Data transmission method, system and equipment based on software-defined security model

Abstract

The embodiment of the invention discloses a data transmission method based on a software-defined security model. The method comprises the following steps: initiating a host access request according to a software-defined security architecture SDS; when the software defined security architecture SDS accesses a server, identity verification is applied to an associated SDS controller according to an improved single packet authorization process; if the identity verification succeeds, the SDS controller endows the software defined security architecture SDS with the lowest-level access authority of an initiating host; and after the host receives the access authority authorization, the host initiates SPA connection to the gateway, determines an mTLS secure channel between the host and the gateway, and keeps continuous data transmission within the T time period. According to the data transmission method based on the software defined security model, the security and efficiency of data transmission are effectively improved by enhancing the security of data transmission, flexible access control, efficient data transmission and data integrity and authenticity verification.

Description

Technical Field

[0001] The present invention relates to the technical field of power network security, and in particular to a data transmission method, system and device based on a software-defined security model. Background Art

[0002] In recent years, with the rapid development of information technology, the power grid industry is undergoing unprecedented changes. In order to improve the level of informatization, optimize business processes, and enhance service efficiency, the power grid industry actively embraces cutting-edge technologies such as cloud computing, big data, and artificial intelligence. The introduction of these technologies has greatly improved the intelligence level and operational efficiency of the power grid; however, while technological progress is in progress, it has also brought unprecedented information security challenges. Sensitive information and key operating data stored and transmitted in the power grid system frequently circulate between cloud platforms, big data processing systems, and various smart devices. Once these data are illegally accessed, tampered with, or leaked, they may pose a serious threat to the stable operation of the power grid, user privacy protection, and even national energy security.

[0003] Faced with this grim situation, the power grid industry urgently needs to build an efficient, flexible and reliable information security protection system. Traditional security strategies based on border protection can no longer meet the needs of the current complex and changing network environment, and new security concepts and technical means are urgently needed. Summary of the invention

[0004] Based on this, it is necessary to propose a data transmission method based on a software-defined security model to address the above problems.

[0005] A data transmission method based on a software-defined security model, the method comprising the following steps:

[0006] Initiate host access request based on software-defined security architecture SDS;

[0007] When the software defined security architecture SDS accesses a server, applying for identity authentication from the associated SDS controller according to the improved single packet authorization process;

[0008] If the identity authentication is successful, the SDS controller grants the SDS initiating host the lowest level of access rights;

[0009] When the host receives the access authorization, the host initiates a SPA connection to the gateway, determines the mTLS secure channel between the two parties, and maintains continuous data transmission within the T period.

[0010] In the above solution, the SDS controller grants the SDS initiator host the lowest level of access rights, including:

[0011] The SDS controller opens designated services and application resources to the software-defined security architecture SDS initiator host to meet the access requirements of the software-defined security architecture SDS;

[0012] The SDS controller informs the software defined security architecture SDS initiator host of the services and resources that have been opened through the IH message;

[0013] The SDS controller sends instructions to the gateway to adjust the firewall rules to accept the service request initiated by the host of the software defined security architecture SDS.

[0014] In the above solution, the adjustment of firewall rules specifically includes:

[0015] Initiate a service request from the host according to the software defined security architecture SDS, and open or close a specific network port;

[0016] Configure firewall rules to allow or prohibit specific network protocols to ensure that network communications that comply with security policies pass;

[0017] A timeout period for the network communication is set, and when the timeout period is greater than a fixed threshold, the network communication is automatically closed.

[0018] In the above solution, the step of maintaining continuous transmission of data within the T period specifically includes:

[0019] In the software defined security architecture SDS, the software defined security architecture SDS initiating host is determined according to the sending end of the SPA data packet, and the SDS controller is determined according to the receiving end of the SPA data packet;

[0020] The host determines a SPA data packet according to the software defined security architecture SDS, wherein the SPA data includes a header, an encrypted payload and an authentication tag;

[0021] Sending a SPA data packet containing a header, encrypted payload, and authentication tag to the SDS controller via the network;

[0022] After receiving the SPA data packet, the SDS controller verifies the data packet;

[0023] When the verification is successful, the encrypted payload is decrypted according to the same encryption algorithm and key to restore the original power data.

[0024] In the above solution, the SPA data includes a header, an encrypted payload, and an authentication tag, specifically including:

[0025] The header contains routing information and security parameters. The field length of the header is dynamically adjusted according to actual needs. The fields include: source address, destination address, sequence number, encryption algorithm identifier, and authentication algorithm identifier;

[0026] The formatted power data is used as the original data, the original data is encrypted by a selected encryption algorithm and a key to generate an encrypted payload, and an authentication tag is generated based on the encrypted payload and the key.

[0027] In the above solution, after receiving the SPA data packet, the SDS controller verifies the data packet, specifically including:

[0028] After receiving the SPA data packet, the SDS controller generates S and calculates the corresponding secure one-time password SOTP' according to the timestamp and random number contained therein;

[0029] Compare the secure one-time password SOTP' with the SOTP provided in the SPA data packet to see if they match;

[0030] If the secure one-time password SOTP' matches the SOTP provided in the SPA packet, the authentication is successful.

[0031] In the above scheme, SOTP or SOTPˋ is determined according to the following relationship:

[0032] STOP=Truncate(HMAC-SHA-1(K,S)); wherein K is a secret key shared between the client and the server, and S is a specific string generated by the variable insertion technique.

[0033] In the above scheme, after the host receives the access authorization, the host initiates a SPA connection to the gateway, determines the mTLS secure channel between the two parties, and maintains continuous data transmission within the T period. After that, the method further includes:

[0034] After the T period, maintaining the mTLS secure channel connection between the two parties;

[0035] The firewall rules are revoked, and the gateway dynamically monitors the software defined security architecture SDS initiating host.

[0036] The present application also proposes a data transmission system based on a software-defined security model, the system comprising: an access request module, an identity authentication module and a data transmission module;

[0037] The access request module is used to initiate a host access request according to the software defined security architecture SDS;

[0038] The identity authentication module is used to apply for identity authentication from the associated SDS controller according to the improved single-packet authorization process when the software-defined security architecture SDS accesses the server;

[0039] The data transmission module is used for, if the identity authentication is successful, the SDS controller grants the lowest level access rights to the software defined security architecture SDS initiating host; when the host receives the access rights authorization, the host initiates a SPA connection to the gateway, determines the mTLS secure channel between the two parties, and maintains continuous data transmission within the T period.

[0040] The present application also proposes a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the following steps:

[0041] Initiate host access request based on software-defined security architecture SDS;

[0042] When the software defined security architecture SDS accesses a server, applying for identity authentication from the associated SDS controller according to the improved single packet authorization process;

[0043] If the identity authentication is successful, the SDS controller grants the SDS initiating host the lowest level of access rights;

[0044] When the host receives the access authorization, the host initiates a SPA connection to the gateway, determines the mTLS secure channel between the two parties, and maintains continuous data transmission within the T period.

[0045] The use of the embodiments of the present invention has the following beneficial effects: initiating a host access request according to the software-defined security architecture SDS; when the software-defined security architecture SDS accesses the server, applying for identity authentication to the associated SDS controller according to the improved single-packet authorization process; if the identity authentication is successful, the SDS controller grants the lowest level of access rights to the host initiating the software-defined security architecture SDS; when the host receives the access rights authorization, the host initiates a SPA connection to the gateway, determines the mTLS secure channel between the two parties, and maintains continuous data transmission within the T period. The present invention effectively prevents unauthorized access by applying for identity authentication to the SDS controller through the improved single-packet authorization process, and effectively improves the security and efficiency of data transmission by enhancing the security of data transmission, flexible access control, efficient data transmission, and data integrity and authenticity verification. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] in:

[0048] Figure 1 The figure is a flowchart of a data transmission method based on a software-defined security model in one embodiment.

[0049] Figure 2 The figure is a schematic diagram of a variable insertion process in one embodiment.

[0050] Figure 3 It is a schematic diagram of the result of capturing flood attack traffic in an embodiment. DETAILED DESCRIPTION

[0051] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0052] In the following description, a large number of specific details are given in order to provide a more thorough understanding of the present invention; however, it is obvious to those skilled in the art that the present invention can be implemented without one or more of these details; in other examples, in order to avoid confusion with the present invention, some technical features known in the art are not described, and it should be understood that the present invention can be implemented in different forms and should not be interpreted as limited to the embodiments presented here; on the contrary, providing these embodiments will make the disclosure thorough and complete and fully convey the scope of the present invention to those skilled in the art.

[0053] The purpose of the terms used herein is only to describe specific embodiments and is not intended to be limiting of the present invention. When used herein, the singular forms "a", "an" and "said / the" are also intended to include the plural forms, unless the context clearly indicates otherwise, and it should also be understood that the terms "consisting of" and / or "comprising", when used in this specification, determine the presence of the features, integers, steps, operations, elements and / or parts, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, parts and / or groups. When used herein, the term "and / or" includes any and all combinations of the relevant listed items.

[0054] With the increasing requirements of the power grid industry for information and intelligence, and the increasingly severe information security threats, the application of zero-trust architecture and SDS model has become an inevitable trend for power grid information security protection. This invention is proposed based on this background, aiming to provide the power grid industry with a more efficient and reliable information security protection solution through innovative technical means.

[0055] Specifically, Zero Trust Architecture has emerged as a new security concept, which emphasizes the principle of "never trust, always verify", that is, no matter where the user or device is in the network, strict identity authentication and access control are required to access resources.

[0056] As a specific implementation path of zero-trust architecture in practice, the Software Defined Security (SDS) model has become a powerful tool for solving power grid information security issues with its high flexibility and scalability. The SDS model decouples security policies and execution from traditional hardware devices through software, and realizes the centralized definition, management and dynamic adjustment of security policies. This model not only simplifies the complexity of security management, but also greatly improves the execution efficiency and response speed of security policies.

[0057] In the SDS model, data packets must undergo multi-level authentication and access control before reaching the target server. This process not only includes verification of the sender's identity, but also involves a comprehensive assessment of multiple dimensions such as device status, legitimacy of access requests, and access context, thereby ensuring that only fully verified entities can obtain access rights. In addition, the SDS model strictly adheres to the principle of least privilege, effectively limiting the access rights of users or devices and reducing potential security risks.

[0058] To facilitate understanding, the relevant terms involved in this application are first introduced below.

[0059] (1) Single Packet Authorization (SPA) data packet refers to a special network authentication method. It mainly uses a single data packet to carry authentication and identification information to complete the authentication process and obtain authorization, thereby allowing access to services. The core of the SPA data packet lies in its "single packet authorization" feature, that is, the entire authentication process is completed through an encrypted and non-replayable data packet;

[0060] (2) Software Defined Security (SDS) architecture is a security architecture derived from software defined networking (SDN). Its core principle is to decouple physical and virtual network security devices from their access modes, deployment methods, and implementation functions. The bottom layer is abstracted as resources in the security resource pool, and the top layer uses software programming to perform intelligent and automated business orchestration and management to complete the corresponding security functions and achieve flexible security protection.

[0061] In order to thoroughly understand the present invention, a detailed structure will be presented in the following description to illustrate the technical solution proposed by the present invention; optional embodiments of the present invention are described in detail as follows, but in addition to these detailed descriptions, the present invention may also have other implementation methods.

[0062] like Figure 1 As shown, in one embodiment, a data transmission method based on a software-defined security model is provided, and the data transmission method based on a software-defined security model includes steps S101 to S104, which are described in detail as follows:

[0063] S101, initiating a host access request according to the software defined security architecture SDS;

[0064] This step is the starting point of data transmission. By initiating an access request to the host through SDS, the needs and goals of data transmission are clarified, ensuring the subsequent security verification and authorization process.

[0065] Preferably, the improved single packet authorization technology is integrated into the software defined security (Software Defined Security, SDS) architecture to ensure that the server can still maintain efficient access control and security protection when facing a large number of fixed attribute devices, and the single packet authorization (Single Packet Authorization, SPA) data packet is optimized and upgraded, and its structure is adjusted to adapt to the scenario requirements. The terminal device attributes are centrally collected on the server side, covering user identification, IP / MAC address and operating system, etc., and the shared key is negotiated and stored in the database to form a customized SPA authentication solution.

[0066] S102, when the software defined security architecture SDS accesses the server, applying for identity authentication from the associated SDS controller according to the improved single-packet authorization process;

[0067] Authentication is performed through an improved single-package authorization process to ensure the legitimacy and authorization of the access subject, effectively preventing the risks of unauthorized access and data leakage. Compared with the traditional multi-package process, the single-package authorization process may be more efficient, complete identity authentication faster, and reduce communication delays.

[0068] Preferably, start the SDS controller and place it in a strictly controlled, preset trusted environment, connect it to functional modules such as device verification, ciphertext parsing and STOP generation, provide optional authentication and authorization services, and deploy the SDS gateway as the external interface of internal resources to initialize the "all-deny" firewall policy.

[0069] Preferably, various types of power Internet of Things terminal devices, such as sensors, meters and smart meters, serve as client access systems, and establish one-to-many associations with nearby SDS controllers with the help of positioning services. When the client wants to access the server, it first applies for identity authentication to the associated controller through an improved single-packet authorization process. If the authentication is successful, it continues with subsequent steps, otherwise access is blocked.

[0070] S103, if the identity authentication is successful, the SDS controller grants the lowest level access rights to the SDS initiating host of the software defined security architecture;

[0071] The SDS controller grants the lowest level of access rights based on the verification results, achieving fine-grained control over resource access, which not only ensures the secure transmission of data but also meets basic business needs. Among them, the setting of the lowest level of access rights helps to control the potential impact to the minimum scope when a security incident occurs, thereby achieving effective isolation of resources.

[0072] In some embodiments, the SDS controller grants the SDS initiator host the lowest level of access rights, including:

[0073] The SDS controller opens specified services and application resources to the SDS initiator host to meet the access requirements of the SDS.

[0074] The SDS controller informs the software-defined security architecture SDS initiator host of the services and resources that have been opened through the IH message;

[0075] The SDS controller sends instructions to the gateway to adjust the firewall rules to accept the service request initiated by the software-defined security architecture SDS host.

[0076] Specifically, when the SDS controller opens designated services and application resources to the SDS architecture initiator host, it is actually deploying and configuring a series of security services, traffic management policies, access control rules in the SDS architecture through software programming, and providing the required computing resources and data storage resources for the application. These resources and services together constitute the security protection system in the SDS architecture, ensuring the security and reliability of the network environment and applications.

[0077] For example, in an enterprise network, the SDS controller can initiate a request to the SDS architecture to open the HTTP service of the Web server and configure the corresponding firewall rules and intrusion detection policies for the service according to business needs and security policies. At the same time, it can also allocate sufficient computing resources and storage resources to the Web server to ensure its stable operation and meet the user's access needs. In this way, the SDS architecture can achieve comprehensive, flexible and efficient security protection for the network environment and applications.

[0078] For example, in an enterprise network, the SDS controller can initiate a request to the SDS architecture to open the HTTP service of the Web server and configure the corresponding firewall rules and intrusion detection policies for the service according to business needs and security policies. At the same time, it can also allocate sufficient computing resources and storage resources to the Web server to ensure its stable operation and meet the user's access needs. In this way, the SDS architecture can achieve comprehensive, flexible and efficient security protection for the network environment and applications.

[0079] In some embodiments, adjusting firewall rules specifically includes:

[0080] Initiate service requests from the host based on the software-defined security architecture (SDS) to open or close specific network ports;

[0081] Configure firewall rules to allow or prohibit specific network protocols to ensure that network communications that comply with security policies pass;

[0082] Set the timeout period for network communication. When the timeout period is greater than the fixed threshold, the network communication is automatically closed.

[0083] Specifically, adjusting firewall rules includes: 1. Initiating service requests from the host based on the software-defined security architecture (SDS) to open or close specific network ports; 2. Configuring firewall rules to allow or prohibit specific network protocols to ensure that network communications that comply with security policies pass; 3. Setting a timeout for network communications. When the timeout is greater than a fixed threshold, the network communication is automatically closed.

[0084] S104. After the host receives the access authorization, the host initiates a SPA connection to the gateway, determines the mTLS secure channel between the two parties, and maintains continuous data transmission within the T period.

[0085] By establishing SPA connection and mTLS secure channel, confidentiality, integrity and anti-replay are ensured during data transmission, effectively resisting security threats such as man-in-the-middle attacks. With the support of mTLS secure channel, continuous data transmission within the T period can be achieved between the SDS initiator host and the gateway to meet the requirements of real-time and efficiency. The design of the T period allows flexible adjustment of the duration of data transmission according to actual conditions to adapt to different business needs and security requirements.

[0086] In some embodiments, maintaining continuous data transmission within the T period specifically includes:

[0087] In the software-defined security architecture SDS, the software-defined security architecture SDS initiator host is determined according to the sending end of the SPA data packet, and the SDS controller is determined according to the receiving end of the SPA data packet;

[0088] The host determines the SPA data packet according to the software-defined security architecture SDS. The SPA data includes the header, encrypted payload and authentication tag.

[0089] Sending a SPA data packet containing a header, encrypted payload, and authentication tag to the SDS controller via the network;

[0090] After receiving the SPA data packet, the SDS controller verifies the data packet;

[0091] When the verification is successful, the encrypted payload is decrypted according to the same encryption algorithm and key to restore the original power data.

[0092] The sender of the above SPA data packet is the SDS initiator host, and the receiver is the SDS controller, which plays the role of the server in the SPA process and undertakes the tasks of verification and authentication.

[0093] Preferably, the SPA setting should achieve the following requirements:

[0094] Data packet processing is subject to encryption and authentication;

[0095] The data packet can provide all identity information, and the data packet header with incomplete information will be discarded;

[0096] The original data packet cannot be modified by the administrator, and the underlying access rights cannot restrict the generation and sending of data packets;

[0097] The accessed port should try to remain silent when receiving and processing data packets and avoid replying confirmation messages.

[0098] In some embodiments, the SPA data includes a header, an encrypted payload, and an authentication tag, specifically including:

[0099] The header contains routing information and security parameters. The length of the header fields is dynamically adjusted according to actual needs. The fields include: source address, destination address, sequence number, encryption algorithm identifier, and authentication algorithm identifier.

[0100] The formatted power data is used as the original data, and the original data is encrypted by a selected encryption algorithm and key to generate an encrypted payload, and an authentication tag is generated based on the encrypted payload and the key.

[0101] Routing information includes trusted IP addresses and MAC addresses.

[0102] The above authentication tag is used to verify the integrity and authenticity of the data packet. The authentication tag adopts the message authentication code (MAC) technology based on hash function and key to ensure the integrity and authenticity of the data packet. The MAC algorithm can be selected and configured according to actual needs.

[0103] In some embodiments, after receiving the SPA data packet, the SDS controller verifies the data packet, specifically including:

[0104] After receiving the SPA data packet, the SDS controller generates S and calculates the corresponding secure one-time password SOTP' according to the timestamp and random number contained in it;

[0105] Compare the secure one-time password SOTP' with the SOTP provided in the SPA packet to see if they match;

[0106] If the secure one-time password SOTP' matches the SOTP provided in the SPA packet, the authentication is successful.

[0107] In some embodiments, SOTP or SOTPˋ is determined according to the following relationship:

[0108] STOP=Truncate(HMAC-SHA-1(K,S)); wherein K is a secret key shared between the client and the server, and S is a specific string generated by the variable insertion technique.

[0109] Specifically, the header contains routing information and security parameters. The field length of the header is dynamically adjusted according to actual needs. The fields include: source address, destination address, serial number, encryption algorithm identifier, and authentication algorithm identifier. The formatted power data is used as the original data, and the original data is encrypted using the selected encryption algorithm and key to generate an encrypted payload, and an authentication tag is generated based on the encrypted payload and the key.

[0110] Furthermore, by integrating OTP and IP address information, a multi-factor authentication framework can be constructed to enhance the security performance of SPA. OTP generates instantaneous and unpredictable passwords based on time, events or specific algorithms, ensuring that each authentication request carries unique credentials, effectively blocking replay attacks. At the same time, combined with the actual IP address of the device, the geographical consistency of the request source can be verified, making it more difficult for attackers to forge legitimate requests. As the third verification factor, device fingerprints can accurately identify and reject malicious attacks disguised as legitimate devices by virtue of their deep understanding of the device's hardware identity and software environment.

[0111] Preferably, the timestamp field format is set to: [year, month, day, hour, minute, second], which consists of 6 variable elements, with 7 spaces for insertion. The random number length is set to 4 bits, and each position is represented by an independent heptad number, which corresponds to the four bytes of the IP address. The insertion rule is: according to the 4-bit random number randomly generated by the system, each byte of the IP address is converted into a binary sequence, reversed and then converted back to decimal form, and then these values ​​are inserted into the corresponding spaces of the timestamp to construct a digital string S with a length of 26 bits.

[0112] like Figure 2 The figure shows an example of the variable insertion process. After receiving the SPA data packet, the server will follow the same steps to generate S and calculate the corresponding SOTPˋ based on the timestamp and random number contained in it. Compare SOTP' with the SOTP provided in the SPA data packet. If the two match, the authentication process is successful; otherwise, it means that the SPA data packet has been tampered with.

[0113] By integrating OTP and IP address information, a multi-factor authentication framework can be built to enhance the security performance of SPA. OTP generates instant, effective, and unpredictable passwords based on time, events, or specific algorithms, ensuring that each authentication request carries unique credentials, effectively blocking replay attacks. At the same time, combined with the actual IP address of the device, the geographic consistency of the request source can be verified, making it more difficult for attackers to impersonate legitimate requests. As the third verification factor, device fingerprints can accurately identify and reject malicious attacks disguised as legitimate devices by virtue of their deep understanding of the device's hardware identity and software environment.

[0114] In summary, the multi-factor authentication system formed by organically integrating the three major security elements of OTP, IP address and device fingerprint can greatly enhance the security protection effect of SPA technology in the power Internet of Things environment, effectively resist various attacks on device identity and communication data, and ensure the confidentiality, integrity and authenticity of network communications.

[0115] In some embodiments, after the host receives the access authorization, the host initiates a SPA connection to the gateway, determines the mTLS secure channel between the two parties, and maintains continuous data transmission within the T period. After that, the method further includes:

[0116] After the T period, the mTLS secure channel connection between the two parties is maintained;

[0117] Revoke the firewall rules, and the gateway dynamically monitors the host initiating the software-defined security architecture SDS.

[0118] Preferably, if the mTLS secure channel remains connected after the T period and is not subject to any restrictions (such as time limits, traffic limits, etc.), then data can still be transmitted on the channel. However, in actual applications, in order to enhance security, some restrictions may be set to prevent unauthorized access and data leakage.

[0119] The above SDS presents three main models in different power IoT application scenarios:

[0120] Remote access model: focuses on providing remote access services for power grid enterprise resources. The client establishes a connection with the enterprise gateway device through the public network link, and then the gateway device acts as an intermediary to guide the client to interact with internal resources.

[0121] Mobile office model: Applicable to scenarios where it is necessary to support operators to work flexibly outside. Mobile devices directly connect to the power grid enterprise server through the Internet, thereby accessing the internal system of the grid company.

[0122] Collaborative conference model: mainly serves remote collaboration and online conference scenarios. All participants connect to the central server via the Internet and share resources and collaborate through the platform.

[0123] SPA certification program, including:

[0124] An identity-based key negotiation mechanism is used to automatically generate and update security keys between nodes. At the same time, a key distribution center (KDC) is used to centrally manage keys to ensure the security and availability of keys.

[0125] Before data transmission, the sender uses the shared key and authentication algorithm to generate an authentication tag and attaches it to the SPA data packet. After receiving the data packet, the receiver uses the same shared key and authentication algorithm to verify the authentication tag. If the verification is successful, the data packet is accepted; otherwise, the data packet is discarded and an error is reported.

[0126] The new SPA authentication scheme uses strong cryptographic primitives, such as hash functions and key negotiation mechanisms, to ensure the confidentiality, integrity and authenticity of data packets. At the same time, it improves the flexibility and security of SPA technology by dynamically adjusting the data packet structure and encryption algorithm.

[0127] In some embodiments, the power transmission data encryption process of the SPA data packet structure is:

[0128] (1) Encrypted payload preparation: The formatted power data is used as the original data of the encrypted payload.

[0129] (2) Select encryption algorithm: Select a suitable encryption algorithm based on security and performance requirements. Common encryption algorithms include AES (Advanced Encryption Standard), RSA (asymmetric encryption algorithm, commonly used for key exchange), SM4 (China Commercial Cryptography Algorithm), etc. For the real-time and security requirements of power transmission data, AES is well-known for its high efficiency and security, and is fully suitable for the encryption of power transmission data.

[0130] (3) Key management: Ensure the security of the keys used in the encryption and decryption processes. Keys can be generated, distributed, and stored through a key management system. For symmetric encryption algorithms such as AES, the same key is used for encryption and decryption. For asymmetric encryption algorithms, public keys are used for encryption and private keys for decryption.

[0131] (3) Encryption operation: Use the selected encryption algorithm and key to encrypt the power data and generate an encrypted payload. The encryption process ensures that the data cannot be easily decrypted even if it is intercepted during transmission.

[0132] (4) Attach authentication tag: Use mechanisms such as message authentication code (MAC) or digital signature to generate authentication tag based on encrypted payload and key. The authentication tag is used to verify the integrity and authenticity of the data packet, ensuring that the data has not been tampered with during transmission, and the generated authentication tag is attached to the end of the SPA data packet.

[0133] (5) Data transmission: The complete SPA data packet including the header, encrypted payload, and authentication tag is sent to the receiving end through the network.

[0134] (6) Data reception and verification: After receiving the data packet, the receiver first verifies the authentication tag to confirm the integrity and authenticity of the data packet; then uses the same encryption algorithm and key to decrypt the encrypted payload and restore the original power data.

[0135] In some embodiments, in the SPA authentication scheme, when a new device is connected to the network, the server side will centrally collect various basic attributes of the terminal device, including but not limited to key data such as user name, IP address, MAC address, and the operating system being run. In addition, the process also involves the setting of a shared key agreed upon with the device, and ensures that these summarized device information and keys are properly stored in the server's database system. In the power Internet of Things SDS model, SPA technology plays a vital role. SPA abandons the traditional "establish a connection first and then authenticate identity" mode and adopts a "pre-authentication" access strategy, which effectively reduces the security risks caused by over-reliance on open authentication protocols. The present invention aims to reasonably integrate the improved SPA technology and the SPA authentication scheme, and specifically design a single-package authorized software-defined security (SPA-SDS) model suitable for the power Internet of Things environment.

[0136] (1) Experimental environment

[0137] Based on the proposed single-package authorized software-defined security (SPA-SDS) model, an experimental test environment is built, which consists of two mutually compatible open source components. The OpenSDS project of WaverleyLabs is used on the technical level, and the network part is deployed on open source components that meet the OpenFlow protocol.

[0138] To ensure the effective verification of the proposed model, the present invention collects household user smart meter data for testing, and builds 6 Linux Ubuntu16.04 virtual machines. The specific distribution is as follows: two terminal devices are equipped with a software-defined network controller with CTRL application, SDS gateway, server and software-defined network switch network, and the built virtual machines are configured with corresponding software and program drivers, and then the virtual machines are interconnected through the virtual network. Table 1 records the details of each component in the experimental environment.

[0139] Table 1 Experimental environment

[0140]

[0141] (2) Network security testing

[0142] The network security test of the present invention is divided into two parts: port scanning and flooding attack. When performing the port scanning test, a free nmap tool is used to launch a port scanning attack on the server in the terminal device A. In this attack, the terminal device A is set as an attacker, which cannot pass the identity authentication of CTRL. When performing the flooding attack test, the hping3 tool is used to launch a flooding attack on the server, and Wireshark is used to capture the traffic.

[0143] The keys and certificates of edge devices in SDS are distributed by CTRL. In order to simplify the operation during simulation, the present invention chooses to manually distribute keys and certificates to trusted terminal devices. Therefore, for the port scanning part of the experiment, device A, as an attacker, is not distributed keys and certificates. Device A performs port scanning attacks on the server with and without SDS protection, respectively. This shows that when attacker A launches an attack without SDS protection, the nmap scan shows that the server's TCP connection is open, but under SDS protection, since the attacker fails to authenticate to CTRL, the device will not be granted access rights. Obviously, the result is as expected, and all ports are closed. A SYN flood attack is launched on the network server from the 20th second, and Wireshark is used to capture the server's traffic within 60 seconds. The attack is carried out three times, and the average value is taken for 20 seconds each time. The results are as follows Figure 3 As shown in the figure. The dotted line records the flow of attack packets, and the solid line represents the flow captured into the server. Since the CTRL command software-defined network controller and software-defined network switch discard packets during the attack, the normal flow of the server is not affected. The test results show that the solution proposed by the present invention has the characteristic of "network stealth" and can protect the server from attacks by unknown users.

[0144] (3) Model quality assessment

[0145] In order to evaluate the performance of the SPA-SDS model more objectively, the present invention will test the delay index by combining theoretical analysis with the actual performance of the model. Ideally, excluding processing delay and queuing delay, the total delay can be expressed as:

[0146] TD=M / V+L / R (1)

[0147] Among them, M is the link length, V is the signal propagation speed, L is the packet length, R is the link bandwidth, and TD aims to calculate the sum of transmission delay and propagation delay.

[0148] The present invention uses the Wireshark tool to monitor 10 times, measures the end-to-end delay of the single packet authorization software defined security (SPA-SDS) model and only SDS (only terminal trusted access) and only software defined network (only reliable transmission), analyzes the packet exchange between each component, and takes the average value to determine the CTRL switch and gateway overhead. The statistical results are shown in Table 2. The delay of the present invention is slightly higher than that of only SDS and only software defined network. This is because when requesting access, the terminal device must pass the CTRL identity authentication and wait for the SDS gateway to update the firewall before accessing the server.

[0149] Table 2 Delay analysis

[0150]

[0151] In addition, during this period, the software-defined network controller will issue a command to the software-defined network switch to instruct it to add a new flow table entry. The software-defined network switch searches for matching flow table entries when forwarding packets from edge devices, and adds a packet encryption step before data transmission, which will inevitably increase the delay. On the other hand, the end-to-end delay of only using software-defined networks is smaller than that of SDS. This is because reliable data transmission ensures the reliability of communication and reduces the time delay caused by packet loss, thereby reducing the delay time. However, judging from the results in the table, these time overheads are completely tolerable compared to the advantages of security, communication and network management brought by the SDS model of the present invention. In addition, the calculated theoretical value is not much different from the actual measured value, which verifies the accuracy and efficiency of the single-packet authorized software-defined security (SPA-SDS) model proposed in the present invention.

[0152] In summary, this application uses the improved single-packet authorization technology to realize the client's identity authentication in this model, which enhances the security of the software-defined network while ensuring the security of the server, and can ensure the secure transmission and communication of data in the power Internet of Things terminal devices.

[0153] The present application also proposes a data transmission system based on a software-defined security model, the system comprising: an access request module, an identity authentication module and a data transmission module;

[0154] The access request module is used to initiate a host access request according to the software-defined security architecture (SDS);

[0155] An authentication module, used to apply for authentication to the associated SDS controller according to the improved single-package authorization process when the software-defined security architecture SDS accesses the server;

[0156] The data transmission module is used to grant the lowest level of access rights to the host initiating the software-defined security architecture SDS by the SDS controller if the identity authentication is successful; when the host receives the access rights authorization, the host initiates a SPA connection to the gateway to determine the mTLS secure channel between the two parties and maintain continuous data transmission within the T period.

[0157] The present application also proposes a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the following steps:

[0158] Initiate host access request based on software-defined security architecture SDS;

[0159] When the software-defined security architecture SDS accesses the server, it applies for identity authentication to the associated SDS controller according to the improved single-packet authorization process;

[0160] If the authentication is successful, the SDS controller grants the SDS initiator host the lowest level of access rights;

[0161] When the host receives the access authorization, it initiates a SPA connection to the gateway to establish the mTLS secure channel between the two parties and maintain continuous data transmission within the T period.

[0162] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a non-volatile computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in the present application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0163] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0164] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the patent of the present application. It should be pointed out that, for ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. The above disclosure is only a preferred embodiment of the present invention, and of course it cannot be used to limit the scope of the rights of the present invention. Therefore, equivalent changes made according to the claims of the present invention are still within the scope covered by the present invention.

Claims

1. A data transmission method based on a software-defined security model, characterized in that: The method comprises: Initiate host access request based on software-defined security architecture SDS; When the software defined security architecture SDS accesses a server, applying for identity authentication from the associated SDS controller according to the improved single packet authorization process; If the identity authentication is successful, the SDS controller grants the SDS initiating host the lowest level of access rights; When the host receives the access authorization, the host initiates a SPA connection to the gateway, determines the mTLS secure channel between the two parties, and maintains continuous data transmission within the T period.

2. The data transmission method based on the software-defined security model according to claim 1, characterized in that: The SDS controller grants the SDS initiator host the lowest level of access rights, including: The SDS controller opens designated services and application resources to the software-defined security architecture SDS initiator host to meet the access requirements of the software-defined security architecture SDS; The SDS controller informs the software defined security architecture SDS initiator host of the services and resources that have been opened through the IH message; The SDS controller sends instructions to the gateway to adjust the firewall rules to accept the service request initiated by the host of the software defined security architecture SDS.

3. The data transmission method based on the software-defined security model according to claim 2, characterized in that: The adjustment of firewall rules specifically includes: Initiate a service request from the host according to the software defined security architecture SDS, and open or close a specific network port; Configure firewall rules to allow or prohibit specific network protocols to ensure that network communications that comply with security policies pass; A timeout period for the network communication is set, and when the timeout period is greater than a fixed threshold, the network communication is automatically closed.

4. The data transmission method based on the software-defined security model according to claim 3 is characterized in that: The step of maintaining continuous data transmission within the T period specifically includes: In the software defined security architecture SDS, the software defined security architecture SDS initiating host is determined according to the sending end of the SPA data packet, and the SDS controller is determined according to the receiving end of the SPA data packet; The host determines a SPA data packet according to the software defined security architecture SDS, wherein the SPA data includes a header, an encrypted payload and an authentication tag; Sending a SPA data packet containing a header, encrypted payload, and authentication tag to the SDS controller via the network; After receiving the SPA data packet, the SDS controller verifies the data packet; When the verification is successful, the encrypted payload is decrypted according to the same encryption algorithm and key to restore the original power data.

5. The data transmission method based on software-defined security model according to claim 4, characterized in that: The SPA data includes a header, an encrypted payload, and an authentication tag, specifically including: The header contains routing information and security parameters. The field length of the header is dynamically adjusted according to actual needs. The fields include: source address, destination address, sequence number, encryption algorithm identifier, and authentication algorithm identifier; The formatted power data is used as the original data, the original data is encrypted by a selected encryption algorithm and a key to generate an encrypted payload, and an authentication tag is generated based on the encrypted payload and the key.

6. The data transmission method based on the software-defined security model according to claim 5, characterized in that: After receiving the SPA data packet, the SDS controller verifies the data packet, specifically including: After receiving the SPA data packet, the SDS controller generates S and calculates the corresponding secure one-time password SOTP' according to the timestamp and random number contained therein; Compare the secure one-time password SOTP' with the SOTP provided in the SPA data packet to see if they match; If the secure one-time password SOTP' matches the SOTP provided in the SPA packet, the authentication is successful.

7. The data transmission method based on software-defined security model according to claim 6, characterized in that: Determine SOTP or SOTPˋ according to the following relationship: STOP=Truncate(HMAC-SHA-1(K,S)); wherein K is a secret key shared between the client and the server, and S is a specific string generated by the variable insertion technique.

8. The data transmission method based on the software-defined security model according to claim 7, characterized in that: After the host receives the access authorization, the host initiates a SPA connection to the gateway, determines the mTLS secure channel between the two parties, and maintains continuous data transmission within the T period. After that, the method further includes: After the T period, maintaining the mTLS secure channel connection between the two parties; The firewall rules are revoked, and the gateway dynamically monitors the software defined security architecture SDS initiating host.

9. A data transmission system based on a software-defined security model, characterized in that: The system comprises: an access request module, an identity authentication module and a data transmission module; The access request module is used to initiate a host access request according to the software defined security architecture SDS; The identity authentication module is used to apply for identity authentication from the associated SDS controller according to the improved single-packet authorization process when the software-defined security architecture SDS accesses the server; The data transmission module is used for, if the identity authentication is successful, the SDS controller grants the lowest level access rights to the software defined security architecture SDS initiating host; when the host receives the access rights authorization, the host initiates a SPA connection to the gateway, determines the mTLS secure channel between the two parties, and maintains continuous data transmission within the T period.

10. A computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor executes the steps of the method according to any one of claims 1 to 8.

Images