Data security access method and system across multiple security areas

Abstract

The invention discloses a data security access method and system across multiple security zones, and relates to the technical field of power dispatching automation, and the method comprises the steps: carrying out the communication service through at least one group of security access zones; multiplexing the data acquisition service of at least one security level area as a transfer service; and realizing data security access between the at least two security level areas through the security access area communication service and the multiplexed data acquisition service. According to the method provided by the invention, data access of a plurality of security areas can be realized by only deploying one group of security access areas, the system architecture is simplified, the management and maintenance cost is reduced, and the data acquisition service is reused as the transfer service, so that the deployment of additional transfer equipment is avoided, and the data transmission efficiency is improved. The three data transmission modes are respectively adapted to different service scenes and secure access area connection positions, and secure transmission of data among different secure areas is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of electric power dispatching automation, and in particular to a data security access method and system across multiple security zones. Background Art

[0002] With the rapid advancement of new power system construction and the widespread access to a high proportion of new energy, the data processing challenges faced by the master station side of the power dispatching automation system are becoming increasingly severe. In the existing power dispatching automation technology, there are many types of data, and different types of data will be collected and used by different security areas. In order to ensure the security and integrity of the data and prevent the data from being illegally tampered with or stolen during transmission, a security access area is usually set between the external communication equipment and the security area. However, the existing technology has obvious shortcomings. Specifically, in the current technology, a group of security access areas can only access the data collection service data of one security area. This means that if there are data collection services in multiple security areas, Services need to access data through secure access zones, and system administrators have to deploy multiple groups of secure access zones corresponding to each security zone. Although this approach ensures data security to a certain extent, it also brings extremely high system construction costs. In addition, the deployment of multiple groups of secure access zones increases the complexity of the system, making management and maintenance more difficult. More importantly, the one-to-one access method limits the flexibility and mobility of data, resulting in low data processing efficiency, which is difficult to meet the real-time and high efficiency requirements of modern power systems. Therefore, existing technologies urgently need to be improved to achieve secure data access across multiple security zones, reduce system costs, and improve data processing efficiency. Summary of the invention

[0003] In view of the above-mentioned problems, the present invention is proposed.

[0004] Therefore, the technical problem solved by the present invention is: the existing cross-security area data access method is single, low in flexibility, and has high system construction cost; and how to achieve efficient and secure transmission of data in multiple security areas without adding additional security access areas.

[0005] To solve the above technical problems, the present invention provides the following technical solutions: a method for secure data access across multiple security zones, comprising: using at least one group of security access zone communication services; multiplexing the data collection service of at least one security level zone as a transit service; and achieving secure data access between at least two security level zones through the security access zone communication service and the multiplexed data collection service.

[0006] As a preferred solution of the data security access method across multiple security zones described in the present invention, the security access zone communication service includes a group of communication services deployed in the security access zone for communicating with external communication devices when accessing data, and isolating direct communication between external communication devices and security level areas.

[0007] As a preferred solution of the method for secure data access across multiple security zones described in the present invention, wherein: the secure access zone includes a secure access zone connected to a security level area via an isolation device.

[0008] As a preferred solution of the data security access method across multiple security zones described in the present invention, the security level area includes multiple groups of data collection services deployed according to business needs, which are used to parse data or transfer data to the next security level area as a transit service.

[0009] As a preferred solution of the data security access method across multiple security zones described in the present invention, the data acquisition service includes the security access zone converting the received data into a data E format file, the data E format file is transmitted between the security access zone and the security zone, and is parsed and used by the data acquisition service.

[0010] As a preferred solution of the method for secure data access across multiple security zones described in the present invention, the secure data access includes selecting a data transmission method according to the connection location and business scenario of the security access zone.

[0011] As a preferred solution of the method for secure data access across multiple security zones described in the present invention, the secure data access also includes automatically selecting a transit service according to the status of a next-level data acquisition service during the transmission of a data E format file.

[0012] Another object of the present invention is to provide a data security access system across multiple security zones, which can select a data transmission method based on the connection location and business scenario of the security access zone, transmit data E format files between the security access module and the data acquisition module, and automatically select a transit service based on the status of the next-level data acquisition service, thereby solving the problem of low flexibility of current cross-security area data access methods.

[0013] As a preferred solution of the data security access system across multiple security zones described in the present invention, it includes: a security access module, a data acquisition and transfer module, and a data transmission module; the security access module is used to deploy a group of communication services in the security access zone, communicate with external communication equipment, receive data and generate data E format files, and isolate external communication equipment from direct communication with the security level area; the data acquisition and transfer module is used to be deployed in the security level area, responsible for parsing data or serving as a transfer service, receiving data E format files from the security access module, and parsing or transferring to the next level of data acquisition service or security access module, flexibly deploying multiple groups of data acquisition services according to the amount of data, maintaining the consistency of the data format file path, and synchronizing data exchange between the same group of data acquisition services; the data transmission module is used to select a data transmission method according to the connection position and business scenario of the security access zone, transmit the data E format file between the security access module and the data acquisition module, and automatically select the transfer service according to the status of the next level of data acquisition service.

[0014] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement a method for secure data access across multiple security zones.

[0015] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a method for securely accessing data across multiple security zones.

[0016] Beneficial effects of the present invention: The data security access method across multiple security zones provided by the present invention can realize data access in multiple security zones by deploying only one set of security access zones, simplify the system architecture, reduce management and maintenance costs, effectively prevent data from being illegally tampered with or stolen by isolating security zones and unifying data formats, ensure data security, avoid deploying additional transit equipment by reusing data acquisition services as transit services, improve data transmission efficiency, flexibly adjust data flow according to business needs and security policies, and realize secure transmission of data between different security zones. The three data transmission modes are respectively adapted to different business scenarios and secure access zone connection locations, ensuring secure transmission of data between different security zones, and automatically selecting transit services according to the status of the next-level data acquisition service to ensure data transmission efficiency and security. The present invention achieves better results in terms of flexibility, efficiency, and economy. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0018] Figure 1 An overall flow chart of a method for secure data access across multiple security zones provided for the first embodiment of the present invention.

[0019] Figure 2 A schematic diagram of the data transmission process of a first data access mode of a method for secure data access across multiple security zones provided by the second embodiment of the present invention.

[0020] Figure 3 A schematic diagram of the data transmission process of a second data access method of a data security access method across multiple security zones provided by the second embodiment of the present invention.

[0021] Figure 4 A schematic diagram of the data transmission process of a third data access mode of a method for secure data access across multiple security zones provided in the second embodiment of the present invention.

[0022] Figure 5 A schematic diagram of modules of a data security access system across multiple security zones provided for the fourth embodiment of the present invention. DETAILED DESCRIPTION

[0023] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0024] Example 1, reference Figure 1 , is an embodiment of the present invention, and provides a data security access method across multiple security zones, comprising:

[0025] The service is communicated via at least one set of secure access zones.

[0026] The data collection service of at least one security level area is reused as a transit service.

[0027] Through the secure access zone communication service and the multiplexed data collection service, secure data access between at least two security level areas is achieved.

[0028] The security level areas include security zone I, security zone II, and security zone III; the data security access methods include three data transmission methods.

[0029] Furthermore, at least one group of secure access zone communication services is used, and the communication services include but are not limited to network communication modules, data encryption modules, identity authentication modules, access control modules, data compression modules, etc. Different secure access zone communication services are selected for data transmission according to the data type and sensitivity. Different access control policies are set according to user permissions and roles to limit user access to and operations on data. Different data transmission formats and frequencies are customized according to user preferences and needs.

[0030] It should be noted that at least one group of secure access area communication services is used, including but not limited to two groups of secure access area communication services, three groups of secure access area communication services, etc. The data transmitted is data related to power operation, including but not limited to equipment operation data, meteorological data, power grid equipment information, system configuration information, etc., for example:

[0031] The power system accesses the device status data from multiple sensor nodes and performs real-time monitoring and control. Two groups of communication services A and B are deployed in the security access area, which are connected to the security area I and the security area II respectively. Data acquisition service A is deployed to parse the device status data, and data acquisition service B is deployed to transmit the parsed device status data to the power system monitoring center. Communication services A and B receive the device status data from the sensor nodes respectively and convert it into data E format files. Data transmission method one, data E format file is first transmitted to security area I, security area I parses the device status data and transmits the data to security area II, and security area II transmits the device status data to the power system monitoring center. Method two, data E format file is first transmitted to security area II, security area II transmits the device status data to security area I, security area I parses the device status data and transmits the data to the power system monitoring center.

[0032] The power system monitoring center accesses real-time data and historical data from multiple substations, and analyzes and processes them. Three groups of communication services A, B and C are deployed in the security access area, which are connected to security area I, security area II and security area III respectively. Data acquisition service A is deployed to parse real-time data, data acquisition service B is deployed to parse historical data, and data acquisition service A is deployed to transmit the parsed data to the power system monitoring center. Communication services A, B and C receive real-time data and historical data from substations respectively, and convert them into data E format files. Data transmission method one: data E format files are first transmitted to security area I, and security area I parses real-time data , and transmit the data to the safety zone III, the safety zone III transmits the real-time data to the power system monitoring center. Method 2, the data E format file is first transmitted to the safety zone II, the safety zone II parses the historical data, and transmits the data to the safety zone I, the safety zone I transmits the historical data to the power system monitoring center. Method 3, the data E format file is first transmitted to the safety zone II, the safety zone II parses the historical data, and transmits the data to the safety zone I, the safety zone I parses the real-time data, and transmits the real-time data to the safety zone III, the safety zone III transmits the real-time data to the power system monitoring center, the data acquisition service A and C exchange data synchronously to ensure data consistency.

[0033] Example 2, reference Figure 2-Figure 4 , is an embodiment of the present invention, and provides a data security access method across multiple security zones, comprising:

[0034] S1: Communication services via at least one set of secure access zones.

[0035] Furthermore, the secure access zone communication service includes a set of communication services deployed in the secure access zone for communicating with external communication devices when accessing data, isolating direct communication between external communication devices and the security level area, and increasing the ability to prevent data tampering.

[0036] It should be noted that the secure access area includes a secure access area connected to a security level area via an isolation device.

[0037] It should also be noted that the secure access zone deploys a group of communication services (communication service A, communication service B), and the security zone I, security zone II, and security zone III flexibly choose to deploy one or more groups of data collection services (security zone n, the mth group of data collection service A, security zone n, the mth group of data collection service B) according to the scale of business data. The value of n is I, II, III, and the value of m is 1, 2, 3...

[0038] A group of communication services in the security access zone needs to access the data of a total of M groups of data collection services in the security zone I, security zone II, and security zone III and generate data in E format files, where M represents the sum of the data collection services in the security zone I, security zone II, and security zone III.

[0039] S2: Reuse the data collection service of at least one security level area as a transit service.

[0040] Furthermore, the security level area includes deploying multiple sets of data collection services according to business needs, which are used to parse data or serve as a transit service to transfer data to the next security level area.

[0041] It should be noted that the data collection service includes the secure access zone converting the received data into a data E format file, which is transmitted between the secure access zone and the secure zone and parsed and used by the data collection service.

[0042] It should also be noted that a group of communication services (communication service A, communication service B) are deployed in the secure access zone. After the secure access zone communication service A receives data and generates a data format file, it must send it to the transit service A or data collection service A deployed in security zone I or security zone II. After the secure access zone communication service B receives data and generates a data format file, it must send it to the transit service B or data collection service B deployed in security zone I or security zone II. After receiving the data format file, transit service A continues to send it to the next-level transit service A or data collection service A deployed in security zone I or security zone III. After receiving the data format file, transit service B continues to send it to the next-level transit service B or data collection service B deployed in security zone I or security zone III. The secure access zone communication service A and communication service B need to independently generate data E format file paths for the M group of data collection services. In the process of sending files or transmitting files across paths, the paths need to be kept consistent on the transit service or data collection service.

[0043] S3: Through the secure access zone communication service and the multiplexed data collection service, secure data access between at least two security level areas is achieved.

[0044] Furthermore, data security access includes selecting a data transmission method according to the connection position and business scenario of the security access area, wherein in the first data transmission method, the security access area is connected to the security area I through the isolation device, and the security area I is further connected to the security area III. The E-format file transmission between the security area III and the security access area needs to pass through the security area I. The second data transmission method, the security access area is connected to the security area II through the isolation device, and the security area II is further connected to the security area I. The E-format file transmission between the security area I and the security access area needs to pass through the security area II. The third method, the security access area is connected to the security area I through the isolation device. All Zone II are connected, Security Zone II is connected to Security Zone I, and Security Zone I is connected to Security Zone III. The E-format file transmission between Security Zone III and Security Access Zone needs to pass through Security Zone II and Security Zone I, and the E-format file transmission between Security Zone I and Security Access Zone needs to pass through Security Zone II. Restricted by the isolation device, the Security Access Zone cannot be directly connected to the three security zones. At the same time, due to data security requirements, data from three or two security zones need to be accessed through the Security Access Zone. Therefore, according to the business scenario and the location of the security access zone connection, select one of the three data security access methods to access the data.

[0045] It should be noted that data security access also includes the automatic selection of the transit service according to the status of the next-level data collection service during the transmission of data E-format files, and the selection of the intermediate security zone data collection service as the transit service based on the comprehensive status including the server CPU occupancy rate, memory occupancy rate, disk usage rate and the results of the transit file.

[0046] It should also be noted that a group of communication services (communication service A, communication service B) are deployed in the security access zone. After the external communication equipment sends the data to the data collection service A or data collection service B in the security zone I, security zone II or security zone III through the communication service A or communication service B in the security access zone and analyzes it, the data collection service A and the data collection service B need to exchange and synchronize the same group of data. When the data E format file transmission needs to cross multiple security zones and there is more than one group of data collection services in the intermediate security zone, each group of data collection services deployed in the upper-level security zone can automatically judge and select according to the comprehensive status of each group of data collection services in the lower-level security zone. A specific group of data collection services in the next-level security zone is used as a transit service. When the data collection service deployed in the previous-level security zone selects a transit service, data collection service A deployed in the previous-level security zone must select the specific group of data collection service A in the next-level security zone as a transit service, which is called transit service A. Data collection service B deployed in the previous-level security zone must select the specific group of data collection service B in the next-level security zone as a transit service, which is called transit service B. The specific group of data collection service in the next-level security zone is selected as a transit service, which automatically triggers the transit service function, including the downward transit of data E format files and the upward transit of data E format files.

[0047] It should also be noted that achieving data security access between at least two security level areas includes the first data access mode data transmission process, such as Figure 1 As shown, the secure access area is connected to the secure area I via an isolation device, and the secure area I is further connected to the secure area III. The E-format file transmission between the secure area III and the secure access area needs to pass through the secure area I.

[0048] After receiving the uplink data from the external communication device, the secure access zone converts it into a data E format file, and then transmits the data E format file to the secure zone I. The data E format files belonging to the secure zone 1 are parsed by the secure zone I, and the remaining data E format files are then transmitted to the secure zone III by the data E format file transit service of the secure zone I. Finally, the data is parsed and used in the secure zone III.

[0049] The downlink command generated by the security zone III is converted into a data E format file, which is first transmitted to the security zone I, and then transmitted to the security access zone by the data E format file transit service of the security zone I, and then parsed by the security access zone and sent to the external communication device.

[0050] The downlink command generated by the security zone I is converted into a data E format file, which is directly transmitted to the security access zone, parsed by the security access zone and sent to the external communication device.

[0051] The second data access method is the data transmission process, such as Figure 2 As shown, the secure access area is connected to the secure area II via an isolation device, and the secure area II is then connected to the secure area I. The E-format file transmission between the secure area I and the secure access area needs to pass through the secure area II.

[0052] After receiving the uplink data from the external communication device, the secure access zone converts it into a data E format file, and then transmits the data E format file to the secure zone II. The data E format files belonging to the secure zone II are parsed by the secure zone II, and the remaining data E format files are then transmitted to the secure zone I by the data E format file transfer service of the secure zone II. Finally, the data is parsed and used in the secure zone I.

[0053] The downlink command generated by the security zone I is converted into a data E format file, which is first transmitted to the security zone II, and then transmitted to the security access zone by the data E format file transfer service of the security zone II, and then parsed by the security access zone and sent to the external communication device.

[0054] The downlink command generated by the security zone II is converted into a data E format file, which is directly transmitted to the security access zone, parsed by the security access zone and sent to the external communication device.

[0055] The third data access method is the data transmission process, such as Figure 3As shown, the secure access area is connected to the secure area II via an isolation device, the secure area II is connected to the secure area I, and the secure area I is connected to the secure area III. The E-format file transmission between the secure area III and the secure access area needs to pass through the secure area II and the secure area I, and the E-format file transmission between the secure area I and the secure access area needs to pass through the secure area II.

[0056] After receiving the uplink data from the external communication device, the security access zone converts it into a data E format file, and then transmits the data E format file to the security zone II. The data E format files belonging to the security zone II are parsed by the security zone II, and the remaining data E format files are then transmitted to the security zone I by the data E format file transfer service of the security zone II. The data E format files belonging to the security zone I are parsed by the security zone I, and the remaining data E format files are then transmitted to the security zone III by the data E format file transfer service of the security zone I, and finally the data is parsed and used in the security zone III.

[0057] The downlink command generated by the security zone III is converted into a data E format file, which is first transmitted to the security zone I, then transmitted to the security zone II by the data E format file transit service of the security zone I, and finally transmitted to the security access zone by the data E format file transit service of the security zone II, and then parsed by the security access zone and sent to the external communication device.

[0058] The downlink command generated by the security zone I is converted into a data E format file, which is first transmitted to the security zone II, and then transmitted to the security access zone by the data E format file transfer service of the security zone II, and then parsed by the security access zone and sent to the external communication device.

[0059] The downlink command generated by the security zone II is converted into a data E format file, which is directly transmitted to the security access zone, parsed by the security access zone and sent to the external communication device.

[0060] Example 3 is an embodiment of the present invention, which provides a data security access method across multiple security zones. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0061] Firstly, a test system including a security access zone, a security zone I, a security zone II and a security zone III is constructed. A group of communication services (A and B) are deployed in the security access zone. Multiple groups of data acquisition services (A and B) are deployed in the security zones I, II and III according to the scale of business data volume. Different data acquisition services are selected to simulate the collection of real-time data, historical data, equipment status data, etc. in the power system. Different data volumes are set to simulate the data transmission requirements in actual application scenarios. Three different data access methods of the present invention are selected to test their data transmission efficiency and security respectively.

[0062] Next, the communication services A and B in the secure access zone receive data from external communication devices respectively, and convert the data into data E format files. In the first data transmission mode of the present invention, the data E format file is first transmitted to the secure zone I, the secure zone I parses the data belonging to this zone, and transmits the remaining data to the secure zone III, the secure zone III parses and uses the data; the second data transmission mode of the present invention, the data E format file is first transmitted to the secure zone II, the secure zone II parses the data belonging to this zone, and transmits the remaining data to the secure zone I, the secure zone I parses and uses the data; the third data transmission mode of the present invention, the data E format file is first transmitted to the secure zone II, the secure zone II parses the data belonging to this zone, and transmits the remaining data to the secure zone I, the secure zone I parses the data belonging to this zone, and transmits the remaining data to the secure zone III, the secure zone III parses and uses the data, and the data acquisition services in the same group are synchronized for data exchange to ensure data consistency, and the parameters such as data transmission time, CPU occupancy, memory occupancy, disk occupancy, etc. under different access modes are recorded to simulate attack scenarios and verify the security of the data transmission process.

[0063] Refer to Table 1 for a comparative analysis of the experimental data.

[0064] Table 1 Experimental data comparison table

[0065]

[0066] By comparing the data in the table, it can be seen that compared with the prior art, the three data access methods proposed in the present invention can significantly improve data transmission efficiency, shorten the transmission time by about 30%-40%, and the system resource occupancy rate proposed in the present invention is lower, and the CPU, memory and disk occupancy rates are all reduced. The system security proposed in the present invention is equivalent to the prior art and can effectively prevent data from being illegally tampered with or stolen. The system proposed in the present invention only needs one set of secure access areas to achieve data access in multiple security areas, significantly reducing the system construction cost.

[0067] To sum up, the data security access method and system across multiple security zones proposed in the present invention can effectively solve the problems of singleness, low flexibility, high system construction cost, etc. in the prior art, and has the advantages of high data transmission efficiency, low system resource occupancy, and strong security. It can meet the needs of modern power systems for data security access. Therefore, our invention is creative.

[0068] Example 4, reference Figure 5 , which is an embodiment of the present invention, provides a data security access system across multiple security zones, including a security access module, a data collection and transfer module, and a data transmission module.

[0069] The security access module is used to deploy a group of communication services in the security access area, communicate with external communication equipment, receive data and generate data E format files, and isolate external communication equipment from direct communication with the security level area; the data acquisition and transfer module is used to be deployed in the security level area, responsible for parsing data or serving as a transfer service, receiving data E format files from the security access module, and parsing or transferring them to the next level of data acquisition service or security access module, flexibly deploying multiple groups of data acquisition services according to the amount of data, maintaining the consistency of the data format file path, and synchronizing data exchange between the same group of data acquisition services; the data transmission module is used to select a data transmission method according to the connection location and business scenario of the security access area, transmit the data E format file between the security access module and the data acquisition module, and automatically select the transfer service according to the status of the next level of data acquisition service.

[0070] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0071] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0072] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0073] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc. It should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not limited. Although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

[0074] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A data security access method across multiple security zones, characterized in that: include: Communication services via at least one set of secure access zones; Reuse the data collection service of at least one security level area as a transit service; Through the secure access zone communication service and the multiplexed data collection service, secure data access between at least two security level areas is achieved.

2. The data security access method across multiple security zones as claimed in claim 1, characterized in that: The secure access zone communication service includes a group of communication services deployed in the secure access zone, which are used to communicate with external communication devices when accessing data and isolate direct communication between external communication devices and the security level area.

3. The data security access method across multiple security zones as claimed in claim 2, characterized in that: The security access area includes a security access area connected to a security level area via an isolation device.

4. The method for secure data access across multiple security zones as claimed in claim 3, characterized in that: The security level area includes multiple groups of data collection services deployed according to business needs, which are used to parse data or serve as a transit service to transfer data to the next security level area.

5. The data security access method across multiple security zones as claimed in claim 4, characterized in that: The data collection service includes the secure access zone converting the received data into a data E format file, the data E format file is transmitted between the secure access zone and the secure zone, and is parsed and used by the data collection service.

6. The data security access method across multiple security zones as claimed in claim 5, characterized in that: The data security access includes selecting a data transmission mode according to the connection location and service scenario of the security access zone.

7. The data security access method across multiple security zones as claimed in claim 6, characterized in that: The data security access also includes automatically selecting a transfer service according to the status of the next level data collection service during the data E format file transmission process.

8. A system using the data security access method across multiple security zones as claimed in any one of claims 1 to 7, characterized in that: Including security access module, data collection and transfer module, data transmission module; The security access module is used to deploy a group of communication services in the security access area, communicate with external communication devices, receive data and generate data E format files, and isolate external communication devices from direct communication with the security level area; The data acquisition and transfer module is used to be deployed in the security level area, responsible for parsing data or serving as a transfer service, receiving data E format files from the security access module, and parsing or transferring to the next level of data acquisition service or security access module, flexibly deploying multiple groups of data acquisition services according to the amount of data, maintaining the consistency of the data format file path, and performing data exchange synchronization between the same group of data acquisition services; The data transmission module is used to select a data transmission method according to the connection location and business scenario of the security access zone, transmit the data E format file between the security access module and the data acquisition module, and automatically select the transit service according to the status of the next-level data acquisition service.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method for secure data access across multiple security zones described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method for secure data access across multiple security zones described in any one of claims 1 to 7 are implemented.

Images