Cross-network segment data forwarding method and device, storage medium and electronic equipment

Abstract

The invention provides a cross-network-segment data forwarding method and device, a storage medium and electronic equipment, and is applied to the technical field of industrial control. The method is applied to a forwarding service node, the forwarding service node multicasts a first data packet containing a service identifier to a first network segment, sends a second data packet containing an application identifier, and an IP address and a port number of a device end in a second network segment after an application service registered in the first network segment receives the first data packet, and sends the second data packet to the second network segment after authority authentication succeeds. A binding relationship between an application identifier and a port number is established, then an exclusive UDP channel is established, a second data packet is forwarded to a specified address and a port through the channel, a protocol message is replied after processing by equipment, and a forwarding service node forwards the message to an application service through the binding relationship, so that cross-network-segment data communication is realized, the communication process is simplified, and the communication efficiency is improved. And the cross-network-segment data transmission efficiency is improved.

Description

Technical Field

[0001] The present invention relates to the field of industrial control technology, and in particular to a method, device, storage medium and electronic equipment for forwarding data across network segments. Background Art

[0002] In modern industrial control systems, in order to achieve efficient management and ensure system security, the network is usually divided into multiple segments and isolated through VLAN (virtual local area network) technology. Specifically, configuration software and instrument management software usually run in segment A, while smart APL instruments, communication cards, and conventional IO cards run in segment B. Although this network division method improves the security of the system, it also brings challenges to cross-segment communication.

[0003] For example, the instrument management software running on network segment A needs to manage the IO devices on network segment B, and the configuration software running on network segment A needs to download the configuration to the IO devices on network segment B. However, due to network isolation, network segments A and B cannot communicate directly, which makes management and configuration operations difficult.

[0004] Therefore, how to solve the data communication problem between different network segments within a control system and achieve efficient data transmission across network segments has become a key issue that needs to be urgently solved by technical personnel in this field. Summary of the invention

[0005] In view of the above problems, the present invention provides a method, device, storage medium and electronic device for forwarding data across network segments to overcome the above problems or at least partially solve the above problems. The technical solution is as follows:

[0006] A cross-segment data forwarding method, applied to a forwarding service node, the method comprising:

[0007] Multicast a first data packet including a service identifier of the forwarding service node to the first network segment, so that each application service registered in the first network segment obtains the first data packet, and sends a second data packet to the forwarding service node according to the service identifier, wherein the second data packet includes an application identifier of the application service, an IP address and a port number of a device end in the second network segment;

[0008] Obtaining the second data packet sent by the application service, and extracting the application identifier of the application service, the IP address of the second network segment, and the port number;

[0009] Performing authorization authentication with an authorization authentication center based on the application identifier, and establishing a binding relationship between the application identifier and the port number when the application identifier has access to the device end corresponding to the port number in the IP address;

[0010] Establishing a UDP channel between the application identifier and the port number, and forwarding the second data packet to the IP address and the port number through the UDP channel, so that the device end corresponding to the port number processes the second data packet when receiving the second data packet, and replies a first protocol message to the forwarding service node;

[0011] According to the binding relationship, the first protocol message is forwarded to the application service.

[0012] Optionally, when the application identifier has the function of accessing the device end corresponding to the port number in the IP address, the method further includes:

[0013] Recording a successful authorization authentication session between the application identifier, the IP address and the port number in an authorization record;

[0014] Obtaining a third data packet sent by the application service, wherein the second data packet includes the application identifier of the application service, the IP address and the port number of the device end in the second network segment;

[0015] querying in the permission record whether there is a successful permission authentication session between the application identifier, the IP address and the port number; if so, forwarding the third data packet to the IP address and the port number through the UDP channel, so that the device end corresponding to the port number processes the third data packet when receiving the third data packet, and replies a second protocol message to the forwarding service node;

[0016] According to the binding relationship, the second protocol message is forwarded to the application service.

[0017] Optionally, the permission record adopts a least recently used strategy caching algorithm to manage sessions. When the number of saved permission authentication successful sessions exceeds a preset session threshold, the permission authentication successful session with the earliest usage time is deleted, and the permission authentication successful session with the latest usage time is saved.

[0018] Optionally, obtaining the second data packet sent by the application service includes:

[0019] The second data packet sent by the application service is received through the soft bus of the first network segment.

[0020] Optionally, when the application identifier has the function of accessing the device end corresponding to the port number in the IP address, the method further includes:

[0021] identifying a data type of the second data packet;

[0022] Allocating bandwidth and priority to the second data packet according to the data type;

[0023] The forwarding of the second data packet to the IP address and the port number through the UDP channel includes:

[0024] According to the bandwidth and the priority, the second data packet is transmitted to the IP address and the port number via the UDP channel.

[0025] Optionally, the device end includes an APL instrument, a temperature sensor, a pressure sensor, a flow meter, an electric valve, an industrial Ethernet switch and an HMI touch screen.

[0026] Optionally, the UDP channel is integrated with an adaptive congestion control algorithm to dynamically adjust the data transmission rate using the adaptive congestion control algorithm.

[0027] A cross-segment data forwarding device is applied to a forwarding service node, the device comprising: a forwarding service data packet multicast unit, a first application service data packet obtaining unit, an application authority authentication unit, a first application service data packet forwarding unit and a first protocol message forwarding unit,

[0028] The forwarding service data packet multicast unit is used to multicast a first data packet containing a service identifier of the forwarding service node to the first network segment, so that each application service registered in the first network segment obtains the first data packet, and sends a second data packet to the forwarding service node according to the service identifier, wherein the second data packet includes an application identifier of the application service, an IP address and a port number of a device end in the second network segment;

[0029] The first application service data packet obtaining unit is used to obtain the second data packet sent by the application service, and extract the application identifier of the application service, the IP address of the second network segment, and the port number;

[0030] The application authorization authentication unit is used to perform authorization authentication with the authorization authentication center based on the application identifier, and to establish a binding relationship between the application identifier and the port number when the application identifier has access to the device end corresponding to the port number in the IP address;

[0031] The first application service data packet forwarding unit is used to establish a UDP channel between the application identifier and the port number, and forward the second data packet to the IP address and the port number through the UDP channel, so that the device end corresponding to the port number processes the second data packet when receiving the second data packet, and replies a first protocol message to the forwarding service node;

[0032] The first protocol message forwarding unit is used to forward the first protocol message to the application service according to the binding relationship.

[0033] A computer-readable storage medium stores a program, which, when executed by a processor, implements any of the above-mentioned methods for forwarding data across network segments.

[0034] An electronic device, comprising at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other via the bus; and the processor is used to call program instructions in the memory to execute any of the above-mentioned cross-segment data forwarding methods.

[0035] By means of the above technical scheme, a method, device, storage medium and electronic device for forwarding data across network segments provided by the present invention are applied to a forwarding service node, the method comprising: multicasting a first data packet containing a service identifier of a forwarding service node to a first network segment, so that each application service registered in the first network segment obtains the first data packet, and sending a second data packet to the forwarding service node according to the service identifier, wherein the second data packet includes an application identifier of the application service, an IP address and a port number of a device end in the second network segment; obtaining a second data packet sent by the application service, extracting the application identifier of the application service, the IP address and the port number of the second network segment; performing authority authentication on an authority authentication center based on the application identifier, and building a binding relationship between the application identifier and the port number when the application identifier has access to the device end corresponding to the port number in the IP address; establishing a UDP channel between the application identifier and the port number, and forwarding the second data packet to the IP address and the port number through the UDP channel, so that the device end corresponding to the port number processes the second data packet when receiving the second data packet, and replies with a first protocol message to the forwarding service node; forwarding the first protocol message to the application service according to the binding relationship. The present invention constructs a forwarding service node for cross-segment communication between different network segments, and sends a service ID to an application service via multicast, so that the application service only needs to send data to the forwarding service and specify the device of the target network segment, thereby realizing cross-segment data communication and efficient data transmission.

[0036] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented according to the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present invention. Moreover, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0038] Figure 1 A schematic diagram showing a flow chart of an implementation of a method for forwarding data across network segments provided by an embodiment of the present invention;

[0039] Figure 2 A schematic diagram of the architecture of a data forwarding service provided by an embodiment of the present invention is shown;

[0040] Figure 3 A timing diagram of a method for forwarding data across network segments provided by an embodiment of the present invention is shown;

[0041] Figure 4 A schematic diagram of the structure of a cross-segment data forwarding device provided by an embodiment of the present invention is shown;

[0042] Figure 5 A schematic structural diagram of an electronic device provided by an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0043] The exemplary embodiments of the present invention will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present invention are shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present invention and to enable the scope of the present invention to be fully communicated to those skilled in the art.

[0044] In the field of communications, in order to solve the problem of cross-segment communication, the existing technology has proposed a variety of solutions, but these solutions have certain limitations when applied to industrial control systems. For example, although the RTP protocol has good real-time performance, it is not suitable for industrial control, the UDP port mapping method cannot achieve the reply of data packets, and the one-way transmission structure based on multicast does not meet the needs of two-way communication. Therefore, there is an urgent need for a new technical solution that can achieve two-way data transmission across network segments in industrial control systems while ensuring network security, thereby improving the management efficiency and operational convenience of the system.

[0045] Based on this, in an embodiment of the present invention, a cross-segment data forwarding method is provided, which is applied to a forwarding service node. The method includes: multicasting a first data packet containing a service identifier of a forwarding service node to a first network segment, so that a registered application service in the network segment obtains the first data packet. After the application service obtains the first data packet, it sends a second data packet containing an application identifier, an IP address of a second network segment, and a port number to the forwarding service node according to the service identifier. After receiving the second data packet, the forwarding service node extracts the application identifier, the IP address, and the port number, and performs authorization authentication to the authority authentication center. After confirming that the application identifier has access rights, a binding relationship between the application identifier and the port number is established. A UDP channel is established between the application identifier and the port number, and the second data packet is forwarded to the specified IP address and port number through the channel. After receiving the second data packet, the device end processes it and replies to the first protocol message to the forwarding service node. According to the binding relationship, the forwarding service node forwards the first protocol message to the corresponding application service, thereby realizing cross-segment data communication, simplifying the communication process, and improving the efficiency of cross-segment data transmission.

[0046] like Figure 1 As shown, a flow chart of an implementation of a method for forwarding data across network segments provided by an embodiment of the present invention is provided. The method is applied to a forwarding service node, and includes:

[0047] S100. Multicast a first data packet including a service identifier of a forwarding service node to the first network segment, so that each application service registered in the first network segment obtains the first data packet, and sends a second data packet to the forwarding service node based on the service identifier, wherein the second data packet includes an application identifier of the application service, and an IP address and port number of a device end in the second network segment.

[0048] The first network segment refers to the network sub-area that contains configuration software and instrument management software. Configuration software is used to configure, monitor and control the automation system, and provides human-machine interface (HMI) and system configuration tools to enable operators to manage and monitor the entire system. Instrument management software is used to manage and maintain various industrial instruments, including calibration, diagnosis and data acquisition functions.

[0049] Among them, multicast is a network communication method that allows a sender to send data packets to a specific group of receivers instead of sending them to each receiver individually (unicast) or to all receivers in the network (broadcast).

[0050] The service identifier is a unique identifier of the forwarding service node and is used to identify the forwarding service node.

[0051] A data packet is a unit of data transmitted in a network, which is encapsulated by a protocol message. A data packet is formed by encapsulating data and protocol message header information together for transmission in a network. A data packet usually includes a data part (payload) and a header part (control information).

[0052] The application service running and registered in the first network segment is configured to be able to receive multicast data packets, and thus can obtain the service identifier of the forwarding service node in the first data packet multicasted by the forwarding service node to the first network segment.

[0053] The second network segment refers to the network sub-area that includes intelligent APL instruments, communication cards, and conventional IO cards. Intelligent APL instruments (Advanced Physical Layer) are used in the physical layer of advanced industrial networks, supporting higher data transmission speeds and longer transmission distances. Communication cards are used for inter-device communication and support different communication protocols and network topologies. Conventional IO cards, i.e. input / output modules, are used to connect sensors and actuators to achieve signal acquisition and control.

[0054] The application ID refers to the unique identity of the application service, which is used to identify the application service.

[0055] The port number refers to the unique identifier of the local port of the device on the second network segment, and is used to identify the local port.

[0056] Specifically, an embodiment of the present invention can use multicast to send a data packet containing a forwarding service node identifier in the first network segment. This data packet contains the service identifier of the forwarding service node, and the purpose is to let other devices know the existence and purpose of this node. In the first network segment, some application services have been registered, and they are configured to receive such multicast data packets. After receiving this multicast data packet, these registered application services can obtain the service identification information inside. The application service determines the forwarding service node to which the data packet is to be sent based on the identification information of the forwarding service node previously received in the first data packet, and sends the second data packet to this forwarding service node.

[0057] S110: Obtain a second data packet sent by the application service, and extract an application identifier of the application service, an IP address of the second network segment, and a port number.

[0058] The embodiment of the present invention can parse the second data packet and extract the application identifier of the application service, the IP address and port number of the second network segment, thereby determining the source and destination information of the forwarding request of the second data packet for correct routing and forwarding.

[0059] S120, performing authorization authentication at an authorization authentication center based on the application identifier, and establishing a binding relationship between the application identifier and the port number when the application identifier has access to a device end corresponding to the port number in the IP address.

[0060] Specifically, the embodiment of the present invention can initiate a permission authentication request to the permission authentication center based on the application identifier, in order to verify whether the application has the permission to access the specified device. If the authentication center confirms that the application identifier does have access rights, and the access rights are for the device end with a specific IP address and port number, then based on the confirmation of the authority, a binding relationship will be established to associate the application identifier with the specific device port number, that is, the application identifier is officially authorized to access the corresponding device through the port number.

[0061] Optionally, in the case where the application identifier does not have the device end corresponding to the port number in the access IP address, the embodiment of the present invention can feed back corresponding forwarding failure information to the application service.

[0062] S130. Establish a UDP channel between the application identifier and the port number, and forward the second data packet to the IP address and port number through the UDP channel, so that the device end corresponding to the port number processes the second data packet when receiving the second data packet, and replies to the first protocol message to the forwarding service node.

[0063] The UDP channel is a data transmission channel implemented by UDP (User Datagram Protocol). The embodiment of the present invention can create a UDP channel dedicated to the application service corresponding to the application identifier and the local port corresponding to the port number for two-way data communication between the two parties.

[0064] Among them, a protocol message is a message format defined according to a specific network protocol and is used to implement a specific communication function.

[0065] The embodiment of the present invention can forward the second data packet to the local port corresponding to the port number in the device end under the IP address of the second network segment through the UDP channel. The device end will perform corresponding processing after receiving the second data packet, and after processing the second data packet, generate a first protocol message and send the first protocol message back to the forwarding service node.

[0066] S140. Forward the first protocol message to the application service according to the binding relationship.

[0067] A cross-segment data forwarding method provided by the present invention is applied to a forwarding service node, the method comprising: multicasting a first data packet containing a service identifier of a forwarding service node to a first network segment, so that each application service registered in the first network segment obtains the first data packet, and sending a second data packet to the forwarding service node according to the service identifier, wherein the second data packet includes an application identifier of the application service, an IP address and a port number of the second network segment; obtaining the second data packet sent by the application service, extracting the application identifier of the application service, the IP address and the port number of a device end in the second network segment; performing authority authentication on an authority authentication center based on the application identifier, and building a binding relationship between the application identifier and the port number when the application identifier has access to the device end corresponding to the port number in the IP address; establishing a UDP channel between the application identifier and the port number, and forwarding the second data packet to the IP address and the port number through the UDP channel, so that the device end corresponding to the port number processes the second data packet when receiving the second data packet, and replies with a first protocol message to the forwarding service node; forwarding the first protocol message to the application service according to the binding relationship. The present invention constructs a forwarding service node for cross-segment communication between different network segments, and sends a service ID to an application service via multicast, so that the application service only needs to send data to the forwarding service and specify the device of the target network segment, thereby realizing cross-segment data communication and efficient data transmission.

[0068] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, when the application identifier has a device end corresponding to the port number in the access IP address, the method may further include:

[0069] Record the successful authentication session between the application identifier, IP address and port number in the permission record; obtain a third data packet sent by the application service, wherein the second data packet includes the application identifier of the application service, the IP address and port number of the device end in the second network segment; query in the permission record whether there is a successful authentication session between the application identifier, IP address and port number, and if so, forward the third data packet to the IP address and port number through the UDP channel, so that the device end corresponding to the port number processes the third data packet when receiving the third data packet, and replies to the second protocol message to the forwarding service node; forward the second protocol message to the application service based on the binding relationship.

[0070] Among them, the permission record is a storage mechanism for recording and maintaining information about the permission authentication status between application identifiers, IP addresses and port numbers. Through these permission records, the system can quickly find out whether a specific application identifier has obtained permission to access a specific IP address and port number, thereby avoiding repeated permission authentication steps in subsequent communications and improving efficiency.

[0071] Among them, the permission authentication successful session refers to an association relationship recorded after the initial permission authentication is completed, which indicates that a specific application identifier has successfully obtained the permission to access a specific IP address and port number. This session record can be used in subsequent communication processes to avoid repeated permission authentication steps.

[0072] The embodiment of the present invention records relevant session information after the initial permission authentication is successful, and queries these records in subsequent communications, so as to skip repeated permission authentication steps and directly forward and process data, thereby improving the efficiency of industrial control data transmission in large-scale, high-frequency data communication scenarios.

[0073] Optionally, the permission record adopts a least recently used strategy caching algorithm to manage sessions. When the number of saved permission authentication successful sessions exceeds a preset session threshold, the permission authentication successful session with the earliest usage time is deleted and the permission authentication successful session with the latest usage time is saved.

[0074] The Least Recently Used (LRU) cache algorithm is used to manage which cached data should be deleted. The LRU strategy deletes data that has not been accessed for the longest time.

[0075] Optionally, the preset session threshold may be 10. In the embodiment of the present invention, when the number of sessions with successful authentication exceeds 10, the latest successful authentication session may be used to overwrite the earliest successful authentication session in a cyclic overwriting manner, so as to always keep the number of records not exceeding 10.

[0076] The embodiment of the present invention preferentially retains the most recently used session records through the LRU strategy, ensuring that the system cache stores the records that are most likely to be accessed again, thereby reducing the probability of cache misses and the number of times repeated permission authentication is required, and improving the overall data communication efficiency.

[0077] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, obtaining the second data packet sent by the application service may specifically include:

[0078] A second data packet sent by the application service is received through the soft bus of the first network segment.

[0079] Among them, the soft bus (Soft Bus) realizes the communication between the application service and the forwarding service node through software, and logically creates a virtual communication channel.

[0080] The embodiment of the present invention can quickly receive and process the second data packet sent by the application service through the soft bus technology, reduce the data processing waiting time and transmission delay, and thus improve the overall data transmission efficiency.

[0081] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, when the application identifier has a device end corresponding to the port number in the access IP address, the method may further include:

[0082] Identify the data type of the second data packet; allocate bandwidth and priority to the second data packet based on the data type; and transmit the second data packet to the IP address and port number via the UDP channel according to the bandwidth and priority.

[0083] Specifically, the embodiment of the present invention can analyze the second data packet to determine its data type, and then allocate corresponding bandwidth and priority according to the data type to ensure that data packets of different data types obtain appropriate resources. Finally, according to the set bandwidth and priority, the data packet is transmitted to the device end matching the IP address and port number through the UDP channel.

[0084] The embodiments of the present invention effectively optimize the efficiency and quality of data transmission by identifying and prioritizing data packets, ensuring that key data in the industrial control field can be transmitted in a timely manner to prevent potential dangerous events and ensure the efficient and stable operation of industrial control systems in complex and dynamic environments.

[0085] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, the device end includes an APL instrument, a temperature sensor, a pressure sensor, a flow meter, an electric valve, an industrial Ethernet switch and an HMI touch screen.

[0086] Among them, the APL instrument is an industrial instrument that utilizes advanced physical layer technology and is generally used to achieve efficient data transmission and communication.

[0087] Among them, the temperature sensor is a device used to measure temperature. It can convert temperature changes into electrical signals for further processing or control.

[0088] Among them, the pressure sensor is used to measure the pressure of fluid or gas. It converts the pressure signal into an electrical signal for further processing or control.

[0089] Among them, a flow meter is a device that measures the flow rate of a fluid (liquid or gas).

[0090] Among them, the electric valve is a valve operated by an electric actuator.

[0091] Among them, the industrial Ethernet switch is a network device designed specifically for industrial environments and is used to connect and manage multiple network devices.

[0092] Among them, HMI touch screen is a device for human-computer interaction, usually used in industrial control systems to display system status, parameters and provide control command input interface. HMI touch screen can display graphics, text and data, and allow users to interact with the system through touch.

[0093] Optional, in the above Figure 1 On the basis of one or more corresponding embodiments, in another optional embodiment provided by the embodiment of the present invention, the UDP channel is integrated with an adaptive congestion control algorithm to dynamically adjust the data transmission rate using the adaptive congestion control algorithm.

[0094] Among them, the Adaptive Congestion Control Algorithm is a mechanism used in network transmission, which aims to dynamically adjust the data transmission rate to adapt to changes in network status, thereby maximizing effective bandwidth utilization and minimizing network congestion and data loss.

[0095] Specifically, the embodiment of the present invention can use the application layer protocol to implement congestion control in the UDP channel, and can also use the enhanced protocol to introduce an adaptive congestion control algorithm in the UDP channel, wherein the enhanced protocol can be the QUIC protocol (QuickUDP Internet Connections), the DTLS (Datagram Transport Layer Security) protocol, the RTP protocol (Real-time Transport Protocol) and the RTCP (RTP Control Protocol) protocol. The embodiment of the present invention can improve the data transmission efficiency and reliability of industrial control data by introducing an adaptive congestion control algorithm in the UDP channel.

[0096] In order to facilitate understanding of the overall solution of a cross-segment data forwarding method provided by the present invention, an example is given here to illustrate: on network segment A, the service ID (Identifier, unique identifier) ​​of the forwarding service is announced by multicast. Each application on network segment A obtains the service ID of the forwarding service by receiving the multicast data packet, so that data can be sent to the forwarding service through the soft bus of network segment A. After the forwarding service receives the data packet notified through the soft bus, it parses the content of the data packet and extracts the source application ID, the IP address of the device on network segment B, and the port number. The extracted application ID is authenticated and verification is requested from the authority authentication center. If the authentication center feedbacks that the current application ID has the authority to access the IO device at the specified address, the processing continues; otherwise, the feedback fails to send. Once the authentication is successful, the forwarding service will record the authority of the application ID, and subsequent communications do not need to be authenticated again. The authority record adopts the LRU (least recently used) method, and only the records of the current 10 sessions are retained. After more than 10 sessions, they will be cyclically covered. The application ID that sends data is matched one by one with the local port number to establish a dedicated UDP channel. At the same time, the data packet is forwarded to the IP address and port number of the device in network segment B. After receiving the corresponding UDP message, the device in network segment B processes the data and replies the protocol message to the IP address and local port bound to the forwarding service. At this time, the forwarding service forwards the data replied by the received device back to the application service on network segment A through the application ID.

[0097] The embodiment of the present invention creates an application node between different network segments, and the node can communicate with network segment A and network segment B at the same time. A forwarding service runs on this node, which broadcasts its service ID on network segment A by multicast so that the registration service on network segment A can recognize it. When an application needs to communicate with a device on network segment B, it only needs to send data to the forwarding service on network segment A and specify the IP address and port number of the target network segment B device. After receiving the data, the forwarding service will forward it to the specified network segment B device, thereby realizing cross-segment device communication. In this way, not only the communication process between different network segments is simplified, but also the flexibility and scalability of the system are improved.

[0098] Figure 2 The figure shows the architecture diagram of the data forwarding service provided by the embodiment of the present invention. After the application service 1 obtains the service ID of the forwarding service: ionet_tunnel_0_0 through multicast, it can communicate with the APL instrument on the network segment B. Application service 1 sends a HART-IP protocol message to the APL instrument for instrument configuration. The forwarding service will bind a port for communication with the APL instrument. When the instrument replies to the protocol message, the forwarding service will forward the reply message back to the application through the application ID (application service 1) on the network segment A.

[0099] Figure 3 The timing diagram of the cross-segment data forwarding method provided by an embodiment of the present invention is shown. When an application needs to access a device, it first needs to obtain the location of the forwarding service through a multicast message. Then, the application sends a data packet to the forwarding service. After receiving the data packet, the forwarding service will first authenticate with the authority center to confirm that the application has access rights. After the authentication is passed, the forwarding service sends the data to the IO device. The IO device processes the data and feeds back a response, and then the forwarding service forwards the response back to the application, thereby completing a data interaction.

[0100] Although operations are depicted in a particular order, this should not be understood as requiring that the operations be performed in the particular order shown or in a sequential order.Multitasking and parallel processing may be advantageous under certain circumstances.

[0101] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0102] Corresponding to the above method embodiment, the embodiment of the present invention also provides a cross-segment data forwarding device, whose structure is as follows: Figure 4 As shown, applied to a forwarding service node, the device includes: a forwarding service data packet multicast unit 10, a first application service data packet obtaining unit 20, an application authority authentication unit 30, a first application service data packet forwarding unit 40 and a first protocol message forwarding unit 50.

[0103] The forwarding service data packet multicast unit 10 is used to multicast a first data packet containing a service identifier of a forwarding service node to the first network segment, so that each application service registered in the first network segment obtains the first data packet, and sends a second data packet to the forwarding service node based on the service identifier, wherein the second data packet includes an application identifier of the application service, an IP address and a port number of a device end in the second network segment.

[0104] The first application service data packet obtaining unit 20 is used to obtain a second data packet sent by the application service, and extract the application identifier of the application service, the IP address of the second network segment, and the port number.

[0105] The application authority authentication unit 30 is used to perform authority authentication to the authority authentication center based on the application identifier, and to establish a binding relationship between the application identifier and the port number when the application identifier has a device end corresponding to the port number in the access IP address.

[0106] The first application service data packet forwarding unit 40 is used to establish a UDP channel between the application identifier and the port number, and forward the second data packet to the IP address and port number through the UDP channel, so that the device end corresponding to the port number processes the second data packet when receiving the second data packet, and replies to the first protocol message to the forwarding service node.

[0107] The first protocol message forwarding unit 50 is used to forward the first protocol message to the application service according to the binding relationship.

[0108] Optionally, the device may further include: an authority authentication success session recording unit, a second application service data packet obtaining unit, an authority record query unit, a second application service data packet forwarding unit and a second protocol message forwarding unit.

[0109] The permission authentication success session recording unit is used to record the permission authentication success session between the application identifier, the IP address and the port number in the permission record when the application identifier has the device end corresponding to the port number in the access IP address.

[0110] The second application service data packet obtaining unit is used to obtain a third data packet sent by the application service, wherein the second data packet includes an application identifier of the application service, an IP address and a port number of a device end in the second network segment.

[0111] The permission record query unit is used to query whether there is a successful permission authentication session between the application identifier, IP address and port number in the permission record, and if so, trigger the second application service data packet forwarding unit.

[0112] The second application service data packet forwarding unit is used to forward the third data packet to the IP address and port number through the UDP channel, so that the device end corresponding to the port number processes the third data packet when receiving the third data packet, and replies to the second protocol message to the forwarding service node.

[0113] The second protocol message forwarding unit is used to forward the second protocol message to the application service according to the binding relationship.

[0114] Optionally, the permission record adopts a least recently used strategy caching algorithm to manage sessions. When the number of saved permission authentication successful sessions exceeds a preset session threshold, the permission authentication successful session with the earliest usage time is deleted and the permission authentication successful session with the latest usage time is saved.

[0115] Optionally, the first application service data packet obtaining unit 20 may be specifically configured to receive a second data packet sent by the application service through the soft bus of the first network segment.

[0116] Optionally, the device may further include: a data type identification unit and a resource allocation unit.

[0117] The data type identification unit is used to identify the data type of the second data packet when the application identifier has a device end corresponding to the port number in the access IP address.

[0118] The resource allocation unit is used to allocate bandwidth and priority to the second data packet according to the data type.

[0119] The first application service data packet forwarding unit 40 may be specifically configured to transmit the second data packet to the IP address and port number via the UDP channel according to bandwidth and priority.

[0120] Optionally, the device side includes APL instruments, temperature sensors, pressure sensors, flow meters, electric valves, industrial Ethernet switches and HMI touch screens.

[0121] Optionally, the UDP channel is integrated with an adaptive congestion control algorithm to dynamically adjust the data transmission rate using the adaptive congestion control algorithm.

[0122] The present invention provides a cross-segment data forwarding device, which is applied to a forwarding service node. The device is used to: multicast a first data packet containing a service identifier of a forwarding service node to a first network segment, so that each application service registered in the first network segment obtains the first data packet, and sends a second data packet to the forwarding service node based on the service identifier, wherein the second data packet includes an application identifier of the application service, an IP address and a port number of a device end in the second network segment; obtain the second data packet sent by the application service, extract the application identifier of the application service, the IP address and the port number of the second network segment; perform authority authentication on an authority authentication center based on the application identifier, and establish a binding relationship between the application identifier and the port number when the application identifier has access to the device end corresponding to the port number in the IP address; establish a UDP channel between the application identifier and the port number, and forward the second data packet to the IP address and the port number through the UDP channel, so that the device end corresponding to the port number processes the second data packet when receiving the second data packet, and replies with a first protocol message to the forwarding service node; and forward the first protocol message to the application service based on the binding relationship. The present invention constructs a forwarding service node for cross-segment communication between different network segments, and sends a service ID to an application service via multicast, so that the application service only needs to send data to the forwarding service and specify the device of the target network segment, thereby realizing cross-segment data communication and efficient data transmission.

[0123] Regarding the device in the above embodiment, the specific manner in which each unit performs the operation has been described in detail in the embodiment of the method, and will not be elaborated here.

[0124] The cross-segment data forwarding device includes a processor and a memory. The above-mentioned forwarding service data packet multicast unit 10, the first application service data packet acquisition unit 20, the application authority authentication unit 30, the first application service data packet forwarding unit 40 and the first protocol message forwarding unit 50 are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0125] The processor includes a kernel, which retrieves the corresponding program unit from the memory. The kernel can be set to one or more, and the kernel parameters are adjusted to multicast the first data packet containing the service identifier to the first network segment. After the application service registered in the first network segment receives it, the second data packet containing the application identifier, the IP address and the port number of the device end in the second network segment is sent. After the authority authentication is successful, the binding relationship between the application identifier and the port number is established, and then a dedicated UDP channel is established. The second data packet is forwarded to the specified address and port through the channel. After processing, the device replies with a protocol message, and the forwarding service node forwards the message to the application service through the binding relationship, thereby realizing cross-segment data communication, simplifying the communication process, and improving the efficiency of cross-segment data transmission.

[0126] An embodiment of the present invention provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, the cross-network segment data forwarding method is implemented.

[0127] An embodiment of the present invention provides a processor, which is used to run a program, wherein the cross-network segment data forwarding method is executed when the program is running.

[0128] like Figure 5 As shown, an embodiment of the present invention provides an electronic device 1000, which includes at least one processor 1001, at least one memory 1002 connected to the processor 1001, and a bus 1003; wherein the processor 1001 and the memory 1002 communicate with each other through the bus 1003; the processor 1001 is used to call the program instructions in the memory 1002 to execute the above-mentioned cross-segment data forwarding method. The electronic device in this article can be a server, a PC, a PAD, a mobile phone, etc.

[0129] The present invention also provides a computer program product, which, when executed on an electronic device, is suitable for executing a program having steps of initializing a method for forwarding data across network segments.

[0130] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatuses, electronic devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable device to generate a machine, so that the instructions executed by the processor of the computer or other programmable device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0131] In a typical configuration, an electronic device includes one or more processors (CPU), a memory, and a bus. The electronic device may also include an input / output interface, a network interface, and the like.

[0132] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip. The memory is an example of a computer-readable medium.

[0133] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0134] In the description of the present invention, it should be understood that the terms "up", "down", "front", "back", "left" and "right" etc. indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings. They are only for the convenience of describing the present invention and simplifying the description. They do not indicate or imply that the positions or elements referred to must have specific directions, be constructed and operate in specific directions. Therefore, they should not be understood as limitations of the present invention.

[0135] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. It should also be noted that the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0136] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0137] The above are only embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A method for forwarding data across network segments, characterized in that: Applied to a forwarding service node, the method comprises: Multicast a first data packet including a service identifier of the forwarding service node to the first network segment, so that each application service registered in the first network segment obtains the first data packet, and sends a second data packet to the forwarding service node according to the service identifier, wherein the second data packet includes an application identifier of the application service, an IP address and a port number of a device end in the second network segment; Obtaining the second data packet sent by the application service, and extracting the application identifier of the application service, the IP address of the second network segment, and the port number; Performing authorization authentication with an authorization authentication center based on the application identifier, and establishing a binding relationship between the application identifier and the port number when the application identifier has access to the device end corresponding to the port number in the IP address; Establishing a UDP channel between the application identifier and the port number, and forwarding the second data packet to the IP address and the port number through the UDP channel, so that the device end corresponding to the port number processes the second data packet when receiving the second data packet, and replies a first protocol message to the forwarding service node; According to the binding relationship, the first protocol message is forwarded to the application service.

2. The method according to claim 1, characterized in that In the case where the application identifier has the function of accessing the device end corresponding to the port number in the IP address, the method further includes: Recording a successful authorization authentication session between the application identifier, the IP address and the port number in an authorization record; Obtaining a third data packet sent by the application service, wherein the second data packet includes the application identifier of the application service, the IP address and the port number of the device end in the second network segment; querying in the permission record whether there is a successful permission authentication session between the application identifier, the IP address and the port number; if so, forwarding the third data packet to the IP address and the port number through the UDP channel, so that the device end corresponding to the port number processes the third data packet when receiving the third data packet, and replies a second protocol message to the forwarding service node; According to the binding relationship, the second protocol message is forwarded to the application service.

3. The method according to claim 2, characterized in that The permission record adopts the least recently used strategy caching algorithm to manage sessions. When the number of saved permission authentication successful sessions exceeds a preset session threshold, the permission authentication successful session with the earliest usage time is deleted, and the permission authentication successful session with the latest usage time is saved.

4. The method according to claim 1, characterized in that: The obtaining the second data packet sent by the application service includes: The second data packet sent by the application service is received through the soft bus of the first network segment.

5. The method according to claim 1, characterized in that In the case where the application identifier has the function of accessing the device end corresponding to the port number in the IP address, the method further includes: identifying a data type of the second data packet; Allocating bandwidth and priority to the second data packet according to the data type; The forwarding of the second data packet to the IP address and the port number through the UDP channel includes: According to the bandwidth and the priority, the second data packet is transmitted to the IP address and the port number via the UDP channel.

6. The method according to claim 1, characterized in that The equipment side includes APL instruments, temperature sensors, pressure sensors, flow meters, electric valves, industrial Ethernet switches and HMI touch screens.

7. The method according to claim 1, characterized in that The UDP channel is integrated with an adaptive congestion control algorithm to dynamically adjust the data transmission rate using the adaptive congestion control algorithm.

8. A cross-segment data forwarding device, characterized in that: Applied to a forwarding service node, the device comprises: a forwarding service data packet multicast unit, a first application service data packet obtaining unit, an application authority authentication unit, a first application service data packet forwarding unit and a first protocol message forwarding unit, The forwarding service data packet multicast unit is used to multicast a first data packet containing a service identifier of the forwarding service node to the first network segment, so that each application service registered in the first network segment obtains the first data packet, and sends a second data packet to the forwarding service node according to the service identifier, wherein the second data packet includes an application identifier of the application service, an IP address and a port number of a device end in the second network segment; The first application service data packet obtaining unit is used to obtain the second data packet sent by the application service, and extract the application identifier of the application service, the IP address of the second network segment, and the port number; The application authorization authentication unit is used to perform authorization authentication with the authorization authentication center based on the application identifier, and to establish a binding relationship between the application identifier and the port number when the application identifier has access to the device end corresponding to the port number in the IP address; The first application service data packet forwarding unit is used to establish a UDP channel between the application identifier and the port number, and forward the second data packet to the IP address and the port number through the UDP channel, so that the device end corresponding to the port number processes the second data packet when receiving the second data packet, and replies a first protocol message to the forwarding service node; The first protocol message forwarding unit is used to forward the first protocol message to the application service according to the binding relationship.

9. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by the processor, the cross-segment data forwarding method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: The electronic device includes at least one processor, and at least one memory and a bus connected to the processor; wherein the processor and the memory communicate with each other through the bus; the processor is used to call program instructions in the memory to execute the cross-segment data forwarding method as described in any one of claims 1 to 7.

Images