Cross-region interactive SIP relay networking connection method and device

Abstract

The invention discloses a cross-region interactive SIP (Session Initiation Protocol) relay networking connection method and device, and the SIP relay networking connection method specifically comprises the following steps: defining an internal network subnet and a public network subnet which are used for the communication of a power system; function information is configured in an SIP server, and the SIP server is arranged in an intranet subnet; intranet subnet connection information, public subnet connection information, an encryption protocol and a crossing rule are configured in an SBC gateway, the SBC gateway is arranged at the joint of an intranet subnet and a public subnet, and the crossing rule comprises a segmented crossing rule and a firewall rule. The encryption protocol comprises a transmission encryption protocol from the intranet subnet to the public network subnet and / or from the public network subnet to the intranet subnet. According to the method, under the condition that the communication interaction requirement of a power system is met, secure transmission of data in a controlled environment is ensured by deploying the SBC gateway and configuring rules such as segmented crossing, a firewall and encryption.

Description

Technical Field

[0001] The present invention belongs to the technical field of communication transmission, and in particular relates to a cross-zone interactive SIP relay networking connection method and device. Background Art

[0002] The power system involves a large amount of real-time data exchange and message transmission, which places high demands on information security and communication stability. The real-time interaction of cross-regional messages, signaling, and media streaming communication services in the power system must meet the requirements of real-time, stability, and scalability while ensuring system security.

[0003] At present, there have been some studies on cross-regional connection schemes for power systems. For example, patent CN110022325A provides a system and method for safe and efficient cross-regional data interaction of the power communication network monitoring platform, which solves the problems of security risks, low efficiency and high latency in cross-regional data interaction of the power communication network monitoring platform. The system includes a monitoring information acquisition module, a monitoring application module and an isolation device; the monitoring information acquisition module is used to collect the operating data of each network manager and transmit the collected data to the monitoring application module for use by each business module; the isolation device includes a forward isolation device and a reverse isolation device, the forward isolation device is used to realize one-way data transmission from the monitoring information acquisition module to the monitoring application module, and the reverse isolation device is used to realize one-way data transmission from the monitoring application module to the monitoring information acquisition module; the monitoring application module is used to receive the data sent by the monitoring information acquisition module, store, analyze and process it, and send request tasks to the monitoring information acquisition module in reverse.

[0004] However, as mentioned above, the information security and real-time communication processing of the power system still have some problems, such as information leakage, communication delay and insufficient cross-region security protection.

[0005] Therefore, how to provide a cross-region SIP relay networking connection and configuration solution based on the power information security requirements and the cross-region interaction needs of real-time communication services to improve the communication efficiency of the power system and ensure the security of information transmission is an urgent problem to be solved by technical personnel in this field. Summary of the invention

[0006] In view of the defects existing in the above-mentioned prior art, the present invention provides a cross-zone interactive SIP relay networking connection method and device, the SIP relay networking connection method specifically includes the following steps: defining the intranet subnet and the public network subnet used for the communication of the power system; configuring the function information in the SIP server, wherein the SIP server is set in the intranet subnet; configuring the intranet subnet connection information, the public network subnet connection information, the encryption protocol and the traversal rules in the SBC gateway, wherein the SBC gateway is set at the connection between the intranet subnet and the public network subnet, the traversal rules include the segment traversal rules and the firewall rules, and the encryption protocol includes the transmission encryption protocol from the intranet subnet to the public network subnet and / or the public network subnet to the intranet subnet. While meeting the communication interaction requirements of the power system, the present invention ensures the safe transmission of data in a controlled environment by deploying the SBC gateway and configuring the segment traversal, firewall, encryption and other rules.

[0007] In a first aspect, the present invention provides a cross-zone interactive SIP trunk networking connection method, which specifically includes the following steps:

[0008] Define the intranet subnet and the public network subnet, where the intranet subnet is used for power system communication;

[0009] Configure function information in the SIP server, wherein the SIP server is set in the intranet subnet;

[0010] Intranet subnet connection information, public network subnet connection information, encryption rules and traversal rules are configured in the SBC gateway, wherein the SBC gateway is set at the connection between the intranet subnet and the public network subnet, the traversal rules include segment traversal rules and firewall rules, and the encryption protocol includes the transmission encryption protocol from the intranet subnet to the public network subnet and / or the public network subnet to the intranet subnet.

[0011] Furthermore, the functional information includes IP addresses, domain names, security certificates, and enabled configuration services;

[0012] The intranet subnet connection information includes the connection between the internal interface and the SIP server and the enabling configuration service;

[0013] The public network subnet connection information includes external interfaces and access rules, wherein the access rules include security policy rules and routing rules.

[0014] Furthermore, the encryption rule includes a first encryption rule and a second encryption rule, the first encryption rule is a TLS encryption rule, and the second encryption rule is an SRTP encryption rule.

[0015] Furthermore, TLS encryption rules include:

[0016] TLS encryption is performed on SIP signaling, as follows:

[0017]

[0018] Among them, m is SIP signaling, k1 is TLS encryption key, E TLS is the TLS encryption function, E TLS (m,k) is the SIP signaling after m is encrypted, M SIP is a set of SIP signaling messages, K SIP A collection of encryption keys for TLS;

[0019] SRTP encryption rules, including:

[0020] SRTP encryption is performed on the RTP stream, which is specifically expressed as follows:

[0021]

[0022] Among them, s is the RTP stream, k2 is the SRTP encryption key, R v is the encrypted random value, E SRTP is the SRTP encryption function, E SRTP (s,k2,R v ) is the RTP stream after s encryption, S RTP is the data packet of the RTP stream, K SRTP It is a set of SRTP encryption keys and corresponding encrypted random values.

[0023] Furthermore, the function information also includes permission information, which includes a user set U, a role set RU, a permission type set P, a permission resource set S, and a permission rule set ACL. The permission rule set is specifically expressed as:

[0024]

[0025] AR0 is allowed to access all privileged resources, r is the rule function that defines the user's role, and U i is the set of users of the i-th category, RU T,0 For the administrator role, AR x To allow access to x-level permission resources, U j is the j-th user set, p is the rule function that defines the user's permission type, q is the rule function that defines the user's permission resource, Q x Get the permission resource set for class x, FA is unauthorized access.

[0026] Furthermore, the segment traversal rules define network segments and perform regional allocation and transmission path planning logic based on the analysis of the transmitted SIP traffic;

[0027] Firewall rules are based on the logic of analyzing the transmitted SIP traffic and blocking it.

[0028] Furthermore, configure firewall rules, including:

[0029] Define a first parameter set and a first function set, wherein the first parameter set includes a SIP traffic set S, a SIP traffic rule set A SIP , Traffic blocking rule set B, IDS monitoring rule set M SIP And the malicious SIP traffic set N SIP ; The first function set includes a matching function match(f, R) and a detection function detect(f, M SIP );

[0030] Initialize the first parameter set, and after initialization, allow SIP traffic rule set A SIP And the blocking traffic rule set B is specifically expressed as:

[0031] A SIP ={a1, a2, ..., a n}

[0032] B={b1,b2,…,b m}

[0033] Among them, a1, a2…a n The 1st, 2nd, ...nth initial SIP traffic rules are allowed, b1, b2, ... n These are the 1st, 2nd,…mth traffic blocking rules respectively;

[0034] For each SIP flow f in the SIP flow set S, the following analysis is performed:

[0035] If match(f,A SIP ) is true, allowing SIP traffic f to pass through the firewall;

[0036] If match(f, B∩S) is true, block SIP traffic f from passing through the firewall;

[0037] For each SIP flow f passing through the firewall, combined with the IDS monitoring rule set, the following analysis is performed:

[0038] Calculate detect(f, M SIP ), if the result is not null, the SIP flow f is identified as malicious flow and blocked.

[0039] Furthermore, configure the segment traversal rules, including:

[0040] A second parameter set and a second function set are defined, wherein the second parameter set includes a network node set N, a VPN tunnel set T, a functional region set TR, a traffic set F, and a security policy set P; the second function set includes a tunnel association function tunnel(n1, n2), a region belonging function region(n), and a traffic routing function route(f);

[0041] According to the set of functional regions TR, the network node set N is divided, and for each n∈N, the region region(n) to which it belongs is determined;

[0042] For the target node pair (n1, n2) that communicates across the intranet subnet and the public network subnet, if they are located in different security zones and are in a state of waiting for secure communication, a VPN tunnel t∈T is created, so that tunnel(n1, n2)=t;

[0043] According to the traffic routing function route(f) and the security policy set P, determine the transmission path of SIP traffic f∈F;

[0044] If the SIP traffic f∈F does not match the security policy set P, block the SIP traffic f∈F and record it.

[0045] Furthermore, it also includes setting a monitoring module including multiple monitoring devices, specifically including:

[0046] Define a third parameter set, wherein the third parameter set includes a SIP server and SBC gateway state set S, a time frame set T, and a monitoring device set M;

[0047] Based on the status of SIP server and SBC gateway, the time frame is matched with the monitoring equipment and early warning information is given;

[0048] Define a fourth parameter set, wherein the fourth parameter set includes a log record set L and an audit operation set A;

[0049] Combine the time frame and warning information to generate log items and update the log record set;

[0050] Based on the analysis of the matching of the audit operations with the log record set, the audit operation set is updated.

[0051] In a second aspect, the present invention further provides a cross-zone interactive SIP trunk networking connection device, which adopts the cross-zone interactive SIP trunk networking connection method as described above, specifically comprising:

[0052] A definition unit, used to define an intranet subnet and a public network subnet, wherein the intranet subnet is used for communication of the power system;

[0053] The setting unit is used to configure function information in the SIP server, wherein the SIP server is set in the intranet subnet; configure the intranet subnet connection information, the public network subnet connection information, the encryption protocol and the traversal rules in the SBC gateway, wherein the SBC gateway is set at the connection between the intranet subnet and the public network subnet, the traversal rules include segment traversal rules and firewall rules, and the encryption protocol includes the transmission encryption protocol from the intranet subnet to the public network subnet and / or the public network subnet to the intranet subnet.

[0054] The present invention provides a cross-region interactive SIP trunk networking connection method and device, which at least includes the following beneficial effects:

[0055] (1) While meeting the communication interaction requirements of the power system, the present invention ensures the secure transmission of data in a controlled environment by deploying an SBC gateway and configuring segment traversal, firewall, encryption and other rules.

[0056] (2) Configure encryption rules in the SBC gateway, encrypt SIP signaling through TLS encryption rules, and encrypt RTP streams through SRTP encryption rules. This not only protects the confidentiality of channel content, but also ensures the security of media stream data (RTP stream).

[0057] (3) For the traversal rules configured in the SBC gateway, including segment traversal rules and firewall rules, VPN technology is used to create a secure tunnel to protect the communication between the intranet subnet and the public network subnet, and to segment the network for different functional areas to ensure that key data is transmitted in a controlled environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 A schematic diagram of a flow chart of a cross-zone interactive SIP trunk networking connection method provided by the present invention;

[0059] Figure 2 A schematic diagram of a SIP trunk networking architecture of an embodiment of the present invention;

[0060] Figure 3 A schematic diagram of a process for configuring firewall rules according to an embodiment of the present invention;

[0061] Figure 4 A schematic diagram of a flow chart of configuring segment traversal rules according to an embodiment of the present invention;

[0062] Figure 5 A schematic diagram of the architecture of a cross-zone interactive SIP trunk networking connection device provided by the present invention. DETAILED DESCRIPTION

[0063] In order to better understand the above technical solution, the above technical solution will be described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0064] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings, and "multiple" generally includes at least two.

[0065] It should also be noted that the term "includes", "comprising" or any other variation thereof is intended to cover non-exclusive inclusion, so that a commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprising a ..." do not exclude the existence of other identical elements in the commodity or device including the elements.

[0066] The real-time interaction of cross-regional messages, signaling, and media streaming communication services in the power system must meet the requirements of real-time, stability, and scalability while ensuring system security.

[0067] Based on the power information security requirements and the cross-region interaction needs of real-time communication services, we can combine the real-time interaction technology of cross-region messaging, signaling and media streaming communication services to provide a cross-region SIP relay networking connection and configuration solution to improve the communication efficiency of the power system and ensure the security of information transmission.

[0068] like Figure 1 As shown, the present invention provides a cross-zone interactive SIP trunk networking connection method, which specifically includes the following steps:

[0069] Define the intranet subnet and the public network subnet, where the intranet subnet is used for power system communication;

[0070] Configure function information in the SIP server, wherein the SIP server is set in the intranet subnet;

[0071] Intranet subnet connection information, public network subnet connection information, encryption rules and traversal rules are configured in the SBC gateway, wherein the SBC gateway is set at the connection between the intranet subnet and the public network subnet, the traversal rules include segment traversal rules and firewall rules, and the encryption protocol includes the transmission encryption protocol from the intranet subnet to the public network subnet and / or the public network subnet to the intranet subnet.

[0072] SIP server is a communication method based on SIP (Session Initiation Protocol). The cross-region SIP trunk networking is designed to achieve seamless communication between the intranet subnet and the public network subnet, ensure efficient, secure and reliable voice and data transmission, and combine real-time interaction to further optimize the networking quality and communication efficiency.

[0073] SBC (Session Border Controller) gateway is an IP service gateway in VoIP communication. It can support VoIP session signaling agent and media agent at the same time. It is deployed at the key nodes of VoIP communication network. By parsing and processing session signaling and media at both ends of the node (intranet subnet and public network subnet), it realizes signaling intercommunication, traffic control, NAT (Network Address Translation) traversal, call encryption and decryption, blocking of illegal access and QoS (Quality of Service) and other services in VoIP business.

[0074] While meeting the communication interaction requirements of the power system, the present invention ensures the secure transmission of data in a controlled environment by deploying an SBC gateway and configuring segment traversal, firewall, encryption and other rules.

[0075] The functional information of the SIP server configuration includes the IP address, domain name, security certificate and enabled configuration service.

[0076] Specifically expressed as:

[0077] Configure IP address: IP S ∈N internal ;

[0078] Configure domain name (FQDN, fully qualified domain name): FQND S ;

[0079] Configure security certificate: Cert S ;

[0080] Start configuration service: F SIP .

[0081] The configuration of the SBC gateway includes the intranet subnet connection information, which specifically includes the connection between the internal interface and the SIP server and the enabling configuration service;

[0082] It also includes public network subnet connection information, which specifically includes external interfaces and access rules, wherein the access rules include security policy rules and routing rules.

[0083] Specifically expressed as:

[0084] Configure internal interface: IP B-internal ∈N internal ;

[0085] Configure external interface: IP B-external ∈N external , which can also be expressed as DMZ;

[0086] Configure the connection to the SIP server:

[0087] Configuration Enable configuration service: F SBC .

[0088] Configure routing rules R according to the information and requirements of intranet transmission to ensure that SIP server calls can be correctly routed to the intranet subnet or accessed from the intranet subnet network; the service is ready when all security policy rules are correctly configured, routing rules are valid, and internal tests and customer tests of the intranet subnet are passed.

[0089] When configuring encryption rules in the SBC gateway, it is necessary to protect the confidentiality of the channel content and ensure the security of the media stream data (RTP stream). Therefore, the encryption rules include two parts, namely, the first encryption rule and the second encryption rule. The first encryption rule is the TLS encryption rule, which encrypts the SIP signaling; the second encryption rule is the SRTP encryption rule, which encrypts the RTP stream.

[0090] Among them, TLS encryption rules include:

[0091] TLS encryption is performed on SIP signaling, as follows:

[0092]

[0093] Among them, m is SIP signaling, k1 is TLS encryption key, E TLS is the TLS encryption function, E TLS (m,k) is the SIP signaling after m is encrypted, M SIP is a set of SIP signaling messages, K SIP A collection of encryption keys for TLS;

[0094] The SRTP encryption rules include:

[0095] SRTP encryption is performed on the RTP stream, which is specifically expressed as follows:

[0096]

[0097] Among them, s is the RTP stream, k2 is the SRTP encryption key, R v is the encrypted random value, E SRTP is the SRTP encryption function, E SRTP (s,k2,R v ) is the RTP stream after s encryption, S RTP is the data packet of the RTP stream, K SRTP It is a set of SRTP encryption keys and corresponding encrypted random values.

[0098] In addition, the configuration of the function information in the SIP server also includes permission information, which specifically includes a user set U, a role set RU, a permission type set P, a permission resource set S, and a permission rule set ACL. The permission rule set is specifically expressed as:

[0099]

[0100] AR0 is allowed to access all privileged resources, r is the rule function that defines the user's role, and U i is the set of users of type i, RU T,0 For the administrator role, AR x To allow access to x-level permission resources, U j is the j-th user set, p is the rule function that defines the user's permission type, q is the rule function that defines the user's permission resource, Q x It is a collection of x-type permission resources, and FA is unauthorized access.

[0101] The user set U includes all users who may access the SIP trunk service; the role set RU, each role has a different permission set; the permission type set P includes all possible operations or access permission types, such as read, write, execute, etc.; the permission resource set S refers to the related resources of the SIP trunk service; the permission rule set ACL defines the accessible resources, roles, and users.

[0102] A rule function r can be used to define the relationship between roles and users, and each user can be assigned a role. The rule function r can be in the form of a mapping, matching, or other corresponding relationships, which are not specifically limited here.

[0103] A rule function p may be used to define the relationship between users and permission types, and each user may be assigned a corresponding permission type. The rule function p may be in the form of a mapping, matching, or other corresponding relationships, which are not specifically limited here.

[0104] Similarly, a rule function q can be used to define the relationship between users and authority resources, and each user can be assigned a corresponding authority resource. This rule function q can be in the form of a mapping, matching, or other corresponding relationship, which is not specifically limited here.

[0105] Generally speaking, AR0 can be considered as the authority resource corresponding to the administrator. x It can be considered as the permission resource corresponding to ordinary users. Different ordinary users have different permission resources. FA is unauthorized access, which can be considered as the permission resource corresponding to "unauthorized users". "Unauthorized users" may not be an actual role. They are used as a placeholder in the permission rule set ACL to represent users who do not have a clearly defined role or users who attempt illegal access.

[0106] Based on the above permission information, when a user tries to access the SIP trunk service, the user's role will be checked first, and then the permission rule set ACL will be used to determine whether the user has the right to access the requested resource. If the permission rule set ACL allows access, access will be authorized. If the permission rule set ACL does not allow access, access will be denied.

[0107] The traversal rules configured in the SBC gateway include segment traversal rules and firewall rules. VPN technology is used to create a secure tunnel to protect the communication between the intranet subnet and the public network subnet, and to segment different functional areas to ensure that key data is transmitted in a controlled environment. Specifically, the segment traversal rules define network segments and perform area allocation and transmission path planning logic based on the analysis of the transmitted SIP traffic;

[0108] Firewall rules are based on the logic of analyzing the transmitted SIP traffic and blocking it.

[0109] like Figure 3 As shown, configure firewall rules, including:

[0110] Define a first parameter set and a first function set, wherein the first parameter set includes a SIP traffic set S, a SIP traffic rule set A SIP , Traffic blocking rule set B, IDS monitoring rule set M SIP And the malicious SIP traffic set N SIP ; The first function set includes a matching function match(f, R) and a detection function detect(f, M SIP );

[0111] Initialize the first parameter set, and after initialization, allow SIP traffic rule set A SIP And the blocking traffic rule set B is specifically expressed as:

[0112] A SIP ={a1, a2, ..., a n}

[0113] B={b1,b2,…,b m}

[0114] Among them, a1, a2…a n The 1st, 2nd, ...nth initial SIP traffic rules are allowed, b1, b2, ... n These are the 1st, 2nd,…mth traffic blocking rules respectively;

[0115] For each SIP flow f in the SIP flow set S, the following analysis is performed:

[0116] If match(f,A SIP ) is true, allowing SIP traffic f to pass through the firewall;

[0117] If match(f, B∩S) is true, block SIP traffic f from passing through the firewall;

[0118] For each SIP flow f passing through the firewall, combined with the IDS monitoring rule set, the following analysis is performed:

[0119] Calculate detect(f, M SIP ), if the result is not null, the SIP flow f is identified as malicious flow and blocked.

[0120] SIP traffic set S: contains all data packets transmitted between the intranet subnet and the public network subnet;

[0121] Allow SIP traffic rule set A SIP : Allowed traffic defined based on source address, destination address, port number and SIP method;

[0122] Traffic blocking rule set B: Traffic blocking rules for various protocol traffic including SIP;

[0123] IDS monitoring rule set M SIP : A collection of rules specifically designed to identify potentially malicious activity or anomalous behavior in SIP traffic;

[0124] Malicious SIP traffic set N SIP : Malicious SIP traffic packets identified by IDS;

[0125] Matching function match(f, R): For SIP traffic f∈S and rule set R (the rule set can be A SIPor B), if the SIP flow f meets any rule in the rule set R, then return true, otherwise return false;

[0126] Detection function detect(f, M SIP ): For SIP traffic f∈S and IDS monitoring rule set M SIP , if SIP traffic f is identified as malicious traffic, the corresponding malicious traffic description n∈N is returned SIP , otherwise returns null.

[0127] like Figure 4 As shown in the figure, configure the segment traversal rules, including:

[0128] A second parameter set and a second function set are defined, wherein the second parameter set includes a network node set N, a VPN tunnel set T, a functional region set FR, a traffic set F, and a security policy set P; the second function set includes a tunnel association function tunnel(n1, n2), a region belonging function region(n), and a traffic routing function route(f);

[0129] According to the set of functional regions FR, the network node set N is divided, and for each n∈N, the region region(n) to which it belongs is determined;

[0130] For the target node pair (n1, n2) that communicates across the intranet subnet and the public network subnet, if they are located in different security zones and are in a state of waiting for secure communication, a VPN tunnel t∈T is created, so that tunnel(n1, n2)=t;

[0131] According to the traffic routing function route(f) and the security policy set P, determine the transmission path of SIP traffic f∈F;

[0132] If the SIP traffic f∈F does not match the security policy set P, block the SIP traffic f∈F and record it.

[0133] The network node set N includes all nodes participating in the SIP relay in the intranet subnet and the public network subnet (for example, SIP servers, clients, SBC gateways, etc.);

[0134] VPN tunnel set T: a set of encrypted tunnels created by VPN technology to protect communications between the intranet subnet and the public network subnet;

[0135] Functional area set FR: different network areas divided according to network functions and security requirements (network areas that can be divided into DMZ area, core data area, access control area);

[0136] Traffic set F: contains all SIP traffic packets transmitted in the network;

[0137] Security policy set P: controls the flow of traffic between different functional areas;

[0138] Tunnel association function tunnel(n1, n2): For any two network nodes n1, n2∈N, if there is a tunnel t∈T connecting them, then tunnel(n1, n2) = t, otherwise it is undefined;

[0139] Region belonging function region(n): For any network node n∈N, return the functional region r∈R to which the node belongs;

[0140] Traffic routing function route(f): For any traffic f∈F, determine the traffic transmission path in the network based on the security policy P and network topology.

[0141] Divide the network node set N according to the set of functional regions FR, that is, for each n∈N, determine the region region(n) to which it belongs;

[0142] For a node pair (n1, n2) that needs to communicate across the intranet subnet and the public network subnet, if they are located in different security zones and need secure communication, a VPN tunnel t∈T is created such that tunnel(n1, n2)=t;

[0143] When SIP traffic f∈F is transmitted in the network, the traffic transmission path is determined according to the traffic routing function route(f) and the security policy set P. If SIP traffic f violates any security policy, SIP traffic f is blocked and recorded, alarmed and blocked to ensure that SIP traffic f is only transmitted through authorized VPN tunnels and controlled functional areas to avoid leakage to unsafe environments.

[0144] The cross-zone interactive SIP trunk networking connection method also includes setting a monitoring module including multiple monitoring devices, specifically including:

[0145] Define a third parameter set, wherein the third parameter set includes a SIP server and SBC gateway state set ST, a time frame set T, and a monitoring device set M;

[0146] Based on the status of SIP server and SBC gateway, the time frame is matched with the monitoring equipment and early warning information is given;

[0147] Define a fourth parameter set, wherein the fourth parameter set includes a log record set L and an audit operation set A;

[0148] Combine the time frame and warning information to generate log items and update the log record set;

[0149] Based on the analysis of the matching of the audit operations with the log record set, the audit operation set is updated.

[0150] like Figure 5 As shown, the present invention also provides a cross-zone interactive SIP trunk networking connection device, which adopts the cross-zone interactive SIP trunk networking connection method as described above, specifically comprising:

[0151] A definition unit, used to define an intranet subnet and a public network subnet, wherein the intranet subnet is used for communication of the power system;

[0152] The setting unit is used to configure function information in the SIP server, wherein the SIP server is set in the intranet subnet; configure the intranet subnet connection information, the public network subnet connection information, the encryption protocol and the traversal rules in the SBC gateway, wherein the SBC gateway is set at the connection between the intranet subnet and the public network subnet, the traversal rules include segment traversal rules and firewall rules, and the encryption protocol includes the transmission encryption protocol from the intranet subnet to the public network subnet and / or the public network subnet to the intranet subnet.

[0153] The present invention provides a cross-region interactive SIP trunk networking connection method and device, which at least includes the following beneficial effects:

[0154] (1) While meeting the communication interaction requirements of the power system, the present invention ensures the secure transmission of data in a controlled environment by deploying an SBC gateway and configuring segment traversal, firewall, encryption and other rules.

[0155] (2) Configure encryption rules in the SBC gateway, encrypt SIP signaling through TLS encryption rules, and encrypt RTP streams through SRTP encryption rules. This not only protects the confidentiality of channel content, but also ensures the security of media stream data (RTP stream).

[0156] (3) For the traversal rules configured in the SBC gateway, including segment traversal rules and firewall rules, VPN technology is used to create a secure tunnel to protect the communication between the intranet subnet and the public network subnet, and to segment the network for different functional areas to ensure that key data is transmitted in a controlled environment.

[0157] Although preferred embodiments of the present invention have been described, additional changes and modifications may be made to these embodiments by those skilled in the art once the basic inventive concepts are known. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A cross-region interactive SIP trunk networking connection method, characterized in that: The specific steps include: Define the intranet subnet and the public network subnet, where the intranet subnet is used for power system communication; Configure function information in the SIP server, wherein the SIP server is set in the intranet subnet; Intranet subnet connection information, public network subnet connection information, encryption rules and traversal rules are configured in the SBC gateway, wherein the SBC gateway is set at the connection between the intranet subnet and the public network subnet, the traversal rules include segment traversal rules and firewall rules, and the encryption protocol includes the transmission encryption protocol from the intranet subnet to the public network subnet and / or the public network subnet to the intranet subnet.

2. The cross-region interactive SIP trunk networking connection method as claimed in claim 1, characterized in that: Functional information includes IP addresses, domain names, security certificates, and enabled configuration services; The intranet subnet connection information includes the connection between the internal interface and the SIP server and the enabling configuration service; The public network subnet connection information includes external interfaces and access rules, wherein the access rules include security policy rules and routing rules.

3. The cross-region interactive SIP trunk networking connection method as claimed in claim 1, characterized in that: The encryption rules include a first encryption rule and a second encryption rule, the first encryption rule is a TLS encryption rule, and the second encryption rule is an SRTP encryption rule.

4. The cross-region interactive SIP trunk networking connection method as claimed in claim 3, characterized in that: TLS encryption rules, including: TLS encryption is performed on SIP signaling, as follows: Among them, m is SIP signaling, k1 is TLS encryption key, E TLS is the TLS encryption function, E TLS (m,k) is the SIP signaling after m is encrypted, M SIP is a set of SIP signaling messages, K SIP A collection of encryption keys for TLS; SRTP encryption rules include: SRTP encryption is performed on the RTP stream, which is specifically expressed as follows: Among them, s is the RTP stream, k2 is the SRTP encryption key, R v is the encrypted random value, E SRTP is the SRTP encryption function, E SRTP (s,k2,Rv) is the RTP stream encrypted by s, S RTP is the data packet of the RTP stream, K SRTP It is a set of SRTP encryption keys and corresponding encrypted random values.

5. The cross-region interactive SIP trunk networking connection method as claimed in claim 2, characterized in that: Function information also includes permission information, which includes user set U, role set RU, permission type set P, permission resource set S and permission rule set ACL. The permission rule set is specifically expressed as: AR0 is allowed to access all privileged resources, r is the rule function that defines the user's role, and U i is the set of users of the i-th category, RU T,0 For the administrator role, AR x To allow access to x-level permission resources, U j is the j-th user set, p is the rule function that defines the user's permission type, q is the rule function that defines the user's permission resource, Q x It is a collection of x-type permission resources, and FA is unauthorized access.

6. The cross-region interactive SIP trunk networking connection method as claimed in claim 1, characterized in that: The segment traversal rule is to define network segments and perform area allocation and transmission path planning logic based on the analysis of transmitted SIP traffic; Firewall rules are based on the logic of analyzing the transmitted SIP traffic and blocking it.

7. The cross-region interactive SIP trunk networking connection method as claimed in claim 6, characterized in that: Configure firewall rules, including: Define a first parameter set and a first function set, wherein the first parameter set includes a SIP traffic set S, a SIP traffic rule set A SIP , Traffic blocking rule set B, IDS monitoring rule set M SIP And the malicious SIP traffic set N SIP ; The first function set includes the matching function match(f,R) and the detection function detect(f,M SIP ); Initialize the first parameter set, and after initialization, allow SIP traffic rule set A SIP And the blocking traffic rule set B is specifically expressed as: <h2 style=";text-align:left;direction:ltr">A<h2 style=";text-align:left;direction:ltr"> SIP <h2 style=";text-align:left;direction:ltr"> (a1,a2,…,a)<h2 style=";text-align:left;direction:ltr"> n <h2 style=";text-align:left;direction:ltr">} B={b1,b2,…,b m } Among them, a1, a2…a n The 1st, 2nd, ...nth initial SIP traffic rules are allowed, b1, b2, ... n These are the 1st, 2nd,…mth traffic blocking rules respectively; For each SIP flow f in the SIP flow set S, the following analysis is performed: If match(f,A SIP ) is true, allowing SIP traffic f to pass through the firewall; If match(f,B∩S) is true, block SIP traffic f from passing through the firewall; For each SIP flow f passing through the firewall, combined with the IDS monitoring rule set, the following analysis is performed: Calculate detect(f,M SIP ), if the result is not null, the SIP flow f is identified as malicious flow and blocked.

8. The cross-region interactive SIP trunk networking connection method as claimed in claim 6, characterized in that: Configure segment traversal rules, including: A second parameter set and a second function set are defined, wherein the second parameter set includes a network node set N, a VPN tunnel set T, a functional region set TR, a traffic set F, and a security policy set P; the second function set includes a tunnel association function tunnel(n1,n2), a region belonging function region(n), and a traffic routing function route(f); According to the set of functional regions TR, the network node set N is divided, and for each n∈N, the region region(n) to which it belongs is determined; For the target node pair (n1, n2) that communicates across the intranet subnet and the public network subnet, if they are located in different security zones and are in a state of waiting for secure communication, a VPN tunnel t∈T is created, so that tunnel(n1, n2) = t; According to the traffic routing function route(f) and the security policy set P, determine the transmission path of SIP traffic f∈F; If the SIP traffic f∈F does not match the security policy set P, block the SIP traffic f∈F and record it.

9. The cross-region interactive SIP trunk networking connection method as claimed in claim 1, characterized in that: It also includes setting a monitoring module including multiple monitoring devices, specifically including: Define a third parameter set, wherein the third parameter set includes a SIP server and SBC gateway state set S, a time frame set T, and a monitoring device set M; Based on the status of SIP server and SBC gateway, the time frame is matched with the monitoring equipment and early warning information is given; Define a fourth parameter set, wherein the fourth parameter set includes a log record set L and an audit operation set A; Combine the time frame and warning information to generate log items and update the log record set; Based on the analysis of the matching of the audit operations with the log record set, the audit operation set is updated.

10. A cross-region interactive SIP trunk networking connection device, characterized in that: The SIP trunk networking connection method for cross-zone interaction as claimed in any one of claims 1 to 9 specifically includes: A definition unit, used to define an intranet subnet and a public network subnet, wherein the intranet subnet is used for communication of the power system; The setting unit is used to configure function information in the SIP server, wherein the SIP server is set in the intranet subnet; configure the intranet subnet connection information, the public network subnet connection information, the encryption protocol and the traversal rules in the SBC gateway, wherein the SBC gateway is set at the connection between the intranet subnet and the public network subnet, the traversal rules include segment traversal rules and firewall rules, and the encryption protocol includes the transmission encryption protocol from the intranet subnet to the public network subnet and / or the public network subnet to the intranet subnet.

Images