Wideband and narrowband fused wireless data security access gateway and implementation method

Abstract

The invention relates to a wireless data security access gateway with integrated broadband and narrowband, which comprises a broadband wireless communication module and a narrowband wireless communication module which are respectively and electrically connected with a main processor and are used for receiving data transmitted by a terminal; the main processor comprises a data processing unit which is used for capturing terminal data transmitted from the broadband wireless communication module and the narrowband wireless communication module, performing priority classification, analysis classification, protocol conversion and storage control on the data, and forwarding the data to the safety protection unit; the security protection unit is used for carrying out identity authentication, encryption and decryption control and integrity verification on the data; the intelligent routing unit is used for receiving the data transmitted from the safety protection unit and selecting an optimal transmission path for data transmission; the memory is used for storing a priority setting table, a protocol configuration file, an operation log and a transmission log; and the national secret chip is used for encrypting and decrypting the data when receiving the encryption and decryption control signal sent by the security protection unit.

Description

Technical Field

[0001] The present invention relates to the technical field of wireless communications, and in particular to a broadband and narrowband integrated wireless data security access gateway and an implementation method thereof. Background Art

[0002] With the rapid development of the Internet of Things and mobile Internet, wireless communication technology is increasingly being used in all walks of life. However, different application scenarios have different requirements for wireless communication. Some applications require high-bandwidth, low-latency communication, such as video surveillance and real-time control; while other applications require low-power, long-distance communication, such as smart meter reading and environmental monitoring. In the prior art, although each single wireless communication protocol has its own advantages, it also has its own limitations; such as broadband wireless communication protocols Wi-Fi, 4G / 5G, although the transmission rate is fast, the power consumption is high and the coverage is limited; and narrowband wireless communication protocols LoRa, BLE, although the power consumption is low and the coverage is wide, the transmission rate is slow. Therefore, a single wireless communication protocol is difficult to meet the needs of different application scenarios for wireless communication; in addition, with the widespread application of wireless communication networks, data security issues are becoming increasingly prominent. The existing wireless access gateway lacks an effective security mechanism during data transmission and is vulnerable to attacks such as man-in-the-middle attacks and replay attacks. Therefore, it is urgent to develop a wireless data security access gateway and its implementation method that can simultaneously support broadband wireless communication protocols and narrowband wireless communication protocols and can ensure secure and reliable data transmission. Summary of the invention

[0003] In view of this, it is necessary to provide a wireless data security access gateway and implementation method that can integrate broadband wireless communication protocols and narrowband wireless communication protocols and realize secure and reliable data transmission.

[0004] According to one aspect of the present invention, there is provided a broadband and narrowband integrated wireless data security access gateway, comprising: a broadband wireless communication module, a narrowband wireless communication module, a main processor, a memory and a national encryption chip;

[0005] The broadband wireless communication module and the narrowband wireless communication module are respectively electrically connected to the main processor, and are used to receive data from the terminal, and send a data interface interrupt signal to the main processor when there is data to be sent;

[0006] Main processor, including: data processing unit, security protection unit and intelligent routing unit;

[0007] A data processing unit is electrically connected to the broadband wireless communication module, the narrowband wireless communication module and the memory, and is used to capture the terminal data transmitted from the broadband wireless communication module and the narrowband wireless communication module when a data interface interrupt signal is captured, and to perform priority classification, analysis classification, protocol conversion, storage control, and forwarding the data to the security protection unit;

[0008] The security protection unit is connected to the data processing unit and is used to receive data transmitted from the data processing unit and perform identity authentication, encryption and decryption control, and integrity verification on the data;

[0009] The intelligent routing unit is connected to the security protection unit, and is used to receive data transmitted from the security protection unit and select an optimal transmission path for data transmission;

[0010] A memory, which is in communication with the data processing unit and the intelligent routing unit, and is used to store a priority setting table, a protocol configuration file, an operation log, and a transmission log;

[0011] The national encryption chip is connected to the security protection unit for encrypting and decrypting data upon receiving the encryption and decryption control signal sent by the security protection unit.

[0012] Preferably, the broadband wireless communication module includes: a 4G / 5G wireless module, connected to the main processor through a USB interface; a WiFi wireless module, connected to the main processor through a PCIE interface; a narrowband wireless communication module includes: a BLE wireless module, connected to the main processor through a UART interface; and a LoRa wireless module, connected to the main processor through an SPI interface.

[0013] Preferably, the data processing unit performs priority classification, CRC check, analysis classification and protocol conversion on the data, specifically:

[0014] When the data processing unit captures the data interface interrupt signal transmitted from the broadband wireless communication module or the narrowband wireless communication module, it performs priority determination according to the interface type through which the data enters and the priority setting table pre-stored in the memory;

[0015] The data processing unit performs CRC check and parsing classification on the data in the classified priority order, and determines the sender and receiver by analyzing the packet header information;

[0016] The data processing unit retrieves the protocol configuration file in the memory for comparison based on the sender and receiver to determine whether protocol conversion is required. When the protocols used by the sender and receiver are consistent, the data is directly forwarded to the security protection unit; when the protocols used by the sender and receiver are inconsistent, the data processing unit performs protocol conversion on the data and then forwards it to the security protection unit; the data processing unit records all operations in the operation log of the memory.

[0017] Preferably, the security protection unit is connected to the data processing unit, and is used to receive data transmitted from the data processing unit, and perform identity authentication, encryption and decryption control, access control and integrity verification on the data, specifically:

[0018] When the security protection unit receives data, it authenticates the data and discards or disconnects the data that fails the authentication. For data that passes the authentication, the security protection unit sends a signal to the national encryption chip to notify the national encryption chip to encrypt the data.

[0019] The security protection unit will perform integrity check on the encrypted files, and send them to the intelligent routing unit for transmission after the check is passed; and all operations will be recorded in the operation log of the storage.

[0020] Preferably, the main processor further includes: an energy consumption management unit connected to the memory, the broadband wireless communication module and the narrowband wireless communication module, and used to retrieve the operation log and the transmission log from the memory, perform periodic tests on the connection requests of the broadband wireless communication module and the narrowband wireless communication module, and perform statistics on the data flow size, and adjust the transmission power of the broadband wireless communication module and the narrowband wireless communication module according to the statistical results;

[0021] The management interface is used to provide a user interface and an API interface, on which the gateway is configured and managed.

[0022] Preferably, it also includes: a power supply, which is electrically connected to the main processor and the memory respectively, and is used to provide the power required by the main processor and the memory.

[0023] According to another aspect of the present invention, a method for implementing a broadband and narrowband integrated wireless data secure access gateway is provided, comprising the following steps:

[0024] S0, initialize the gateway;

[0025] S1. Data reception:

[0026] The broadband wireless communication module and the narrowband wireless communication module receive data transmitted from the terminal, and send a data interface interrupt signal to the data processing unit when there is data to be sent;

[0027] S2. Data processing:

[0028] When the data processing unit captures the data interface interrupt signal transmitted from the broadband wireless communication module or the narrowband wireless communication module, it performs priority determination according to the interface type through which the data enters and the priority setting table pre-stored in the memory;

[0029] The data processing unit performs CRC check and parsing classification on the data in the classified priority order, and determines the sender and receiver by analyzing the packet header information;

[0030] The data processing unit retrieves the protocol configuration file in the memory for comparison according to the sender and the receiver to determine whether protocol conversion is required. When the protocols used by the sender and the receiver are consistent, the data is directly forwarded to the security protection unit; when the protocols used by the sender and the receiver are inconsistent, the data processing unit performs protocol conversion on the data and then forwards it to the security protection unit;

[0031] S3. Security Verification:

[0032] When the security protection unit receives data, it authenticates the data and discards or disconnects the data that fails the authentication. For data that passes the authentication, the security protection unit sends a signal to the national encryption chip to notify the national encryption chip to encrypt the data. The security protection unit performs integrity check on the encrypted data.

[0033] The security protection unit sends the encrypted file to the intelligent routing unit for transmission; and records all operations in the operation log of the storage;

[0034] S4, Intelligent Routing:

[0035] The intelligent routing unit selects the optimal transmission path for the data transmitted from the security protection unit;

[0036] S5. Data forwarding:

[0037] The intelligent routing unit forwards the data according to the optimal transmission path and records the status feedback in the operation log and transmission log.

[0038] Preferably, in step S3, when the security protection unit receives data, the process of authenticating the data is a process of negotiating a session key between the terminal device and the gateway. If the key negotiation is successful, it means that the identity authentication has passed, otherwise it means that the identity authentication has not passed.

[0039] Preferably, in step S4, the intelligent routing unit selects the optimal transmission path for the data transmitted from the security protection unit, as follows:

[0040] The intelligent routing unit selects the optimal transmission path based on data type and priority;

[0041] The intelligent routing unit uses machine learning algorithms to optimize routing strategies.

[0042] Preferably, it also includes:

[0043] S6. Energy consumption management:

[0044] The energy consumption management unit retrieves the operation log and the transmission log from the memory, performs periodic tests on the connection requests of the broadband wireless communication module and the narrowband wireless communication module, and performs statistics on the data flow, and adjusts the transmission power of the broadband wireless communication module and the narrowband wireless communication module according to the statistical results;

[0045] S7. Management and maintenance:

[0046] Through the user interface provided by the management interface, the status of the gateway can be monitored and the parameters of the gateway can be configured and managed.

[0047] Compared with the existing technology, the above-mentioned broadband and narrowband integrated wireless data security access gateway and implementation method, on the one hand, integrates broadband wireless communication modules and narrowband wireless communication modules, which can not only meet the high-speed transmission of high-bandwidth and large-traffic services, but also achieve low-power consumption and long-distance transmission; on the other hand, by setting up a multi-level security protection mechanism of identity authentication, national secret algorithm encryption, and complete small verification, it can effectively resist attacks such as replay attacks, thereby ensuring the security and reliability of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 The figure is a schematic diagram of the overall structure of the broadband and narrowband integrated wireless data security access gateway in the present invention.

[0049] Figure 2 It is a top view of the present invention.

[0050] Figure 3 It is a schematic diagram of the second three-dimensional structure of the present invention.

[0051] In the figure: broadband wireless communication module 1; 4G / 5G wireless module 10; WiFi wireless module 11; narrowband wireless communication module 2; BLE wireless module 20; LoRa wireless module 21; main processor 3; data processing unit 30; security protection unit 31; intelligent routing unit 32; energy consumption management unit 33; management interface 34; memory 4; national encryption chip 5; power supply 6. DETAILED DESCRIPTION

[0052] The technical solutions and technical effects of the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings of the present invention.

[0053] Please see Figure 1As shown, a broadband and narrowband integrated wireless data security access gateway includes: a broadband wireless communication module 1, a narrowband wireless communication module 2, a main processor 3, a memory 4 and a national encryption chip 5;

[0054] The broadband wireless communication module 1 and the narrowband wireless communication module 2 are respectively electrically connected to the main processor 3 to receive data from the terminal and send a data interface interrupt signal to the main processor 3 when there is data to be sent.

[0055] The main processor 3 includes: a data processing unit 30, a security protection unit 31 and an intelligent routing unit 32;

[0056] The data processing unit 30 is electrically connected to the broadband wireless communication module 1, the narrowband wireless communication module 2 and the memory 4, and is used to capture the terminal data transmitted from the broadband wireless communication module 1 and the narrowband wireless communication module 2 when the data interface interrupt signal is captured, and to perform priority classification, analysis classification, protocol conversion, storage control, and forwarding the data to the security protection unit 31;

[0057] The security protection unit 31 is connected to the data processing unit 30 and is used to receive data transmitted from the data processing unit 30 and perform identity authentication, encryption and decryption control, and integrity verification on the data;

[0058] The intelligent routing unit 32 is connected to the security protection unit 31 and is used to receive data transmitted from the security protection unit 31 and select an optimal transmission path for data transmission;

[0059] The memory 4 is connected to the data processing unit 30 and the intelligent routing unit 32 for storing the priority setting table, the protocol configuration file, the operation log and the transmission log;

[0060] The national encryption chip 5 is connected to the security protection unit 31 for communication, and is used to encrypt and decrypt data when receiving the encryption and decryption control signal sent by the security protection unit 31.

[0061] In this embodiment, the priority setting table stores data types and corresponding priority levels, and the priority level of wideband data is higher, while the priority level of narrowband data is lower; therefore, the data processing unit 30 determines the priority level corresponding to the data according to the received data type and the priority setting table, and then analyzes and classifies the data, performs protocol conversion, and performs storage control according to the priority level from high to low, and forwards the data to the security protection unit 31 to ensure that the critical data line can be processed;

[0062] In this embodiment, the protocol configuration file stores a configuration interface protocol, which is used to assist the data processing unit 30 in determining whether the protocols of the data sender and the receiver are consistent and to perform protocol conversion; for example, conversion between TCP and MQTT, conversion between UPD and MQTT, and conversion between HTTP and MQTT;

[0063] In this implementation, the operation log and the transmission log are used to record all operations of all components of the gateway and the actions of transmission overcharge.

[0064] For further information, see Figure 1 The broadband wireless communication module 1 includes: a 4G / 5G wireless module 10, connected to the main processor 3 through a USB interface; a WiFi wireless module 11, connected to the main processor 3 through a PCIE interface; a narrowband wireless communication module 2 includes: a BLE wireless module 20, connected to the main processor 3 through a UART interface; and a LoRa wireless module 21, connected to the main processor 3 through an SPI interface.

[0065] In this embodiment, since the 4G / 5G wireless module 10, the WiFi wireless module 11, the BLE wireless module 20 and the LoRa wireless module 21 are all connected to the main processor 3 through different interfaces, the main processor 3 can determine the type of data according to the interface source of the data.

[0066] Furthermore, the data processing unit 30 performs priority classification, CRC check, analysis classification and protocol conversion on the data, specifically:

[0067] When the data processing unit 30 captures the data interface interrupt signal transmitted from the broadband wireless communication module 1 or the narrowband wireless communication module 2, it performs priority determination according to the interface type through which the data enters and the priority setting table pre-stored in the memory 4;

[0068] The data processing unit 30 performs CRC check and parsing classification on the data in order of priority, and determines the sender and receiver by analyzing the packet header information;

[0069] The data processing unit 30 retrieves the protocol configuration file in the memory 4 for comparison based on the sender and the receiver to determine whether protocol conversion is required. When the protocols used by the sender and the receiver are consistent, the data is directly forwarded to the security protection unit 31; when the protocols used by the sender and the receiver are inconsistent, the data processing unit 30 performs protocol conversion on the data and then forwards it to the security protection unit 31; the data processing unit 30 records all operations in the operation log of the memory 4.

[0070] In this implementation, the CRC check is to ensure the integrity and correctness of the data; the parsing process includes removing the frame header, extracting the effective load, etc.

[0071] Furthermore, the security protection unit 31 is connected to the data processing unit 30, and is used to receive data transmitted from the data processing unit 30, and perform identity authentication, encryption and decryption control, and integrity verification on the data, specifically:

[0072] When the security protection unit 31 receives the data, it authenticates the data and discards or disconnects the data that fails the authentication. For the data that passes the authentication, the security protection unit 31 sends a signal to the national encryption chip 5 to notify the national encryption chip 5 to encrypt the data.

[0073] The security protection unit 31 performs integrity check on the encrypted data, and sends the data to the intelligent routing unit 32 for transmission after passing the check; and records all operations in the operation log of the memory 4.

[0074] In this embodiment, the security protection unit 31 performs identity authentication on the data to ensure the legitimacy of the data source. The identity authentication can be based on various methods such as certificates, usernames and passwords. If the authentication fails, the data will be discarded, or the connection between the terminal sending the data and the gateway will be disconnected. The security protection unit 31 performs integrity verification on the encrypted data to prevent replay attacks. The integrity verification is usually implemented using a message authentication code MAC or a digital signature.

[0075] Furthermore, the main processor 3 also includes: an energy consumption management unit 33, connected to the memory 4, the broadband wireless communication module 1 and the narrowband wireless communication module 2, for retrieving operation logs and transmission logs from the memory 4, performing periodic tests on the connection requests of the broadband wireless communication module 1 and the narrowband wireless communication module 2, and performing statistics on the size of data traffic, and adjusting the transmission power of the broadband wireless communication module 1 and the narrowband wireless communication module 2 according to the statistical results;

[0076] The management interface 34 is used to provide a user interface and an API interface, and configure and manage the gateway on the user interface and the API interface.

[0077] For further information, see Figure 1 , and also includes: a power supply 6, which is electrically connected to the main processor 3 and the memory 4 respectively, and is used to provide the power required by the main processor 3 and the memory 4.

[0078] Please see Figure 2 As shown, a method for implementing a broadband and narrowband integrated wireless data security access gateway, using the broadband and narrowband integrated wireless data security access gateway, includes the following steps:

[0079] S0, initialize the gateway;

[0080] S1. Data reception:

[0081] The broadband wireless communication module 1 and the narrowband wireless communication module 2 receive data transmitted from the terminal, and send a data interface interrupt signal to the data processing unit 30 when there is data to be sent;

[0082] S2. Data processing:

[0083] When the data processing unit 30 captures the data interface interrupt signal transmitted from the broadband wireless communication module 1 or the narrowband wireless communication module 2, it performs priority determination according to the interface type through which the data enters and the priority setting table pre-stored in the memory 4;

[0084] The data processing unit 30 performs CRC check and parsing classification on the data in order of priority, and determines the sender and receiver by analyzing the packet header information;

[0085] The data processing unit 30 retrieves the protocol configuration file in the memory 4 for comparison according to the sender and the receiver, and determines whether protocol conversion is required. When the protocols adopted by the sender and the receiver are consistent, the data is directly forwarded to the security protection unit 31; when the protocols adopted by the sender and the receiver are inconsistent, the data processing unit 30 performs protocol conversion on the data and then forwards it to the security protection unit 31;

[0086] S3. Security Verification:

[0087] When the security protection unit 31 receives data, it authenticates the data, and discards or disconnects the data that fails the authentication; for the data that passes the authentication, the security protection unit 31 sends a signal to the national secret chip 5 to notify the national secret chip 5 to encrypt the data; the security protection unit 31 performs integrity check on the encrypted data;

[0088] The security protection unit 31 sends the encrypted file to the intelligent routing unit 32 for transmission; and records all operations in the operation log of the memory 4;

[0089] S4, Intelligent Routing:

[0090] The intelligent routing unit 32 selects the best transmission path for the data transmitted from the security protection unit 31;

[0091] S5. Data forwarding:

[0092] The intelligent routing unit 32 forwards the data according to the optimal transmission path and records the status feedback in the operation log and the transmission log.

[0093] In this embodiment, the gateway initialization stage includes gateway self-check, configuration of the broadband wireless communication module 1 and the narrowband wireless communication module 2, etc.

[0094] Further, in step S3, when the security protection unit 31 receives the data, the process of authenticating the data is the process of negotiating the session key between the terminal and the gateway. If the key negotiation is successful, it means that the identity authentication has been passed, otherwise it means that the identity authentication has not been passed. The key negotiation is initiated by the terminal, and the negotiation process is as follows: Figure 3 As shown in the figure, the key is randomly set by the negotiation initiator, that is, the terminal. The process is briefly described as follows:

[0095] a. The terminal generates a random number r1, i.e. the key, and A=E Cert2 (r1)||E Skey1 (H(r1)), send A to the gateway;

[0096] b. The gateway decrypts A and verifies the signature of terminal 1, generates a random number r2, and calculates: B = E Cert1 (r2)||E Skey2 (H(r2)), send B to device 1; synthesize session key:

[0097] c. The terminal decrypts B and verifies the gateway's signature to synthesize the session key: Send C to the gateway; the gateway does And compare whether C and D are the same. If they are the same, then both parties have verified each other's identity and hold the session key: If they are different, the gateway will issue a negotiation failure alarm message to notify the terminal, and the terminal will re-initiate negotiation.

[0098] In this implementation, the adoption of session key negotiation between the terminal and the gateway can resist replay attacks and improve the security of data transmission.

[0099] Furthermore, in step S4, the intelligent routing unit 32 selects the optimal transmission path for the data transmitted from the security protection unit 31, as follows:

[0100] The intelligent routing unit 32 selects the best transmission path according to the data type and priority;

[0101] The intelligent routing unit 32 optimizes the routing strategy using a machine learning algorithm.

[0102] In this embodiment, the machine learning routing algorithm of the intelligent routing unit 32 is Q-Learning, which selects the optimal path by learning an action value function, Q function; by continuously iterating and updating the Q function, the algorithm can find the optimal path from the starting node to the target node. The specific implementation steps are as follows:

[0103] a. Initialization:

[0104] Initialize the Q function, usually represented by a two-dimensional array Q(s,a), where s is the state and a is the action.

[0105] Set the learning rate α, discount factor γ, and exploration rate ∈.

[0106] b. Select an action:

[0107] Use ∈-strategy to select actions. In most cases, the action with the highest Q value in the current state is selected, and actions are randomly selected with a certain probability ∈.

[0108] c. Execution action:

[0109] Execute the selected action and observe the new state s ′ and the immediate reward factor r.

[0110] d. Update Q function:

[0111] Update the Q value using the Bellman equation:

[0112] Q(s,a)←Q(s,a)+α(r+γmax Q(s ′ ,a ′ )-Q(s,a))

[0113] Repeat the above steps until the target node is reached or the termination condition is met. After multiple iterations, the Q table will gradually converge, and the action in each state will have a corresponding Q value. According to the Q function, the optimal path from the starting node to the target node is determined by selecting the action with the highest Q value in each state.

[0114] Furthermore, it also includes:

[0115] S6. Energy consumption management:

[0116] The energy consumption management unit 33 retrieves the operation log and the transmission log from the memory 4, performs periodic tests on the connection requests of the broadband wireless communication module 1 and the narrowband wireless communication module 2, and performs statistics on the data flow, and adjusts the transmission power of the broadband wireless communication module 1 and the narrowband wireless communication module 2 according to the statistical results;

[0117] S7. Management and maintenance:

[0118] The status of the gateway is monitored and the parameters of the gateway are configured and managed through the user interface provided by the management interface 34.

[0119] In this embodiment, the transmit power of the broadband wireless communication module 1 and the narrowband wireless communication module 2 is calculated as follows: Where k1 and k2 are weight coefficients used to balance the impact of traffic and number of connections on transmit power. N is the current number of connections, N maxis the maximum number of connections, T max is the maximum flow, T is the current flow, P min is the minimum transmit power;

[0120]

[0121] The specific process of energy consumption management unit 33 managing energy consumption is as follows:

[0122] By retrieving operation logs, transmission logs, and continuously monitoring the network status of the gateway, including CPU utilization, memory usage, and network traffic, the data can be analyzed to determine whether the current power consumption mode is appropriate;

[0123] Automatically adjust the power consumption mode according to the working state of the gateway and the network status. For example, when the gateway is idle, reduce the CPU frequency and network bandwidth of the gateway to save energy, and increase the CPU frequency and network bandwidth to ensure performance under high load conditions.

[0124] Compared with the prior art, the above-mentioned broadband and narrowband integrated wireless data security access gateway and implementation method, on the one hand, integrates a broadband wireless communication module 1 and a narrowband wireless communication module 2, which can not only meet the high-speed transmission of high-bandwidth and large-traffic services, but also achieve low-power consumption and long-distance transmission; on the other hand, by setting up a multi-level security protection mechanism of identity authentication, national secret algorithm encryption, and complete small verification, it can effectively resist attacks such as replay attacks, thereby ensuring the security and reliability of data transmission.

[0125] What is disclosed above is only a preferred embodiment of the present invention, which certainly cannot be used to limit the scope of rights of the present invention. A person skilled in the art can understand that all or part of the processes of the above embodiments and equivalent changes made according to the claims of the present invention still fall within the scope of the invention.

Claims

1. A broadband and narrowband integrated wireless data security access gateway, characterized in that: include: Broadband wireless communication module, narrowband wireless communication module, main processor, memory and national secret chip; The broadband wireless communication module and the narrowband wireless communication module are respectively electrically connected to the main processor, and are used to receive data from the terminal, and send a data interface interrupt signal to the main processor when there is data to be sent; Main processor, including: data processing unit, security protection unit and intelligent routing unit; A data processing unit is electrically connected to the broadband wireless communication module, the narrowband wireless communication module and the memory, and is used to capture the terminal data transmitted from the broadband wireless communication module and the narrowband wireless communication module when a data interface interrupt signal is captured, and to perform priority classification, analysis classification, protocol conversion, storage control, and forwarding the data to the security protection unit; The security protection unit is connected to the data processing unit and is used to receive data transmitted from the data processing unit and perform identity authentication, encryption and decryption control, and integrity verification on the data; The intelligent routing unit is connected to the security protection unit, and is used to receive data transmitted from the security protection unit and select an optimal transmission path for data transmission; A memory, which is in communication with the data processing unit and the intelligent routing unit, and is used to store a priority setting table, a protocol configuration file, an operation log, and a transmission log; The national encryption chip is connected to the security protection unit for encrypting and decrypting data upon receiving the encryption and decryption control signal sent by the security protection unit.

2. The broadband and narrowband integrated wireless data secure access gateway as claimed in claim 1, characterized in that: Broadband wireless communication module, including: 4G / 5G wireless module, connected to the main processor through the USB interface; WiFi wireless module, connected to the main processor through the PCIE interface; narrowband wireless communication module, including: BLE wireless module, connected to the main processor through the UART interface; LoRa wireless module, connected to the main processor through the SPI interface.

3. The broadband and narrowband integrated wireless data secure access gateway as claimed in claim 2, characterized in that: The data processing unit performs priority classification, CRC verification, analysis classification and protocol conversion on the data, specifically: When the data processing unit captures the data interface interrupt signal transmitted from the broadband wireless communication module or the narrowband wireless communication module, it performs priority determination according to the interface type through which the data enters and the priority setting table pre-stored in the memory; The data processing unit performs CRC check and parsing classification on the data in the classified priority order, and determines the sender and receiver by analyzing the packet header information; The data processing unit retrieves the protocol configuration file in the memory for comparison based on the sender and receiver to determine whether protocol conversion is required. When the protocols used by the sender and receiver are consistent, the data is directly forwarded to the security protection unit; when the protocols used by the sender and receiver are inconsistent, the data processing unit performs protocol conversion on the data and then forwards it to the security protection unit; the data processing unit records all operations in the operation log of the memory.

4. The broadband and narrowband integrated wireless data secure access gateway as claimed in claim 1, characterized in that: The security protection unit is connected to the data processing unit, and is used to receive data transmitted from the data processing unit, and perform identity authentication, encryption and decryption control, and integrity verification on the data, specifically: When the security protection unit receives data, it authenticates the data and discards or disconnects the data that fails the authentication. For data that passes the authentication, the security protection unit sends a signal to the national encryption chip to notify the national encryption chip to encrypt the data. The security protection unit will perform integrity check on the encrypted files, and after passing the check, send them to the intelligent routing unit for transmission; And all operations are recorded in the operation log of the storage.

5. The broadband and narrowband integrated wireless data secure access gateway according to claim 1, characterized in that: The main processor also includes: an energy consumption management unit connected to the memory, the broadband wireless communication module and the narrowband wireless communication module, and used to retrieve the operation log and the transmission log from the memory, perform periodic tests on the connection requests of the broadband wireless communication module and the narrowband wireless communication module, and perform statistics on the size of the data flow, and adjust the transmission power of the broadband wireless communication module and the narrowband wireless communication module according to the statistical results; The management interface is used to provide a user interface and an API interface, on which the gateway is configured and managed.

6. The broadband and narrowband integrated wireless data secure access gateway according to claim 1, characterized in that: Also includes: The power supply is electrically connected to the main processor and the memory respectively, and is used to provide the power required by the main processor and the memory.

7. A method for implementing a broadband and narrowband integrated wireless data security access gateway, using the broadband and narrowband integrated wireless data security access gateway as described in any one of claims 1 to 6, characterized in that: The following steps are involved: S0, initialize the gateway; S1. Data reception: The broadband wireless communication module and the narrowband wireless communication module receive data transmitted from the terminal, and send a data interface interrupt signal to the data processing unit when there is data to be sent; S2. Data processing: When the data processing unit captures the data interface interrupt signal transmitted from the broadband wireless communication module or the narrowband wireless communication module, it performs priority determination according to the interface type through which the data enters and the priority setting table pre-stored in the memory; The data processing unit performs CRC check and parsing classification on the data in the classified priority order, and determines the sender and receiver by analyzing the packet header information; The data processing unit retrieves the protocol configuration file in the memory for comparison according to the sender and the receiver to determine whether protocol conversion is required. When the protocols used by the sender and the receiver are consistent, the data is directly forwarded to the security protection unit; when the protocols used by the sender and the receiver are inconsistent, the data processing unit performs protocol conversion on the data and then forwards it to the security protection unit; S3. Security Verification: When the security protection unit receives data, it authenticates the data and discards or disconnects the data that fails the authentication. For data that passes the authentication, the security protection unit sends a signal to the national encryption chip to notify the national encryption chip to encrypt the data. The security protection unit performs integrity check on the encrypted data. The security protection unit sends the encrypted file to the intelligent routing unit for transmission; and records all operations in the operation log of the storage; S4, Intelligent Routing: The intelligent routing unit selects the best transmission path for the data transmitted from the security protection unit; S5. Data forwarding: The intelligent routing unit forwards the data according to the optimal transmission path and records the status feedback in the operation log and transmission log.

8. The method for implementing the broadband and narrowband integrated wireless data secure access gateway as claimed in claim 7, characterized in that: In step S3, when the security protection unit receives the data, the process of authenticating the data is a process of negotiating a session key between the terminal device and the gateway. If the key negotiation is successful, it means that the identity authentication has passed, otherwise it means that the identity authentication has not passed.

9. The method for implementing the broadband and narrowband integrated wireless data secure access gateway as claimed in claim 7, characterized in that: In step S4, the intelligent routing unit selects the optimal transmission path for the data transmitted from the security protection unit, as follows: The intelligent routing unit selects the optimal transmission path based on data type and priority; The intelligent routing unit uses machine learning algorithms to optimize routing strategies.

10. The method for implementing a broadband and narrowband integrated wireless data secure access gateway as claimed in claim 7, characterized in that: Also includes: S6. Energy consumption management: The energy consumption management unit retrieves the operation log and the transmission log from the memory, performs periodic tests on the connection requests of the broadband wireless communication module and the narrowband wireless communication module, and performs statistics on the data flow, and adjusts the transmission power of the broadband wireless communication module and the narrowband wireless communication module according to the statistical results; S7. Management and maintenance: Through the user interface provided by the management interface, the status of the gateway can be monitored and the parameters of the gateway can be configured and managed.

Images