Road traffic management information transmitting and receiving and safety protection system in public network environment

Abstract

The invention relates to the technical field of traffic management safety, and discloses a road traffic management information receiving and sending and safety protection system in a public network environment, which is provided with a terminal identity authentication and authorization module, verifying the capability of accessing the network transmission layer of the network terminals of various different service types, authorizing a data receiving and transmitting interface, and recording the terminal identity; the system is also provided with a gateway module which is used for receiving a data message and carrying out digital signature, encryption, decryption, signature verification and data message analysis on the data message. The system is also provided with an active monitoring module which is used for monitoring the network terminals of various different service types based on the analyzed data message, generating and pushing an early warning when an abnormal condition is found, and generating an emergency disposal plan. According to the invention, the problem that authenticity, accuracy and reliability of traffic management information receiving and transmitting are difficult to guarantee due to lack of a safety protection mechanism in a public network environment is solved.

Description

Technical Field

[0001] The present invention relates to the field of road traffic management safety technology, and in particular to a road traffic management information receiving and sending and safety protection system in a public network environment. Background Art

[0002] In recent years, the traffic management department has thoroughly implemented the strategic deployment of developing the police force through science and technology and big data, and gradually built a fully covered and fully networked road monitoring system and traffic management business processing and service system, which has brought together data resources related to traffic management, such as motor vehicles, driver's licenses, traffic violations, traffic accidents, and vehicle trajectories. Most of these information systems and collected data involve people's livelihood, public interests, and personal privacy information, and are characterized by large scale, wide range, and high value. In order to promote the goal of facilitating the people and enterprises and sharing data with external units, some road traffic management information needs to be placed on the public network for sending and receiving. Since the public network security protection system is quite different from the security protection system of the self-built network, information network security problems occur frequently, especially security incidents such as data leakage. After analysis, the main problems are reflected in the following aspects:

[0003] 1. Unauthorized devices are connected to the public network at will, and the authenticity of information sent and received is difficult to guarantee. First, hackers forge virtual field devices and send malicious codes or data messages containing illegal and reactionary information to the network center node, causing the network center node to fail to operate or trigger social public opinion events. Second, unauthorized field devices do not communicate with the network center node according to the correct protocol message, causing the network center node to waste computing resources and causing normal business to be unable to run stably.

[0004] 2. There is a risk of theft or tampering during data transmission, and the accuracy of information transmission and reception is difficult to guarantee. When a network terminal uploads data to a network center node through a public network, if data is transmitted through a plain text and insecure channel, there is a vulnerability that network data messages can be intercepted or maliciously tampered with, resulting in network data being stolen or unable to be transmitted normally.

[0005] 3. Lack of proactive security risk prevention mechanism, and the reliability of information transmission and reception is difficult to guarantee. In the case of malicious network attacks and abnormal operation of batch equipment, the current situation is often discovered and dealt with after the fact, and there is a lack of proactive discovery and early warning technology in advance, which leads to passive work. Therefore, it is necessary to establish an effective equipment safety early warning supervision system. Summary of the invention

[0006] In view of this, the present invention provides a road traffic management information receiving and sending and security protection system in a public network environment to solve the problem that the authenticity, accuracy and reliability of traffic management information receiving and sending are difficult to ensure due to the lack of a security protection mechanism in a public network environment.

[0007] In a first aspect, the present invention provides a road traffic management information receiving and sending and safety protection system in a public network environment, the system comprising a network center node layer, a network transmission layer and a network terminal layer connected in sequence;

[0008] A terminal identity authentication and authorization module is provided at the network terminal layer, and the terminal identity authentication and authorization module is connected to network terminals of various business types at the network terminal layer; the terminal identity authentication and authorization module is used to verify the ability of network terminals of various business types to access the network transmission layer, authorize the data transmission and reception interfaces, and record the terminal identities when network terminals of various business types interact with the network center node layer through the public network via the network transmission layer;

[0009] Gateway modules are provided at both the network transmission layer and the network center node layer. The gateway modules are used to receive data messages transmitted by network terminals of various service types in the network terminal layer, and use national secret algorithms and key management mechanisms to digitally sign, encrypt, decrypt, verify signatures, and parse data messages.

[0010] An active monitoring module is also provided at the network center node layer. The active monitoring module is used to receive the parsed data messages transmitted by the gateway module, monitor the working status, data transmission quality, and instruction execution status of network terminals of various business types based on the parsed data messages, generate early warning information for network terminals in abnormal status, and generate disposal plans based on the early warning information.

[0011] The road traffic management information receiving and sending and security protection system in a public network environment provided by the present invention establishes a device integrated access authorization mechanism by setting a terminal identity authentication authorization module for network terminal equipment, realizes identity authentication of network terminals, ensures the authenticity of information receiving and sending, sets a gateway module, and adopts a national secret algorithm and a key management mechanism to establish a data security transmission mechanism between a network center node and a network terminal, prevents data messages from being stolen and tampered with during transmission in a public network, ensures the accuracy of information receiving and sending, and further provides an active monitoring module at the network center node layer, establishes a data monitoring and early warning mechanism, and can promptly issue a security warning and initiate a disposal plan when an abnormal situation occurs, and take corresponding measures, thereby solving the problem that the authenticity, accuracy and reliability of traffic management information receiving and sending are difficult to ensure due to the lack of a security protection mechanism in a public network environment.

[0012] In an optional implementation, the terminal identity authentication and authorization module includes a test entry submodule, an interface authorization submodule and a terminal filing submodule; network terminals of various service types access the network center node layer through the network transmission layer via the public network through the test entry submodule, the interface authorization submodule and the terminal filing submodule;

[0013] The test entry submodule is used to verify whether the network terminal has the ability to communicate and interact with the network transport layer in accordance with the agreed protocol message format;

[0014] The interface authorization submodule is used to allocate an interface serial number to each network terminal that intends to access the network transport layer through the public network;

[0015] The terminal filing submodule is used to assign a unique filing number to the network terminal that has obtained the interface serial number.

[0016] The road traffic management information receiving and sending and safety protection system under the public network environment provided by the present invention verifies whether the network terminal has the ability to communicate and interact with the network transmission layer through the public network in accordance with the agreed protocol message format through the test entry submodule; the interface authorization submodule allocates an interface serial number to each network terminal that intends to access the network transmission layer through the public network; the terminal filing submodule allocates a unique filing number to the network terminal that has obtained the interface serial number, thereby realizing the capability verification, authorization and filing of the network terminal equipment, and providing data authenticity, accuracy and reliability guarantees for the network terminal uploading data to the network center node.

[0017] In an optional implementation, the national encryption algorithm includes an asymmetric encryption algorithm and a symmetric encryption algorithm, and the gateway module includes a first gateway module and a second gateway module;

[0018] The first gateway module is arranged at the network center node layer, and the network center node layer also includes an encryption machine device, in which key information is stored; the first gateway module is used to obtain the key information from the encryption machine device and use a symmetric encryption algorithm to encrypt or decrypt the data message, and use an asymmetric encryption algorithm to digitally sign or verify the data message, and generate and save a key index corresponding to the key information;

[0019] The second gateway module is arranged at the network transmission layer, and is used to obtain the second key information from the external storage device and use the symmetric encryption algorithm to encrypt or decrypt the data message, and use the asymmetric encryption algorithm to digitally sign or verify the data message.

[0020] In an optional implementation, the first gateway module includes a first data security transmission submodule, a first national secret encryption service submodule, and a national secret key management submodule;

[0021] The first data security transmission submodule is used to receive data messages transmitted by network terminals, and establish a virtual private network between the network center node layer and the network terminal layer, and build a network tunnel in the virtual private network through the national secret security gateway to transmit the data message to the network center node through the network tunnel;

[0022] The first national secret encryption service submodule is used to encrypt or decrypt data messages using a symmetric encryption algorithm, and to digitally sign or verify data messages using an asymmetric encryption algorithm, so as to obtain key information from the encryption device through the key index during the verification process;

[0023] The national secret key management submodule is used to record and save the key index corresponding to the key information of digital signature and encryption processing, and save the key information to an external storage device.

[0024] The road traffic management information receiving and sending and security protection system under a public network environment provided by the present invention has a first gateway module that establishes a virtual private network between a network center node layer and a network terminal layer through a first data security transmission submodule, and constructs a network tunnel in the virtual private network through a national secret security gateway to transmit data messages to a network center node through the network tunnel, and performs data encryption or decryption, digital signature or signature verification processing through a first national secret encryption service submodule, and records and saves key indexes corresponding to key information of digital signatures and encryption processing through a national secret key management submodule, and saves the key information in an external storage device, thereby achieving the purpose of protecting the accuracy of data messages.

[0025] In an optional implementation, the second gateway module includes a second data security transmission submodule and a second national secret encryption service submodule;

[0026] The second data security transmission submodule is used to send and receive data messages transmitted between the network terminal and the network center layer, and establish a virtual private network between the network center node layer and the network terminal layer, and build a network tunnel in the virtual private network through the national secret security gateway to transmit the data message to the network center node through the network tunnel;

[0027] The second national secret encryption service submodule is used to encrypt or decrypt data messages using a symmetric encryption algorithm, and to digitally sign or verify data messages using an asymmetric encryption algorithm.

[0028] The road traffic management information receiving and sending and security protection system under the public network environment provided by the present invention has a second gateway module corresponding to the first gateway module, and a virtual private network is established between the network center node layer and the network terminal layer through the second data security transmission submodule, and a network tunnel is constructed in the virtual private network through the national secret security gateway to transmit the data message to the network center node through the network tunnel, and the data is encrypted or decrypted, digitally signed or verified through the second national secret encryption service submodule, so as to achieve the purpose of protecting the accuracy of the data message.

[0029] In an optional implementation, the active monitoring module includes a data monitoring submodule and an early warning push disposal submodule;

[0030] The data monitoring submodule is used to construct a data monitoring model for the network terminal layer based on the parsed data message, and evaluate the operating status of various network terminals of different service types in the network terminal layer through the data monitoring model;

[0031] The early warning push disposal submodule is used to generate early warning information for network terminals in abnormal states and push the early warning information to the network center node so that the network center node generates a disposal plan based on the early warning information.

[0032] The road traffic management information receiving and sending and safety protection system under the public network environment provided by the present invention comprises a data monitoring submodule which constructs a data monitoring model for the network terminal layer based on the parsed data message, and evaluates the operation status of network terminals of various different business types in the network terminal layer through the data monitoring model; an early warning push disposal submodule is used to generate early warning information for network terminals in abnormal status, and push the early warning information to the network center node, so that the network center node generates a disposal plan based on the early warning information; by establishing a monitoring and early warning module, it is possible to timely carry out safety warnings and initiate disposal plans when abnormal situations occur, and take corresponding measures.

[0033] In a second aspect, the present invention provides a method for sending and receiving road traffic management information and protecting safety in a public network environment, which is applied to a system for sending and receiving road traffic management information and protecting safety in a public network environment according to the first aspect or any corresponding embodiment thereof, and the method comprises:

[0034] When network terminals of different service types exchange data messages with the network center node layer through the public network via the network transmission layer, the ability of network terminals of different service types to access the network transmission layer is verified, the data transmission and reception interfaces are authorized, and the terminal identities are recorded;

[0035] Receive data messages transmitted by network terminals of various service types, and use national secret algorithms and key management mechanisms to digitally sign, encrypt, decrypt, verify signatures, and parse data messages;

[0036] Receive parsed data messages, monitor the working status, data transmission quality, and instruction execution status of network terminals of various business types based on the parsed data messages, generate warning information when abnormal situations are found, and generate disposal plans based on the warning information.

[0037] In a third aspect, the present invention provides a computer device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the method for sending and receiving road traffic management information and protecting safety in a public network environment of the above-mentioned second aspect or any corresponding embodiment thereof by executing the computer instructions.

[0038] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the method for sending and receiving road traffic management information and for safety protection in a public network environment of the above-mentioned second aspect or any corresponding embodiment thereof.

[0039] In a fifth aspect, the present invention provides a computer program product, including computer instructions, which are used to enable a computer to execute the method for sending and receiving road traffic management information and safety protection in a public network environment of the above-mentioned second aspect or any corresponding embodiment. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 is a schematic diagram of the structure of a road traffic management information receiving and sending and safety protection system in a public network environment according to an embodiment of the present invention;

[0042] Figure 2 is a schematic diagram of the structure of a road traffic management information receiving and sending and safety protection system in a public network environment according to an embodiment of the present invention;

[0043] Figure 3 It is a flowchart of a method for sending and receiving road traffic management information and protecting safety in a public network environment according to an embodiment of the present invention;

[0044] Figure 4 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0046] In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0047] In the description of the present invention, it should be noted that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, it can also be the internal connection of two components, it can be a wireless connection, or it can be a wired connection. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0048] In addition, the technical features involved in the different embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0049] According to an embodiment of the present invention, an embodiment of a method for sending and receiving road traffic management information and protecting safety in a public network environment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0050] In this embodiment, a road traffic management information receiving and sending and safety protection system is provided in a public network environment. Figure 1 is a structural diagram of a road traffic management information receiving and sending and safety protection system in a public network environment according to an embodiment of the present invention, such as Figure 1 As shown, the system includes: a network center node layer, a network transmission layer and a network terminal layer which are connected in sequence.

[0051] A terminal identity authentication and authorization module is provided at the network terminal layer, and the terminal identity authentication and authorization module is connected to network terminals of various different business types at the network terminal layer; the terminal identity authentication and authorization module is used to verify the ability of network terminals of various different business types to access the network transmission layer, authorize the data sending and receiving interfaces, and record the terminal identities when network terminals of various business types exchange data messages with the network center node layer through the public network via the network transmission layer.

[0052] Gateway modules are set up in both the network transmission layer and the network center node layer. The gateway modules are used to receive data messages transmitted by network terminals of various different business types in the network terminal layer, and use national secret algorithms and key management mechanisms to digitally sign, encrypt, decrypt, verify signatures and parse data messages.

[0053] An active monitoring module is also provided at the network center node layer. The active monitoring module is used to receive the parsed data messages transmitted by the gateway module, monitor the working status, data transmission quality, and instruction execution status of network terminals of various business types based on the parsed data messages, generate early warning information when abnormal situations are found, and generate disposal plans based on the early warning information.

[0054] The road traffic management information receiving and sending and security protection system in a public network environment provided by this embodiment, by setting a terminal identity authentication authorization module for the network terminal equipment, establishing a device integrated access authorization mechanism, realizing identity authentication of the network terminal, ensuring the authenticity of information reception and sending, setting a gateway module, and using a national secret algorithm and a key management mechanism to establish a data security transmission mechanism between the network center node and the network terminal, to prevent data messages from being stolen and tampered with during the public network transmission process, to ensure the accuracy of information reception and sending, and an active monitoring module is also provided at the network center node layer, to establish a data monitoring and early warning mechanism to ensure that when an abnormal situation occurs, a security warning can be issued in time and a disposal plan can be initiated, and corresponding measures can be taken, thereby solving the problem that the authenticity, accuracy and reliability of the traffic management information reception and sending are difficult to ensure due to the lack of a security protection mechanism in a public network environment.

[0055] In an optional embodiment, if Figure 2 As shown, the terminal identity authentication and authorization module includes a test entry submodule, an interface authorization submodule and a terminal filing submodule; network terminals of various different business types access the network center node layer through the public network via the network transmission layer through the test entry submodule, the interface authorization submodule and the terminal filing submodule.

[0056] The test entry submodule is used to verify whether the network terminal has the ability to communicate and interact with the network transport layer in accordance with the agreed protocol message format. Specifically, the network terminal is verified through a laboratory environment test to verify whether it has the ability to communicate and interact with the gateway module of the network transport layer in accordance with the agreed protocol message format. After the test verification is passed, the network terminal of this manufacturer will be shortlisted for the qualified list of system integration terminals.

[0057] The interface authorization submodule is used to assign an interface serial number to each network terminal that intends to access the network transmission layer through the public network. Specifically, the interface authorization submodule assigns an interface serial number to the terminal that intends to access the network transmission layer. With the interface serial number, the road traffic management information transceiver and safety protection system in the public network environment recognizes the data message reported by the network terminal as legal data.

[0058] The terminal filing submodule is used to assign a unique filing number to the network terminal that has obtained the interface serial number. Specifically, the terminal filing module assigns a unique filing number to the network terminal that has accessed the public network by filling in a filing application for the manufacturer terminal that has obtained the interface serial number, as the only legal identification of the terminal in the public network.

[0059] After completing the above test entry, interface authorization and filing the network terminal in the public network, the network terminal can communicate with the public network through data messages that comply with the protocol.

[0060] The road traffic management information transmission and reception security protection traffic management information transmission and reception and security protection system provided in this embodiment verifies whether the network terminal has the ability to communicate and interact with the network transmission layer through the public network in accordance with the agreed protocol message format through the test entry sub-module; the interface authorization sub-module assigns an interface serial number to each network terminal that intends to access the network transmission layer through the public network; the terminal filing sub-module assigns a unique filing number to the network terminal that has obtained the interface serial number, thereby realizing the capability verification, authorization and filing of the network terminal equipment, and providing data authenticity, accuracy and reliability security guarantees for the network terminal uploading data to the network center node.

[0061] The gateway module is a functional module that performs data security transmission and data encryption and decryption processing to achieve data accuracy protection.

[0062] In an optional embodiment, if Figure 2 As shown, the national encryption algorithm includes an asymmetric encryption algorithm and a symmetric encryption algorithm, and the gateway module includes a first gateway module and a second gateway module.

[0063] The first gateway module is arranged at the network center node layer, and the network center node layer also includes an encryption machine device, in which key information is stored; the first gateway module is used to obtain key information from the encryption machine device and use a symmetric encryption algorithm to encrypt or decrypt data messages, and use an asymmetric encryption algorithm to digitally sign or verify data messages, and generate and save a key index corresponding to the key information.

[0064] Specifically, Figure 2 As shown, the first gateway module includes a first data security transmission submodule, a first national secret encryption service submodule and a national secret key management submodule;

[0065] The first data security transmission submodule is used to receive data packets transmitted by network terminals, and establish a virtual private network between the network center node layer and the network terminal layer, and build a network tunnel in the virtual private network through the national secret security gateway to transmit data packets to the network center node through the network tunnel.

[0066] The first national secret encryption service submodule is used to encrypt or decrypt data messages using a symmetric encryption algorithm, and to digitally sign or verify data messages using an asymmetric encryption algorithm, so as to obtain key information from the encryption device through the key index during the signature verification process.

[0067] The national secret key management submodule is used to record and save the key index corresponding to the key information of digital signature and encryption processing, and save the key information to an external storage device.

[0068] The second gateway module is arranged at the network transmission layer, and is used to obtain the second key information from the external storage device and use the symmetric encryption algorithm to encrypt or decrypt the data message, and use the asymmetric encryption algorithm to digitally sign or verify the data message.

[0069] The second data security transmission sub-module is used to send and receive data packets transmitted between the network terminal and the network center layer, and to establish a virtual private network between the network center node layer and the network terminal layer. A network tunnel is constructed in the virtual private network through a national security gateway to transmit data packets to the network center node through the network tunnel.

[0070] The second national secret encryption service submodule is used to encrypt or decrypt data messages using a symmetric encryption algorithm, and to digitally sign or verify data messages using an asymmetric encryption algorithm.

[0071] Among them, the first data security transmission submodule and the second data security transmission submodule both build an overlay network tunnel through the national secret IPSecVPN (national secret IPSec VPN refers to a VPN technology that uses the IPSec protocol to achieve remote access. The full name of IPSec is Internet Protocol Security. It is a security standard framework defined by the Internet Engineering Task Force (IETF). It provides a secure communication channel for two private networks on the public network and ensures the security of the connection through an encrypted channel.) and uses tunnel encryption technology that complies with encryption standards to encrypt and transmit data packets. IPsec VPN provides two security mechanisms, authentication and encryption. The authentication mechanism enables the data recipient of the IP communication to confirm the true identity of the data sender and determine whether the data has been tampered with during the transmission process. The encryption mechanism encrypts the data through the national secret algorithm to ensure the confidentiality of the data to prevent the data from being eavesdropped during the transmission process.

[0072] The national secret key management module uses the encryption device deployed at the network center node to manage the keys for data encryption and digital signature. Network terminals need to apply for external storage devices and keys through public network access systems. The external storage device uses a USB-KEY. When the administrator receives the application, he operates the encryption device at the network center node to generate a key for it, and burns the generated key into the USB-KEY. At the same time, the key index is saved and the USB-KEY is distributed to the applicant.

[0073] The first national secret encryption service module and the second national secret encryption service module implement encryption and decryption, digital signature and signature verification for sent and received data messages. Among them, at the network center node, the first national secret encryption service module uses the key index obtained by the national secret key management module to obtain key information from the encryption device and adopts asymmetric encryption algorithm SM2 and symmetric encryption algorithm SM4 and other national secret algorithms to encrypt and decrypt, digitally sign and verify the signature of the data message; at the network transmission layer, the second national secret encryption service module uses the key information stored in the USB-KEY device and adopts asymmetric encryption algorithm SM2 and symmetric encryption algorithm SM4 and other national secret algorithms to encrypt and decrypt, sign and verify the signature of the data message. The specific data processing flow is as follows:

[0074] (1) The network terminal sends a data message to the second gateway module in the network transport layer according to the protocol format;

[0075] (2) The second gateway module verifies the interface serial number in the data message and determines whether the network terminal manufacturer has the authority to upload such data message;

[0076] (3) After the interface serial number is verified, the second gateway module verifies the data format of the message;

[0077] (4) After the data format verification is passed, the second national secret encryption service module obtains the key information from the USB-KEY device and uses the asymmetric encryption algorithm SM2 to digitally sign the data message, and uses the symmetric encryption algorithm SM4 to encrypt the data message;

[0078] (5) The first data security transmission module transmits the digital signature information and the encrypted data message to the network center node;

[0079] (6) The national secret key management service module in the first gateway module in the network center node obtains the key index corresponding to the data source through interface serial number matching;

[0080] (7) The first national secret encryption service module uses the obtained key index to obtain key information from the encryption device to decrypt and verify the data message;

[0081] (8) After data decryption and signature verification, the data message is parsed and subsequent business processing is performed.

[0082] In an optional embodiment, if Figure 2 As shown, the active monitoring module includes a data monitoring submodule and an early warning push disposal submodule; the data monitoring submodule is used to construct a data monitoring model of the network terminal layer based on the parsed data message, and evaluate the operating status of various network terminals of different business types in the network terminal layer through the data monitoring model; the early warning push disposal submodule is used to generate early warning information when an abnormal situation is found, and push the early warning information to the network center node, so that the network center node generates a disposal plan based on the early warning information.

[0083] Specifically, the active monitoring module discovers and generates and pushes warnings for abnormal situations such as data transmission interruption and data quality mutation, thereby protecting data reliability. Among them, the data monitoring submodule establishes a data monitoring model based on various types of access network terminal data reported by the gateway modules of each transmission layer. The network terminal data monitoring indicators included in the data monitoring model are shown in Table 1 below. By monitoring the multi-dimensional key indicators of the access network terminal layer, the operating status of the network terminal layer is evaluated. The warning push disposal submodule generates and pushes warnings to the network center node when it discovers abnormal situations. It generates emergency disposal plans based on the warning information and tracks the disposal status. The administrator conducts system, network, and network terminal inspections and disposals based on the disposal plans.

[0084] Table 1

[0085]

[0086]

[0087] It should be noted that the above embodiment takes the uploading of data messages from network terminals of various business types to the network center node layer via the network transmission layer as an example, and describes in detail the road traffic management information transceiver and security protection system under the public network environment provided by the present invention. The road traffic management information transceiver and security protection system under the public network environment provided by the present invention can also issue control commands from the network center node layer to network terminals of various business types via the network transmission layer to implement identity authentication, establish a data security transmission mechanism, and use the national secret algorithm to encrypt and decrypt, digitally sign and verify the control commands, as well as establish a data monitoring and early warning mechanism to achieve the purpose of timely issuing security warnings and initiating disposal plans when abnormal situations occur. The specific identity authentication, establishment of a data security transmission mechanism, and use of the national secret algorithm to encrypt and decrypt, digitally sign and verify the control commands, as well as the establishment of a data monitoring and early warning mechanism to achieve the purpose of timely issuing security warnings and initiating disposal plans when abnormal situations occur are the same as the operations of network terminals of various business types uploading data messages to the network center node layer via the network transmission layer. For example:

[0088] A terminal identity authentication and authorization module is also set up at the network center node layer to verify the ability of network terminals to access the system, authorize and approve the data sending and receiving interfaces, and register and approve the network terminal identities.

[0089] The first gateway module is also used to receive control instructions issued by the network center node in the network center node layer, and use the national secret algorithm and key management mechanism to digitally sign and encrypt the control instructions.

[0090] Among them, the first data security transmission submodule is also used to receive the control instructions issued by the network center node in the network center node layer, and send the control instructions to the network terminal through the network tunnel. The first national secret encryption service submodule is also used to encrypt the control instructions using a symmetric encryption algorithm, and use an asymmetric encryption algorithm to digitally sign the control instructions, generate digital signatures and encryption key information and key indexes corresponding to the key information, and save the key information to the encryption machine device.

[0091] The second national secret encryption service submodule is also used to decrypt the control instructions using a symmetric encryption algorithm, and to verify the digital signature of the control instructions using an asymmetric encryption algorithm.

[0092] The further functional description of other modules is the same as that of the corresponding embodiments above and will not be repeated here.

[0093] The road traffic management information receiving and sending and safety protection system in a public network environment provided by this embodiment is based on a custom protocol message, comprehensively applies information security technology and network security protection technology, and constructs a two-level platform architecture to comprehensively protect equipment operation, data transmission and system security. The present invention also proposes a data monitoring model to monitor and evaluate the terminal operation status from multiple dimensions such as equipment working status, data transmission, instruction issuance, manufacturer statistics and regional statistics, which helps to quickly discover and locate abnormal terminal operation and data transmission.

[0094] In this embodiment, a method for sending and receiving road traffic management information and protecting safety in a public network environment is also provided, which can be used in the above-mentioned road traffic management information sending and receiving and protecting safety system in the public network environment. Figure 3 is a flow chart of a method for sending and receiving road traffic management information and protecting safety in a public network environment according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0095] Step S301, when network terminals of various service types exchange data messages with the network center node layer through the public network via the network transmission layer, the ability of network terminals of various service types to access the network transmission layer is verified, the data transmission and reception interfaces are authorized, and the terminal identities are filed;

[0096] Specifically, when network terminals of various different business types send data packets to the public network, the terminal identity authentication and authorization module is used to verify the ability of network terminals of various different business types to access the road traffic management information receiving and sending and safety protection system in the public network environment through the public network, authorize the data receiving and sending interfaces, and record the terminal identities.

[0097] Step S302, receiving data messages transmitted by network terminals of various service types, and using national secret algorithms and key management mechanisms to digitally sign, encrypt, decrypt, verify signatures, and parse data messages.

[0098] Specifically, a gateway module is used to receive data messages transmitted by network terminals of various business types in the network terminal layer, and a national secret algorithm and key management mechanism are used to digitally sign, encrypt, decrypt, verify signatures and parse data messages.

[0099] Step S303, receiving the parsed data message, monitoring the working status, data transmission quality, and instruction execution status of network terminals of various business types based on the parsed data message, generating warning information when abnormal situations are found, and generating a disposal plan based on the warning information.

[0100] Specifically, an active monitoring module is used to receive the parsed data messages transmitted by the gateway module, and based on the parsed data messages, the working status, data transmission quality, and instruction execution status of network terminals of various different business types are monitored, and warning information is generated when abnormal situations are found, and a disposal plan is generated based on the warning information.

[0101] The method for receiving and sending road traffic management information and protecting safety in a public network environment provided by this embodiment establishes a device integrated access authorization mechanism through a terminal identity authentication authorization module, realizes identity authentication of network terminals, ensures the authenticity of information reception and transmission, sets a gateway module, and adopts a national secret algorithm and a key management mechanism to establish a data security transmission mechanism between a network center node and a network terminal, prevents data messages from being stolen and tampered with during transmission over a public network, and ensures the accuracy of information reception and transmission. An active monitoring module is also provided at the network center node layer, and a data monitoring and early warning mechanism is established to ensure that when an abnormal situation occurs, a safety warning can be issued in a timely manner, and a disposal plan can be initiated, and corresponding measures can be taken, thereby solving the problem that the authenticity, accuracy and reliability of the reception and transmission of traffic management information in a public network environment are difficult to ensure due to the lack of a security protection mechanism.

[0102] The further functional description of each of the above modules is the same as the corresponding embodiment of the road traffic management information receiving and sending and safety protection system in the above public network environment, and will not be repeated here.

[0103] The embodiment of the present invention also provides a computer device having the above Figure 1 and Figure 2 The road traffic management information receiving and sending and safety protection system in the public network environment shown.

[0104] See also Figure 4 , Figure 4 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 4 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 4 A processor 10 is taken as an example.

[0105] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0106] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0107] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0108] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0109] The computer device also includes an input device 30 and an output device 40. The processor 10, the memory 20, the input device 30 and the output device 40 may be connected via a bus or other means. Figure 4 The example of connecting through bus is taken in the following.

[0110] The input device 30 can receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device, such as a touch screen, a keypad, a mouse, a track pad, a touch pad, an indicator bar, one or more mouse buttons, a trackball, a joystick, etc. The output device 40 may include a display device, an auxiliary lighting device (e.g., an LED) and a tactile feedback device (e.g., a vibration motor), etc. The above-mentioned display device includes but is not limited to a liquid crystal display, a light emitting diode, a display and a plasma display. In some optional embodiments, the display device can be a touch screen.

[0111] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0112] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A road traffic management information receiving and sending and safety protection system in a public network environment, characterized in that: The system comprises a network center node layer, a network transmission layer and a network terminal layer connected in sequence; A terminal identity authentication and authorization module is provided at the network terminal layer, and the terminal identity authentication and authorization module is connected to network terminals of various different business types at the network terminal layer; the terminal identity authentication and authorization module is used to verify the ability of network terminals of various different business types to access the network transmission layer, authorize the data transmission and reception interfaces, and record the terminal identities when network terminals of various business types interact with the network center node layer through the public network via the network transmission layer; A gateway module is provided in both the network transmission layer and the network center node layer, and the gateway module is used to receive data messages transmitted by network terminals of various service types in the network terminal layer, and digitally sign, encrypt, decrypt, verify signatures and parse data messages using a national secret algorithm and a key management mechanism; An active monitoring module is also provided at the network center node layer, which is used to receive the parsed data messages transmitted by the gateway module, monitor the working status, data transmission quality, and instruction execution status of network terminals of various business types based on the parsed data messages, generate early warning information when abnormal situations are found, and generate a disposal plan based on the early warning information.

2. The system according to claim 1, characterized in that The terminal identity authentication and authorization module includes a test entry submodule, an interface authorization submodule and a terminal filing submodule; the network terminals of various service types access the network center node layer through the public network via the network transmission layer through the test entry submodule, the interface authorization submodule and the terminal filing submodule; The test entry submodule is used to verify whether the network terminal has the ability to communicate and interact with the network transport layer through the public network in accordance with the agreed protocol message format; The interface authorization submodule is used to allocate an interface serial number to each network terminal that intends to access the network transmission layer through the public network; The terminal filing submodule is used to assign a unique filing number to the network terminal that has obtained the interface serial number.

3. The system according to claim 1, characterized in that The national secret algorithm includes an asymmetric encryption algorithm and a symmetric encryption algorithm, and the gateway module includes a first gateway module and a second gateway module; The first gateway module is arranged at the network center node layer, and the network center node layer also includes an encryption machine device, in which key information is stored; the first gateway module is used to obtain the key information from the encryption machine device and use a symmetric encryption algorithm to encrypt or decrypt the data message, and use an asymmetric encryption algorithm to digitally sign or verify the data message, and generate and save a key index corresponding to the key information; The second gateway module is arranged at the network transmission layer, and the second gateway module is used to encrypt or decrypt the data message by operating an external storage device using a symmetric encryption algorithm, and to digitally sign or verify the data message using an asymmetric encryption algorithm.

4. The system according to claim 3, characterized in that The first gateway module includes a first data security transmission submodule, a first national secret encryption service submodule and a national secret key management submodule; The first data security transmission submodule is used to receive data messages transmitted by the network terminal, and establish a virtual private network between the network center node layer and the network terminal layer, and construct a network tunnel in the virtual private network through the national secret security gateway to transmit the data message to the network center node through the network tunnel; The first national secret encryption service submodule is used to encrypt or decrypt the data message using a symmetric encryption algorithm, and to digitally sign or verify the data message using an asymmetric encryption algorithm, so as to obtain key information from the encryption device through the key index during the signature verification process; The national secret key management submodule is used to record and save the key index corresponding to the key information of digital signature and encryption processing, and save the key information to an external storage device.

5. The system according to claim 3, characterized in that The second gateway module includes a second data security transmission submodule and a second national secret encryption service submodule; The second data security transmission submodule is used to send and receive data messages transmitted between the network terminal and the network center layer, and to establish a virtual private network between the network center node layer and the network terminal layer, and to build a network tunnel in the virtual private network through the national secret security gateway to transmit the data message to the network center node through the network tunnel; The second national secret encryption service submodule is used to use a symmetric encryption algorithm to encrypt or decrypt the data message, and to use an asymmetric encryption algorithm to digitally sign or verify the data message.

6. The system according to claim 1, characterized in that The active monitoring module includes a data monitoring submodule and an early warning push disposal submodule; The data monitoring submodule is used to construct a data monitoring model for the network terminal layer based on the parsed data message, and evaluate the operating status of network terminals of various service types in the network terminal layer through the data monitoring model; The early warning push handling submodule is used for generating early warning information for a network terminal in an abnormal state, and pushing the early warning information to a network center node, so that the network center node generates a handling plan based on the early warning information.

7. A method for sending, receiving and protecting road traffic management information in a public network environment, characterized in that: Applied to a road traffic management information transceiving and safety protection system in a public network environment according to any one of claims 1 to 6, the method comprising: When network terminals of different service types send data packets to the network center node layer through the public network via the network transmission layer, the ability of network terminals of different service types to access the network transmission layer is verified, the data transmission and reception interfaces are authorized, and the terminal identities are recorded; Receive data messages transmitted by network terminals of various service types, and use national secret algorithms and key management mechanisms to digitally sign, encrypt, decrypt, verify signatures, and parse data messages; Receive parsed data messages, monitor the working status, data transmission quality, and instruction execution status of network terminals of various business types based on the parsed data messages, generate warning information when abnormal situations are found, and generate disposal plans based on the warning information.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method for sending and receiving road traffic management information and protecting safety in a public network environment as described in claim 7 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the road traffic management information receiving and sending and safety protection method in a public network environment described in claim 7.

10. A computer program product, characterized in that It includes computer instructions, which are used to enable a computer to execute the road traffic management information sending, receiving and safety protection method in a public network environment as described in claim 7.

Images