format.

[0008] According to some embodiments of the present invention, when the key message is successfully verified and a key verification success byte is generated, the key in the key message is obtained and stored.

[0009] According to some embodiments of the present invention, the steps of encapsulating encrypted data packets in a custom message format and decrypting the encrypted data packets to obtain data to be transmitted include: parsing the data information in the encrypted data packets using the custom message format to obtain encrypted data, and sending a parsing success byte to the data acquisition device; and decrypting the encrypted data using a key to obtain the data to be transmitted.

[0010] According to some embodiments of the present invention, the method further includes: in response to a key message verification failure, generating a key verification failure byte and sending it to the data acquisition device, while simultaneously disconnecting the communication connection with the data acquisition device.

[0011] Thirdly, embodiments of the present invention provide a data acquisition device that is communicatively connected to a data receiving device via a forward isolation gateway, including:

[0012] The sending module is used to send a key message to the data receiving device so that the data receiving device can verify the key message;

[0013] The acquisition module is used to acquire the data to be transmitted in response to receiving a key verification success byte sent by the data receiving device;

[0014] The encryption and transmission module is used to encrypt the data to be transmitted, generate encrypted data messages, and send them to the data receiving device.

[0015] Fourthly, embodiments of the present invention provide a data receiving device that is communicatively connected to a data acquisition device via a forward isolation gateway, comprising:

[0016] The first receiving module is used to receive key messages sent by the data acquisition device;

[0017] The verification module is used to verify the key message. In response to the successful verification of the key message, it generates a key verification success byte and sends it to the data acquisition device, so that the data acquisition device, in response to receiving the key verification success byte, collects the data to be transmitted, encrypts the data to be transmitted, generates an encrypted data message, and sends it to the data receiving device.

[0018] The second receiving module is used to receive encrypted data packets sent by the data acquisition device;

[0019] The decryption module is used to decrypt encrypted data packets to obtain the data to be transmitted.

[0020] Fifthly, embodiments of the present invention provide a data communication system, including a forward isolation gateway and a data acquisition device and a data receiving device that are connected to each other through the forward isolation gateway; wherein, the data acquisition device is the data acquisition device of the above embodiment, and the data receiving device is the data receiving device of the above embodiment.

[0021] The above-described technical solution of the present invention has at least one of the following beneficial effects: Before performing a data acquisition task, the data acquisition device first sends a key message to itself, enabling the data acquisition device to verify the key message and use the verification result as the basis for determining whether the current data transmission meets security and validity requirements. Only after successful key message verification does the data acquisition device begin data acquisition, thereby ensuring the security and validity of data acquisition. Furthermore, the data acquisition device encrypts the acquired data to be transmitted during data transmission, preventing the leakage of critical data during transmission and further ensuring the security of data transmission.

[0022] Furthermore, the use of a custom message format distinguishes it from other application protocols, making it impossible for outsiders to obtain valid information by capturing and analyzing encrypted data messages, thus further ensuring the security of data transmission.

[0023] Furthermore, the data acquisition device can verify the key message, determine the validity of data transmission and the security of the current communication connection based on the verification result, and feed back the verification result to the data acquisition device in byte form, thereby overcoming the drawbacks of unidirectional data transmission in the forward isolation gateway and improving the security of data acquisition and transmission.

[0024] Furthermore, when the data acquisition device fails to verify, it can directly disconnect the communication connection with the data acquisition device to prevent malicious attacks by third parties that forge messages, thereby ensuring the security of communication, avoiding invalid data transmission, and improving the accuracy of data acquisition.

[0025] Furthermore, after successfully verifying the key message, the data acquisition device can directly decrypt the subsequently received encrypted data messages without needing to verify them again, thus improving data transmission efficiency while ensuring security. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of a data communication system according to an embodiment of the present invention;

[0027] Figure 2 This is a flowchart of the data acquisition method according to an embodiment of the present invention;

[0028] Figure 3 This is a flowchart of a data collection method according to an embodiment of the present invention;

[0029] Figure 4 This is a flowchart illustrating the data communication method implemented by the data communication system according to an embodiment of the present invention;

[0030] Figure 5 This is a schematic diagram of a communication system for power system data according to an embodiment of the present invention;

[0031] Figure 6 This is a schematic diagram of a data acquisition device according to an embodiment of the present invention;

[0032] Figure 7 This is a schematic diagram of a data receiving device according to an embodiment of the present invention;

[0033] Figure 8 This is a schematic diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0034] The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples. The following examples are for illustrative purposes only and are not intended to limit the scope of the invention.

[0035] like Figure 1 As shown, the data communication system 100 of this embodiment includes a forward isolation gateway 102 and a data acquisition device 101 and a data receiving device 103 that are connected to each other through the forward isolation gateway 102. The data acquisition device 101 is the same as the data acquisition device 101 in the following embodiments, which is used to implement the data acquisition method in the following embodiments; the data receiving device 103 is the same as the data receiving device 103 in the following embodiments, which is used to implement the data receiving method in the following embodiments. The data acquisition device 101, the data receiving device 103, and their corresponding data acquisition and data receiving methods are described in detail in the following embodiments, and will not be described in detail in this embodiment.

[0036] In one embodiment, the data acquisition device 101 and the data receiving device 103 can communicate using the TCP (Transmission Control Protocol) communication protocol to further ensure the security of data transmission. In other embodiments, other communication protocols can be used according to the actual application scenario, which are not limited here. This article uses the TCP communication protocol as an example for explanation.

[0037] The forward isolation gateway 102 only allows unidirectional data transmission from the data acquisition device 101 to the data receiving device 103. The data receiving device 103 can only reply with a single byte, where only 1 bit is valid. This means the data receiving device 103 can only transmit a single 1-bit byte to the data acquisition device 101. Therefore, in existing systems using the forward isolation gateway 102 for communication, the security and effectiveness of data acquisition cannot be guaranteed. The data acquisition and data receiving methods described in the following embodiments enable data acquisition between the data acquisition device 101 and the data receiving device 103 using the forward isolation gateway 102, and improve the security of data acquisition.

[0038] like Figure 2 As shown, the data acquisition method of this invention is applied to a data acquisition device in a data communication system, wherein the data acquisition device and the data receiving device in the data communication system are connected through a forward isolation gateway. The data acquisition method includes:

[0039] Step 110: Send a key message to the data receiving device so that the data receiving device can verify the key message.

[0040] The data acquisition device responds to a data acquisition task—that is, when data needs to be collected and transmitted to the data receiving device—by sending a key message to the receiving device. This allows the receiving device to verify the key message. The data acquisition task can be triggered manually or by a controller, depending on the specific application. By verifying the key message, the receiving device can determine whether the data acquisition device is a trusted data source, i.e., whether the current communication connection is legitimate. It can also determine whether the data sent by the receiving device can be decrypted, i.e., whether the current data transmission is valid. The verification result of the key message serves as the basis for judging whether the current data transmission meets security and validity requirements. The data acquisition device can then determine whether to begin data acquisition based on the verification result, thereby ensuring the validity and security of data acquisition.

[0041] Step 120: In response to receiving a key verification success byte sent by the data receiving device, collect the data to be transmitted.

[0042] Upon receiving a key verification success byte from the data receiving device, indicating successful key message verification, the data acquisition terminal begins acquiring the data to be transmitted. Conversely, upon receiving a key verification failure byte from the data receiving device, indicating key message verification failure, the data acquisition terminal stops acquiring data, disconnects from the data acquisition terminal, then re-establishes a communication connection and sends a key message again to ensure the validity and security of data transmission.

[0043] Step 130: Encrypt the data to be transmitted, generate an encrypted data message, and send it to the data receiving device.

[0044] After the data to be transmitted is collected, it is encrypted to generate an encrypted data message, which is then sent to the data receiving device so that the data receiving device can receive the encrypted data message and obtain the original data to be transmitted.

[0045] In one embodiment, step 130 may specifically include: encrypting the data to be transmitted using the key in the key message to obtain encrypted data; and encapsulating the encrypted data in a custom message format to generate an encrypted data message. The encryption algorithm used to encrypt the data to be transmitted using the key in the key message can be set according to actual needs, such as the Chinese national cryptographic algorithm SM4, and is not limited here. It is understood that the encryption algorithm used by the data sampling device and the decryption algorithm used by the data receiving device are of the same type, thereby ensuring the accuracy of the original data to be transmitted obtained by the data receiving device from decrypting the encrypted data message.

[0046] When using the TCP communication protocol, many application protocols are involved. Using a custom message format can distinguish it from other application protocols, making it impossible for outsiders to obtain valid information by capturing and analyzing encrypted data messages, thus further ensuring the security of data transmission.

[0047] In one embodiment, the custom message format may include five parts: header identifier, type, parameters, data content length, and data content. The specific content of each part can be added and set according to actual application requirements.

[0048] In one specific embodiment, as shown in Table 1 below, Table 1 is an encrypted data message encapsulated in a custom message format in this specific embodiment. The “content” part corresponding to “type” is used to indicate that the data type in the current message is the collected data to be transmitted. 0x01 indicates the key verification success byte fed back by the data receiving device. The “content” part corresponding to “data content” is used to indicate the specific encrypted data to be transmitted, i.e., encrypted data.

[0049] Table 1 Encrypted Data Messages

[0050] Content Items Length (bytes) content Header logo 2 0x550xAA type 1 0x01 Data to be transmitted parameter 1 Default 0x0 Data content length 4 N Data content N Encrypted data

[0051] In one embodiment, the key message sent by the data acquisition device can also be encapsulated in a custom message format, so that the data receiving device can verify the message format of the key message during the verification process to ensure the security of the current communication.

[0052] In one specific embodiment, as shown in Table 2 below, Table 2 is a key message encapsulated in a custom message format in this specific embodiment. The “content” part corresponding to “type” is used to indicate that the data type in the current message is a key, 0xff indicates a key message, and the “content” part corresponding to “data content” is used to indicate specific key information.

[0053] Table 2 Key Messages

[0054] Content Items Length (bytes) content Header logo 2 0x550xAA type 1 0xff Send Key parameter 1 0x0 Data content length 4 N Data content N Key

[0055] In this embodiment, before executing the data acquisition task, the data acquisition device first sends a key message to itself. This allows the data acquisition device to verify the key message and use the verification result as the basis for determining whether the current data transmission meets security and validity requirements. Only after successful key message verification does the data acquisition device begin data acquisition, thus ensuring the security and validity of data acquisition. Furthermore, the data acquisition device encrypts the acquired data to be transmitted during data transmission, preventing the leakage of critical data during transmission and further ensuring data transmission security. In addition, the use of a custom message format distinguishes it from other application protocols, preventing external parties from obtaining valid information through packet sniffing and analysis of encrypted data messages, further guaranteeing data transmission security.

[0056] like Figure 3 As shown, the data receiving method of this invention is applied to a data receiving device in a data communication system. The data receiving device and the data acquisition device in the data communication system are connected through a forward isolation gateway. The data receiving method includes:

[0057] Step 210: Receive the key message sent by the data acquisition device.

[0058] Step 220: Verify the key message. In response to successful key message verification, generate a key verification success byte and send it to the data acquisition device. This enables the data acquisition device to collect the data to be transmitted, encrypt the data to be transmitted, generate an encrypted data message, and send it to the data receiving device.

[0059] In one embodiment, step 220, verifying the key message, may include: verifying the key message based on the key type and message format; and determining that the key message verification is successful if the key type is a preset type and the message format is a custom message format. Specifically, the validity of data transmission can be determined by determining whether the data acquisition device can decrypt the data message based on the key type in the key message; and the security of the current communication connection can be determined by determining whether the data acquisition device is a reliable data source based on the message format of the key message. By performing dual verification of the validity of data acquisition and the security of data transmission, the security of communication is further guaranteed.

[0060] In one embodiment, in response to a key message verification failure, a key verification failure byte can be generated and sent to the data acquisition device, while simultaneously disconnecting the communication connection with the data acquisition device. That is, if the key type is not a preset type or the message format is not a custom message format, it indicates that the current communication connection is insecure or the data transmission is invalid. In this case, the data receiving device can directly disconnect the communication connection with the data acquisition device to prevent malicious attacks by forged messages from third parties, thereby ensuring communication security, avoiding invalid data transmission, and improving the accuracy of data acquisition.

[0061] In one embodiment, after the data acquisition device and the data receiving device establish a connection, the data receiving device can determine that the data acquisition device is a trusted data source, i.e., the current communication connection is legitimate, only after the first received data is a key message and the key message is successfully verified. If the first received data is not a key message, or if a key message is received after the first received key message, the data acquisition device is considered not a trusted data source, i.e., the current communication connection is illegitimate, and the communication connection with the data receiving device is immediately disconnected.

[0062] Step 230: Receive encrypted data packets sent by the data acquisition device.

[0063] Step 240: Decrypt the encrypted data message to obtain the data to be transmitted.

[0064] After receiving encrypted data packets from the data acquisition device, the receiving device decrypts the encrypted data packets to obtain the data to be transmitted. Understandably, after successfully verifying the key packet, the receiving device can directly decrypt subsequently received encrypted data packets without needing to verify them again, thus improving data transmission efficiency while ensuring security.

[0065] In one embodiment, when the key message is successfully verified and a key verification success byte is generated, the key in the key message can be obtained and stored so as to decrypt the encrypted data message.

[0066] In one embodiment, step 240 may specifically include: parsing the data information in the encrypted data message using a custom message format to obtain encrypted data, and sending the parsing success byte to the data acquisition device; and decrypting the encrypted data using a key to obtain the data to be transmitted.

[0067] In one embodiment, upon successful message parsing (i.e., obtaining encrypted data), a parsing success byte can be sent to the data acquisition device, and then the encrypted data can be decrypted using a key. Alternatively, upon successful decryption (i.e., obtaining data to be transmitted), the data to be transmitted can be sent to the backend data collection system. Furthermore, upon failed message parsing or decryption, a parsing failure byte or decryption failure byte can be sent to the data acquisition device, and the connection with the data acquisition device can be disconnected, further ensuring the effectiveness of data acquisition and the security of transmission.

[0068] In this embodiment, the data acquisition device can verify the key message, determine the validity of data transmission and the security of the current communication connection based on the verification result, and feed back the verification result to the data acquisition device in byte form. This overcomes the drawbacks of unidirectional data transmission in forward isolation gateways and improves the security of data acquisition and transmission. Furthermore, if verification fails, the communication connection with the data acquisition device can be directly disconnected to prevent malicious attacks by third parties using forged messages, thus ensuring communication security and avoiding invalid data transmission, thereby improving the accuracy of data acquisition. In addition, after successful verification of the key message, subsequent received encrypted data messages can be directly decrypted without further verification, thus improving data transmission efficiency while ensuring security.

[0069] like Figure 4 As shown, the data communication method executed by the data communication system in the above embodiments will be described below in the form of data interaction between the data acquisition device and the data receiving device. The data communication method executed by the data communication system includes the data acquisition method implemented by the data acquisition device and the data receiving method implemented by the data receiving device. The data communication system can greatly improve the security of data acquisition through the following data communication method.

[0070] S1: The data acquisition device sends a key message to the data receiving device.

[0071] S2: The data receiving device receives the key message sent by the data acquisition device and stores the key in the key message.

[0072] S3: The data receiving device verifies the key message. In response to the key message verification failure, it generates a key verification failure byte and sends it to the data acquisition device, while simultaneously disconnecting the communication connection with the data acquisition device.

[0073] S4: The data receiving device verifies the key message. In response to the successful verification of the key message, it generates a key verification success byte and sends it to the data acquisition device.

[0074] S5: The data acquisition device responds to receiving the key verification success byte sent by the data receiving device and acquires the data to be transmitted.

[0075] S6: The data acquisition device encrypts the data to be transmitted, generates encrypted data messages, and sends them to the data receiving device.

[0076] S7: The data receiving device receives encrypted data packets sent by the data acquisition device.

[0077] S8: Decrypt the encrypted data message to obtain the data to be transmitted.

[0078] Understandably, the contents of S1 to S8 described above are the same as those described in the above embodiments, and will not be repeated here.

[0079] In one embodiment, the above-mentioned data communication system can be a power system data communication system. That is to say, the above-mentioned data communication method can be applied to the data communication scenario of the power system. The composition of the power system will be briefly introduced below.

[0080] In the power sector, based on security requirements, the power secondary system is divided into a production control zone and a management information zone. The production control zone can be further divided into a control zone (also known as security zone 1) and a non-control zone (also known as security zone 2). Security zone 1 enables real-time monitoring of the power primary system. Security zone 2 enables online monitoring of data but does not have control functions. It is closely connected with the business systems or functional modules in the control zone and is a non-network-connected side, not allowed to interact with the Internet. Security zone 3 is the production management zone, which can interact with the Internet when protected by a firewall.

[0081] Currently, to monitor the energy consumption of key energy-consuming units, an online energy consumption monitoring system is installed in the power system. This system collects energy consumption data from these units and periodically calculates and uploads their energy consumption indicators. The online energy consumption monitoring system mainly includes modules for data acquisition, data merging, indicator calculation, and indicator uploading, which will not be described in detail here.

[0082] Currently, online energy consumption monitoring systems are generally deployed in Safety Zone 3 to facilitate internet access. The data collected (i.e., energy consumption data of key energy-consuming units) typically comes from online monitoring data in Safety Zone 2. According to the aforementioned safety protection requirements in the power sector, Safety Zone 2 and Safety Zone 3 are not allowed to communicate directly via network; they must communicate through a forward isolation gateway. This presents a problem where data collection cannot be performed normally through the forward isolation gateway.

[0083] Therefore, in the data communication scenario between security zone 2 and security zone 3 in the above power system, the data communication method proposed in the above embodiments can overcome the problem of normal data collection through the forward isolation gateway, while ensuring the security of data collection.

[0084] The following describes an embodiment of a power system data communication system applying the above-described data communication method. It is understood that this embodiment is only illustrated using a data communication scenario applied to a power system as an example. Actual application scenarios are not limited to this; the above-described data communication method applies to any scenario where data is collected and transmitted through a forward isolation gateway. Detailed examples will not be provided here.

[0085] like Figure 5 As shown, in the power system, Safety Zone 2 acts as a data acquisition device, and Safety Zone 3 acts as a data receiving device. Safety Zone 2 is connected to the internal network side of the forward isolation gateway via a network cable, and Safety Zone 3 is connected to the external network side of the forward isolation gateway via a network cable. Communication between Safety Zone 2 and Safety Zone 3 uses the TCP protocol. Safety Zone 2 connects to the industrial control system or database system via a network cable to collect energy consumption data from key energy-consuming units and send it to Safety Zone 3. Safety Zone 3 connects to the online energy consumption monitoring system via a network cable to receive energy consumption data from key energy-consuming units and send this data as events to the online energy consumption monitoring system, enabling the online energy consumption monitoring system to calculate and upload energy consumption indicators for these units based on the data.

[0086] The following describes the data communication methods and steps performed between Security Zone 2 and Security Zone 3.

[0087] 1. Security Zone 2 can first establish a TCP connection from the internal network side of the forward isolation gateway to the external network side of Security Zone 3. After the connection is successfully established, Security Zone 2 sends a key message containing a randomly generated key to Security Zone 3 in a custom message format.

[0088] 2. Security Zone 3 receives the key message and verifies it. If the verification fails or the first message received is not a key message, it replies with a key verification failure byte to Security Zone 2 and terminates communication with Security Zone 2.

[0089] 3. If the key message meets the custom message format and the key type is the preset type, the verification is successful. Security Zone 3 replies to Security Zone 2 with a key verification success byte and records the key in the key message.

[0090] 4. If Security Zone 2 receives a key verification failure byte, it will interrupt communication with Security Zone 3, re-establish a TCP connection and send a key message, thereby ensuring that Security Zone 3 can normally decrypt the energy consumption data of key energy-consuming units encrypted with the key sent by Security Zone 2.

[0091] 5. If Security Zone 2 receives a key verification success byte from Security Zone 3, it determines that Security Zone 3 has received the key and begins collecting energy consumption data from key energy-consuming units.

[0092] 6. After collecting energy consumption data of key energy-consuming units, the second security zone first uses a key to encrypt the energy consumption data of key energy-consuming units using the national cryptographic algorithm SM4 to obtain encrypted data. Then, the encrypted data is encapsulated in a custom message format to generate an encrypted data message, and the encrypted data message is sent to the third security zone on the external network side of the forward isolation gateway.

[0093] 7. Security Zone 3 receives encrypted data packets, parses the data information in the encrypted data packets using a custom message format to obtain encrypted data, and sends a parsing success byte to Security Zone 2. Then, it uses a key to decrypt the encrypted data using the national cryptographic algorithm SM4 to obtain the energy consumption data of key energy-consuming units. This data is then sent to the online energy consumption monitoring system as an event, enabling the system to calculate and upload energy consumption indicators for these units. If parsing or decryption of the encrypted data packets fails, a parsing failure byte or decryption failure byte is sent to Security Zone 2, and communication with Security Zone 2 is interrupted.

[0094] This embodiment applies a data communication method to a power system, solving the problem that secure data acquisition is impossible through a forward isolation gateway in a power system. It enables data acquisition while meeting the security requirements of the power system, and encrypts the acquired data during transmission to prevent the leakage of critical data in the power system during transmission, thus ensuring data security.

[0095] like Figure 6 As shown, the data acquisition device 600 of this embodiment of the invention is connected to the data receiving device through a forward isolation gateway, and includes a sending module 601, an acquisition module 602, and an encryption and sending module 603.

[0096] The sending module 601 is used to send a key message to the data receiving device so that the data receiving device can verify the key message.

[0097] The acquisition module 602 is used to acquire the data to be transmitted in response to receiving a key verification success byte sent by the data receiving device.

[0098] The encryption and transmission module 603 is used to encrypt the data to be transmitted, generate encrypted data messages, and send them to the data receiving device.

[0099] like Figure 7 As shown, the data receiving device 700 of this embodiment of the invention is connected to the data acquisition device through a forward isolation gateway, and includes a first receiving module 701, a verification module 702, a second receiving module 703, and a decryption module 704.

[0100] The first receiving module 701 is used to receive key messages sent by the data acquisition device.

[0101] The verification module 702 is used to verify the key message. In response to the successful verification of the key message, it generates a key verification success byte and sends it to the data acquisition device, so that the data acquisition device, in response to receiving the key verification success byte, collects the data to be transmitted, encrypts the data to be transmitted, generates an encrypted data message, and sends it to the data receiving device.

[0102] The second receiving module 703 is used to receive encrypted data packets sent by the data acquisition device.

[0103] The decryption module 704 is used to decrypt encrypted data packets to obtain the data to be transmitted.

[0104] It should be noted that the data acquisition device 600 and data receiving device 700 provided in the above embodiments are only illustrated by the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the devices and corresponding method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the corresponding method embodiments, which will not be repeated here.

[0105] One embodiment of the present invention also provides an electronic device, which includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, the at least one instruction or the at least one program being loaded and executed by the processor to implement the data acquisition method or data reception method provided in the above method embodiments.

[0106] Memory is used to store software programs and modules. The processor executes these stored software programs and modules to perform various functional applications and data processing. Memory can primarily consist of a program storage area and a data storage area. The program storage area stores the operating system, application programs required for functionality, etc.; the data storage area stores data created based on device usage, etc. Furthermore, memory can include high-speed random access memory (RAM) and non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, memory can also include a memory controller to provide the processor with access to the memory.

[0107] In one specific embodiment Figure 8 A schematic diagram of the structure of an electronic device for implementing the embodiments of the present invention is shown. The electronic device may be a computer terminal, a mobile terminal or other device. The electronic device may also participate in or include the data acquisition device or data receiving device provided in the embodiments of the present invention.

[0108] like Figure 8 As shown, an embodiment of the present invention provides an electronic device 800, including a processor 801 and a memory 802. The memory 802 stores computer program instructions, wherein when the computer program instructions are executed by the processor, the processor 801 performs the data acquisition method or data reception method provided in the above-described method embodiment.

[0109] Furthermore, such as Figure 8 As shown, the electronic device 800 also includes a network interface 803, an input device 804, a hard disk 805, and a display device 806.

[0110] The various interfaces and devices described above can be interconnected via a bus architecture. The bus architecture can include any number of interconnecting buses and bridges. Specifically, various circuits representing one or more central processing units (CPUs), represented by processor 801, and one or more memories, represented by memory 802, are connected together. The bus architecture can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits. It is understood that the bus architecture is used to implement communication between these components. In addition to the data bus, the bus architecture also includes a power bus, a control bus, and a status signal bus, which are well known in the art and will not be described in detail herein.

[0111] The network interface 803 can be connected to a network (such as the Internet, a local area network, etc.), obtain relevant data from the network, and save it to the hard disk 805.

[0112] The input device 804 can receive various instructions input by the operator and send them to the processor 801 for execution. The input device 804 may include a keyboard or a clicking device, such as a mouse, trackball, touchpad, or touch screen.

[0113] The display device 806 can display the results obtained by the processor 801 executing instructions.

[0114] The memory 802 is used to store programs and data necessary for the operation of the operating system, as well as intermediate results and other data during the calculation process of the processor 801.

[0115] It is understood that the memory 802 in the embodiments of the present invention may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory may be random access memory (RAM), which is used as an external cache. The memory 802 of the apparatus and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0116] In some implementations, memory 802 stores elements such as executable modules or data structures, or subsets thereof, or extended sets thereof: operating system 8021 and application programs 8022.

[0117] The operating system 8021 includes various system programs, such as the framework layer, core library layer, and driver layer, used to implement various basic business functions and handle hardware-based tasks. The application program 8022 includes various applications, such as a browser, used to implement various application functions. The program implementing the method of this embodiment can be included in the application program 8022.

[0118] When the processor 801 calls and executes the application program and data stored in the memory 802, specifically the program or instructions stored in the application program 8022, it executes the data acquisition method or data receiving method provided in the above method embodiments.

[0119] The methods disclosed in the above embodiments of the present invention can be applied to processor 801, or implemented by processor 801. Processor 801 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in processor 801 or by instructions in software form. The processor 801 may be a general-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), off-the-shelf programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware component, and can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of the present invention can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules may be located in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. The storage medium is located in memory 802, and processor 801 reads the information in memory 802 and completes the steps of the above method in combination with its hardware.

[0120] It is understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described herein, or combinations thereof.

[0121] For software implementation, the techniques described herein can be achieved through modules (e.g., procedures, functions, etc.) that perform the functions described herein. The software code can be stored in memory and executed by a processor. The memory can be implemented within the processor or externally.

[0122] In addition, embodiments of the present invention also provide a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the data acquisition method, data reception method, or data communication method provided in the above-described method embodiments.

[0123] In the several embodiments provided in this application, it should be understood that the disclosed methods and apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0124] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can be physically comprised separately, or two or more units can be integrated into one unit. The integrated unit described above can be implemented in hardware or in the form of hardware plus software functional units.

[0125] The integrated units implemented as software functional units described above can be stored in a computer-readable storage medium. These software functional units, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute some steps of the transmission and reception methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0126] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A data acquisition method, characterized in that, A data acquisition device is used in a data communication system. The data acquisition device and the data receiving device in the data communication system are connected through a forward isolation gateway. The forward isolation gateway only allows the data acquisition device to transmit data unidirectionally to the data receiving device, and the data receiving device can only reply with a single byte to the data acquisition device. The data acquisition method includes the following steps: Send a key message to the data receiving device so that the data receiving device can verify the key message; In response to receiving a key verification success byte sent by the data receiving device, the data to be transmitted is collected; The data to be transmitted is encrypted using the key in the key message to generate an encrypted data message, which is then sent to the data receiving device.

2. The data acquisition method according to claim 1, characterized in that, The step of encrypting the data to be transmitted and generating an encrypted data message includes: The data to be transmitted is encrypted using the key in the key message to obtain encrypted data; The encrypted data is encapsulated in a custom message format to generate the encrypted data message.

3. A data receiving method, characterized in that, A data receiving device used in a data communication system, wherein the data receiving device and the data acquisition device in the data communication system are connected through a forward isolation gateway, wherein the forward isolation gateway only allows the data acquisition device to transmit data unidirectionally to the data receiving device, and the data receiving device can only reply with a single byte to the data acquisition device; The data receiving method includes the following steps: Receive the key message sent by the data acquisition device; The key message is verified. In response to the successful verification of the key message, a key verification success byte is generated and sent to the data acquisition device. In response to receiving the key verification success byte, the data acquisition device acquires the data to be transmitted, and uses the key in the key message to encrypt the data to be transmitted, generating an encrypted data message and sending it to the data receiving device. Receive encrypted data packets sent by the data acquisition device; The encrypted data message is decrypted using the key to obtain the data to be transmitted, wherein the key is obtained by the data receiving device based on the key message.

4. The data receiving method according to claim 3, characterized in that, The step of verifying the key message includes: The key message is verified based on the key type and message format in the key message; In response to the fact that the key type is a preset type and the message format is a custom message format, it is determined that the key message verification is successful.

5. The data receiving method according to claim 3, characterized in that, Upon successful verification of the key message and the generation of a key verification success byte, the key in the key message is acquired and stored.

6. The data receiving method according to claim 5, characterized in that, The encrypted data packet is encapsulated in a custom message format. The step of decrypting the encrypted data packet to obtain the data to be transmitted includes: The data information in the encrypted data message is parsed using the custom message format to obtain encrypted data, and a parsing success byte is sent to the data acquisition device. The encrypted data is decrypted using the key to obtain the data to be transmitted.

7. The data receiving method according to claim 3, characterized in that, The method further includes: In response to the failure of the key message verification, a key verification failure byte is generated and sent to the data acquisition device, while the communication connection with the data acquisition device is disconnected.

8. A data acquisition device, characterized in that, The data acquisition device communicates with the data receiving device through a forward isolation gateway, which only allows the data acquisition device to transmit data unidirectionally to the data receiving device, and the data receiving device can only reply with a single byte to the data acquisition device. The data acquisition device includes: A sending module is used to send a key message to the data receiving device so that the data receiving device can verify the key message; The acquisition module is used to acquire the data to be transmitted in response to receiving a key verification success byte sent by the data receiving device; The encryption and transmission module is used to encrypt the data to be transmitted using the key in the key message, generate an encrypted data message, and send it to the data receiving device.

9. A data receiving device, characterized in that, The data acquisition device is connected to the data receiving device via a forward isolation gateway, which only allows the data acquisition device to transmit data unidirectionally to the data receiving device, and the data receiving device can only reply with a single byte to the data acquisition device. The data receiving device includes: The first receiving module is used to receive the key message sent by the data acquisition device; The verification module is used to verify the key message. In response to the successful verification of the key message, it generates a key verification success byte and sends it to the data acquisition device, so that the data acquisition device, in response to receiving the key verification success byte, acquires the data to be transmitted, and uses the key in the key message to encrypt the data to be transmitted, generates an encrypted data message, and sends it to the data receiving device. The second receiving module is used to receive encrypted data packets sent by the data acquisition device; The decryption module is used to decrypt the encrypted data message using the key to obtain the data to be transmitted, wherein the key is obtained by the data receiving device based on the key message.

10. A data communication system, characterized in that, It includes a forward isolation gateway and a data acquisition device and a data receiving device that are connected to each other through the forward isolation gateway; wherein the data acquisition device is the data acquisition device of claim 8, and the data receiving device is the data receiving device of claim 9.

Images