Data distribution method and device, communication equipment and storage medium

Abstract

The invention relates to a data distribution method and device, communication equipment and a storage medium. The method comprises the following steps: acquiring a target instruction, and identifying a service quality level corresponding to the target instruction; if the service quality level of the target instruction is a target service quality level, encrypting the target instruction according to a security module to obtain encrypted message data; and generating a target message under the target protocol according to the target service quality level and the encrypted message data, issuing the target message to a message server based on the target protocol, and indicating the message server to forward the target message to the second client. By adopting the method, the message data in the target message can be prevented from being attacked and tampered, and the security of message data distribution in an industrial scene can also be improved.

Description

Technical Field

[0001] The present application relates to the technical field of industrial passive optical networks, and in particular to a data distribution method, device, communication equipment and storage medium. Background Art

[0002] With the joint development of the Internet and the industrial field, industrial PON (Passive Optical Network) technology has emerged. Industrial PON technology can be used to interconnect various industrial equipment in factories.

[0003] In traditional technology, for industrial PON applications, the MQTT (Message Queuing Telemetry Transport) protocol is commonly used for message distribution. The controller and industrial gateway in the industrial PON application are both used as clients to subscribe and publish messages to the Broker, which forwards messages to different clients and controls the number of times the message data in the message is processed through the QoS (Quality of Service) level in the MQTT protocol.

[0004] However, the message data transmitted in industrial scenarios contains sensitive data with high security requirements. The QoS level of the MQTT protocol in traditional technology only constrains the reliability of message data processing, resulting in poor security of message data distribution in industrial scenarios. Summary of the invention

[0005] The embodiments of the present application provide a data distribution method, apparatus, communication equipment and storage medium, which can prevent the message data in the target message from being attacked and tampered with, and can also improve the security of message data distribution in industrial scenarios.

[0006] In a first aspect, the present application provides a data distribution method, which is applied to a first client and includes:

[0007] Acquire a target instruction, and identify a service quality level corresponding to the target instruction;

[0008] If the service quality level of the target instruction is the target service quality level, encrypting the target instruction according to the security module to obtain encrypted message data;

[0009] A target message under a target protocol is generated according to the target service quality level and the encrypted message data, and the target message is sent to a message server based on the target protocol, instructing the message server to forward the target message to the second client.

[0010] In one embodiment, the service quality level in the target protocol includes the target service quality level; before obtaining the target instruction and identifying the service quality level corresponding to the target instruction, the method further includes:

[0011] In the target protocol, among the two target bits representing the service quality level, the service quality level when the values ​​of the two target bits are both 1 is determined as the target service quality level.

[0012] In one of the embodiments, after generating a target message under a target protocol according to the target service quality level and the encrypted message data, sending the target message to a message server based on the target protocol, and instructing the message server to forward the target message to the second client, the method further includes:

[0013] The interactive message based on the target protocol type performs encrypted feedback with the message server; the encrypted feedback is used to instruct the message server to release the storage status information corresponding to the target message.

[0014] In one embodiment, the interactive message based on the target protocol type is encrypted and fed back to the message server, including:

[0015] In response to the first encrypted message fed back by the message server, sending a second encrypted message to the message server;

[0016] In response to the third encrypted message fed back by the message server, the storage status information of the target message is released.

[0017] In a second aspect, the present application provides a data distribution method, which is applied to a second client, and the method includes:

[0018] receiving a target message sent by a message server, wherein the target message carries a service quality level;

[0019] If the service quality level is the target service quality level, decrypting the encrypted message data in the target message according to the security module to obtain message data;

[0020] Message processing is performed based on the message data to obtain a message processing result, and encrypted feedback is provided to the message server based on an interactive message of the target protocol type; the encrypted feedback is used to instruct the message server to release the storage status information corresponding to the target message.

[0021] In one embodiment, after performing message processing based on the message data and obtaining a message processing result, the method further includes:

[0022] In response to the target message published by the message server, feeding back a first encrypted message to the message server;

[0023] In response to the second encrypted message fed back by the message server, a third encrypted message is fed back to the message server, and the storage status information corresponding to the target message is released.

[0024] In a third aspect, the present application further provides a data distribution device, which is applied to a first client and includes:

[0025] An acquisition module, used to acquire a target instruction and identify a service quality level corresponding to the target instruction;

[0026] An encryption module, configured to encrypt the target instruction according to the security module to obtain encrypted message data if the service quality level of the target instruction is the target service quality level;

[0027] A publishing module is used to generate a target message under a target protocol according to a target service quality level and the encrypted message data, and send the target message to a message server based on the target protocol, instructing the message server to forward the target message to a second client.

[0028] In one embodiment, the quality of service level in the target protocol includes the target quality of service level; and the apparatus further comprises:

[0029] The pre-defined module is used to determine the service quality level when the values ​​of the two target bits representing the service quality level in the target protocol are both 1 as the target service quality level.

[0030] In one embodiment, the device further comprises:

[0031] The first feedback module is used to perform encrypted feedback with the message server based on the interactive message of the target protocol type; the encrypted feedback is used to instruct the message server to release the storage status information corresponding to the target message.

[0032] In one of the embodiments, the first feedback module is specifically configured to send a second encrypted message to the message server in response to the first encrypted message fed back by the message server;

[0033] In response to the third encrypted message fed back by the message server, the storage status information of the target message is released.

[0034] In a fourth aspect, the present application further provides a data distribution device, which is applied to a second client and includes:

[0035] A receiving module, used for receiving a target message sent by a message server, wherein the target message carries a service quality level;

[0036] a decryption module, configured to decrypt the encrypted message data in the target message according to the security module to obtain message data if the service quality level is the target service quality level;

[0037] A processing module is used to perform message processing based on the message data, obtain a message processing result, and provide encrypted feedback to the message server based on an interactive message of a target protocol type; the encrypted feedback is used to instruct the message server to release the storage status information corresponding to the target message.

[0038] In one embodiment, the device further comprises:

[0039] A second feedback module, configured to feedback a first encrypted message to the message server in response to the target message published by the message server;

[0040] The third feedback module is used to feedback a third encrypted message to the message server in response to the second encrypted message fed back by the message server, and release the storage status information corresponding to the target message.

[0041] In a fifth aspect, the present application also provides a data distribution system, the system comprising:

[0042] A first client is used to obtain a target instruction and identify a service quality level corresponding to the target instruction;

[0043] If the service quality level of the target instruction is the target service quality level, encrypt the target instruction according to the security module to obtain encrypted message data; generate a target message under the target protocol according to the target service quality level and the encrypted message data, and send the target message to the message server based on the target protocol, instructing the message server to forward the target message to the second client;

[0044] The second client is used to receive a target message sent by a message server, the target message carrying a service quality level; if the service quality level is the target service quality level, decrypt the encrypted message data in the target message according to the security module to obtain the message data; perform message processing based on the message data to obtain a message processing result, and provide encrypted feedback to the message server based on an interactive message of a target protocol type; the encrypted feedback is used to instruct the message server to release the storage status information corresponding to the target message;

[0045] The message server is used to forward the target message to the second client.

[0046] In a sixth aspect, the present application further provides a communication device, including: a transmitter, a processor, and a receiver;

[0047] The processor is used to obtain a target instruction and identify a service quality level corresponding to the target instruction; if the service quality level of the target instruction is a target service quality level, encrypt the target instruction according to the security module to obtain encrypted message data; and generate a target message under a target protocol according to the target service quality level and the encrypted message data;

[0048] The sender is used to send the target message to the message server based on the target protocol, and instruct the message server to forward the target message to the second client.

[0049] In a seventh aspect, the present application further provides a communication device, including: a transmitter, a processor, and a receiver;

[0050] The receiver is used to receive a target message sent by a message server, wherein the target message carries a service quality level;

[0051] The processor is configured to, if the quality of service level is a target quality of service level, decrypt the encrypted message data in the target message according to the security module to obtain message data; perform message processing based on the message data to obtain a message processing result;

[0052] The sender is used to provide encrypted feedback to the message server based on an interactive message of a target protocol type; the encrypted feedback is used to instruct the message server to release storage status information corresponding to the target message.

[0053] In an eighth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0054] Acquire a target instruction, and identify a service quality level corresponding to the target instruction;

[0055] If the service quality level of the target instruction is the target service quality level, encrypting the target instruction according to the security module to obtain encrypted message data;

[0056] A target message under a target protocol is generated according to the target service quality level and the encrypted message data, and the target message is sent to a message server based on the target protocol, instructing the message server to forward the target message to the second client.

[0057] In a ninth aspect, the present application further provides a computer program product, including a computer program, which, when executed by a processor, implements the data distribution method provided in the embodiment of the present application, and the method may be:

[0058] Acquire a target instruction, and identify a service quality level corresponding to the target instruction;

[0059] If the service quality level of the target instruction is the target service quality level, encrypting the target instruction according to the security module to obtain encrypted message data;

[0060] A target message under a target protocol is generated according to the target service quality level and the encrypted message data, and the target message is sent to a message server based on the target protocol, instructing the message server to forward the target message to the second client.

[0061] The above-mentioned data distribution method, device, communication equipment and storage medium obtain the target instruction and the target service quality level corresponding to the target instruction, encrypt the target instruction according to the security module to obtain encrypted message data; generate the target message under the target protocol according to the target service quality level and the encrypted message data, and send the target message to the message server according to the target protocol, instructing the message server to forward the target message to the second client; the service quality level in the target protocol includes the target service quality level; the interactive message based on the target protocol type is encrypted and fed back to the message server; the encrypted feedback is used to instruct the message server to release the storage status information corresponding to the target message. By adopting this method, the target instruction under the target service quality level is encrypted by the security module, and the data security forwarding capability can be provided for the industrial PON system in the scenario with high data security requirements, that is, in the process of publishing the target message to the second client via the message server, the message data in the target message is sent and forwarded in an encrypted state, which can prevent the message data in the target message from being attacked and tampered, and can also improve the security of message data distribution in industrial scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 An application environment diagram of a data distribution method in an embodiment;

[0063] Figure 2 This is a schematic diagram of the interaction between a traditional MQTT protocol client and a message server;

[0064] Figure 3 is a flow chart of a data distribution method applied to a first client in one embodiment;

[0065] Figure 4 A schematic diagram of a flow chart of encryption processing performed by a security module in one embodiment;

[0066] Figure 5 A schematic diagram of a fixed message header of a message structure in MQTT in one embodiment;

[0067] Figure 6 A schematic diagram of a process of interactive feedback between a first client and a message server after completing data distribution in one embodiment;

[0068] Figure 7 A schematic diagram of an embodiment in which a first client completes data distribution and performs interactive feedback with a message server;

[0069] Figure 8 is a flow chart of a data distribution method applied to a second client in one embodiment;

[0070] Fig. 9 A schematic diagram of a flow chart of interactive feedback between a message server and a second client in one embodiment;

[0071] Fig.10 is a structural block diagram of a data distribution device applied to a first client in an embodiment;

[0072] Fig.11 is a structural block diagram of a data distribution device applied to a second client in an embodiment;

[0073] Fig.12 FIG. 4 is a diagram showing the internal structure of a communication device in one embodiment. DETAILED DESCRIPTION

[0074] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0075] The embodiment of the present invention can be applied to the communication network scenario in the industrial Internet project based on PON technology. The workshop industrial Internet covers the production material information collection, equipment data collection, production process information collection, personnel information collection, product quality information collection and workshop working condition information collection, etc. Among them, the equipment data collection can be realized between the controller and multiple industrial gateways through the publish / subscribe message mode of the MQTT protocol. In the industrial PON application, it includes multiple clients (the message publisher is the first client 102, and at least one message receiver is the second client 104) and the message server 106. The first client 102 obtains the target instruction and identifies the service quality level corresponding to the target instruction. If the service quality level of the target instruction is the target service quality level, the first client 102 encrypts the target instruction according to the security module to obtain the encrypted message data. The first client 102 generates the target message under the target protocol according to the target service quality level and the encrypted message data, and sends the target message to the message server 106 based on the target protocol, instructing the message server 106 to forward the target message to the second client 104. For example, the controller and the industrial gateway both act as clients (Client) to subscribe and publish information to the message server (Broker). The collected data and control command return data are mainly published by the industrial gateway to the Broker, and the Broker distributes them to the controller. The collected subscription data and control commands are mainly published by the controller to the Broker, and the Broker distributes them to the industrial gateway.

[0076] In traditional technology, industrial PON applications generally use the MQTT protocol for message distribution. The controller and industrial gateway in the industrial PON application are both used as clients, subscribing and publishing messages to the Broker, forwarding messages to different clients through the Broker, and controlling the number of times the message data in the message is processed through the QoS level in the MQTT protocol. For example, Figure 2 As shown in the figure, after the client sends a PUBLISH data packet with QoS (quality of service) level 2 to the message server (Broker), the client and the message server interact with PUBREC messages, PUBREL and PUBCOMP messages respectively to ensure that the message server processes the PUBLISH data packet only once.

[0077] Based on this, the Broker in traditional technology uniformly distributes all data streams, which cannot meet the needs of sensitive data unique to industrial scenarios to use secure encrypted channels. The PUBLISH message in the MQTT protocol has QoS levels, and messages such as PUBACK, PUBREC, PUBREL, and PUBCOMP, as part of the QoS level mechanism, do not have the concept of QoS. They cannot be forwarded securely either. Therefore, the QoS capability of the existing MQTT protocol only has constraints on reliability, but no security requirements, and cannot meet the needs of sensitive data unique to industrial scenarios to use secure encrypted channels.

[0078] It should be noted that the beneficial effects brought about by the embodiments of the present application or the technical problems solved are not limited to this one, but may also include other implicit or related problems. For details, please refer to the description of the following embodiments.

[0079] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0080] In one embodiment, Figure 3 As shown, a data distribution method is provided, which is applied to Figure 1 Taking the first client in the example as an example, the following steps are included:

[0081] Step 302: Acquire a target instruction and identify the service quality level corresponding to the target instruction.

[0082] In the embodiments of the present application, in the data collection of the workshop industrial Internet in the industrial PON field, the current mainstream access network OLT (Optical Line Terminal) equipment uses Telemetry technology for high-precision collection. The resources of the industrial PON gateway are limited. In the case where the MQTT protocol stack is already available, supporting the collection function of the industrial PON gateway through MQTT technology has great application prospects.

[0083] In the MQTT scenario of industrial PON, the first client is the publisher of the instruction (message). After the first client publishes a message of a certain topic to the message server (Broker in the MQTT protocol), the second client that subscribes to the topic corresponding to the message receives the message and responds to it.

[0084] In the message publishing supported by the first client, the topics and service quality levels (QoS) corresponding to each message are pre-defined. The topic name can be a string with a hierarchical structure separated by forward slashes, for example, "myhome / livingroom / temperature"; the service quality level is an agreement between the sender and the receiver of the message, which defines the delivery guarantee of a specific message. For example, in scenarios with low reliability requirements, the service quality level of the message can be set to 0 or 1 to reduce the consumption of communication resources. For messages with high reliability requirements, a higher service quality level (QoS2) is set to ensure that the message is delivered exactly once.

[0085] The target instruction in the first client may come from different sources, such as user input, other systems or automated processes. After the first client receives or generates the target instruction, the first client first identifies the server quality level corresponding to the target instruction in the service quality levels predefined for each message.

[0086] Step 304: If the service quality level of the target instruction is the target service quality level, encrypt the target instruction according to the security module to obtain encrypted message data.

[0087] The target quality of service (QoS) level is an additional higher QoS level: QoS3, which means the quality of service level is level 3. Both bits corresponding to the target quality of service level are 1, and its specific definition is described in detail in the following embodiment 3021.

[0088] In the embodiment of the present application, if the first client determines that the predefined service quality level corresponding to the target instruction is the target service quality level, it means that the target instruction not only has high reliability requirements, but also has high security requirements, that is, the target instruction is sensitive data, and if it is attacked and tampered with, it will have a great impact on industrial production. Therefore, before the first client generates a message using the target instruction as message data, it is also necessary to encrypt the target instruction, such as Figure 4 As shown, the first client encrypts the target instruction through the security module and obtains the encrypted message data, and then publishes it based on the encrypted message data in the encrypted state. Specifically, the first client calls the integrated security module, which is responsible for encrypting and decrypting sensitive data. The security module selects a suitable encryption algorithm (for example, AES, RSA, etc.) according to the predefined encryption strategy or security strategy, encrypts the payload data of the target instruction, and generates encrypted message data. This process ensures that even if the message is intercepted during transmission, it cannot be easily decrypted. The encrypted payload data is recombined with other parts of the instruction (such as subject, QoS level) to generate complete encrypted message data.

[0089] Step 306: Generate a target message under the target protocol according to the target service quality level and the encrypted message data, and send the target message to the message server based on the target protocol, instructing the message server to forward the target message to the second client.

[0090] Among them, the target protocol is the MQTT protocol with an added target service quality level (QoS3).

[0091] In an embodiment of the present application, the first client constructs a target message containing encrypted message data and a target service quality level in accordance with the required message structure of the MQTT protocol, publishes the generated target message to the message server (Broker) through the MQTT protocol, and instructs the Broker to forward the target message to the second client (for example, an industrial gateway) that has subscribed to the corresponding topic.

[0092] In an exemplary embodiment, the security module encrypts the message with high security requirements according to the security requirements of the target message, and packages it in a QoS 3 MQTT packet to publish the message.

[0093] In the above data distribution method, the target instructions under the target service quality level are encrypted through the security module, which can provide the industrial PON system with the ability to securely forward data in scenarios with high data security requirements. That is, in the process of publishing the target message to the second client via the message server, the message data in the target message is sent and forwarded in an encrypted state, which can prevent the message data in the target message from being attacked and tampered with, and can also improve the security of message data distribution in industrial scenarios.

[0094] In an exemplary embodiment, the quality of service level in the target protocol includes a target quality of service level; before step 302, the method may further include:

[0095] Step 3021: In the target protocol, of the two target bits representing the service quality level, the service quality level when both target bit values ​​are 1 is determined as the target service quality level.

[0096] In the embodiment of the present application, the target protocol is the MQTT protocol, and the first client introduces QoS3 in the QoS level of the original MQTT protocol as the target service quality level, which is used to indicate that the delivery guarantee of the target message is processed once, forwarded with priority and has security requirements. Figure 5 As shown, Figure 5The following is a diagram of the fixed header of the message structure in MQTT, where Bit 1 and Bit 2 are target bits used to represent the QoS level. These two bits are recorded in a binary system, i.e. Bit1=0 and Bit2=0 represent QoS0, Bit1=0 and Bit2=1 represent QoS1, Bit1=1 and Bit2=0 represent QoS2, and Bit1=1 and Bit2=1 represent QoS3. Similarly, in the MQTT protocol in other clients, a target QoS level is defined, i.e., the QoS level when the target bits representing the QoS level are all 1 is used as the target QoS level.

[0097] In this embodiment, by introducing the target service quality level, data security forwarding can be achieved, and a new priority is provided to provide an implementation method for strictly preventing attacks and tampering of important instructions such as control instructions, thereby improving the security of data delivery.

[0098] In an exemplary embodiment, after step 306, the method further includes:

[0099] Step 3061, encrypt and feedback the interactive message based on the target protocol type to the message server.

[0100] Among them, the interactive message of the target protocol type refers to the feedback message encrypted by the security module, and the encryption method of the interactive message of the target protocol type is the same as the encryption method of the target message. The interactive message of the target protocol type is used to interactively feedback the target message of the target service quality after it is sent. The target message of the target service quality is an interactive message for message feedback of the target message containing the encrypted message data encrypted by the security module.

[0101] The encrypted feedback is used to instruct the message server to release the storage status information corresponding to the target message.

[0102] In an embodiment of the present application, an interactive message of a target protocol type for feedback of a target message is also introduced in the first terminal. In an optional embodiment, taking the MQTT protocol as an example, in the message type of the original MQTT protocol in this embodiment, the interactive message of the target protocol type introduced includes a SECPUBREC message (SECPUBREC data packet), a SECPUBREL message (SECPUBREL data packet), and a SECPUBCOMP message (SECPUBCOMP data packet). Among them, the SECPUBREC message and the SECPUBREC data packet are used as examples for explanation (the SECPUBREL message and the SECPUBREL data packet, the SECPUBCOMP message and the SECPUBCOMP data packet are the same), the SECPUBREC message and the SECPUBREC data packet actually refer to the same concept, the SECPUBREC message refers to the message type of the interactive message of the target protocol type, the SECPUBREC data packet is the actual manifestation of the SECPUBREC message in network transmission, and the SECPUBREC data packet is a binary data packet, which contains a specific field defined in the MQTT protocol after being encrypted by the security module, and is used to identify and confirm the received PUBLISH message.

[0103] After the target message is sent, the target protocol type is used to encrypt feedback with the receiver, so that the receiver only processes the target message once. The interactive message of the target protocol type is used to provide a feedback confirmation capability for the sender and receiver after the sender sends the target message with the target service quality level.

[0104] In a specific embodiment, when the receiver obtains the target message from the sender (the target message includes a PUBLISH packet, and the service quality level of the target message is QoS3), the receiver will process the publish message accordingly and reply to the sender through a SECPUBREC packet, and the SECPUBREC packet is used to confirm the PUBLISH packet. If the sender does not obtain the SECPUBREC packet from the receiver, it will send the PUBLISH packet with a duplicate (DUP) flag again until the SECPUBREC packet is received.

[0105] When the sender receives a SECPUBREC packet from the receiver, the sender can safely discard the initial PUBLISH packet. The sender stores the SECPUBREC packet from the receiver and responds with a SECPUBREL packet.

[0106] After the receiver gets the SECPUBREL packet, the receiver can discard all stored state and reply with a SECPUBCOMP packet (when the sender receives a SECPUBCOMP packet, the sender also discards all stored state for the PUBLISH packet). Before the receiver completes processing and sends the SECPUBCOMP packet back to the sender, the receiver stores a reference to the packet identifier of the original PUBLISH packet. This step is used to avoid processing the target message containing the PUBLISH packet more than once. After the sender receives the SECPUBCOMP packet, the packet identifier of the PUBLISH message becomes available for reuse.

[0107] In this embodiment, an interactive message of a target protocol type is defined for a target message of a target service quality level, which can ensure the security of interactive feedback of the target message between the first client and the message server, thereby ensuring the data security of the entire process from the sending of the target message to the interactive feedback between the first client and the message server.

[0108] In an exemplary embodiment, Figure 6 As shown, step 3061 specifically includes steps 602 to 604. Among them:

[0109] Step 602: In response to the first encrypted message fed back by the message server, a second encrypted message is sent to the message server.

[0110] In the embodiment of the present application, the first encrypted message is a SECPUBREC message, and the second encrypted message is a SECPUBREL message. Figure 7 As shown, after the first client (Client) sends the target message to the message server (Broker), the first client is in the state of waiting to receive the first encrypted message from the message server, and after receiving the first encrypted message, it indicates that the message server has received the target message, and has stored the reference of the data packet identifier of the PUBLISH data packet in the target message, and is ready to forward it to the subscriber (the second client). The first client responds to the message server according to the second encrypted message, that is, sends the second encrypted message to the message server. The second encrypted message indicates that the first client has received the first encrypted message fed back by the message server, and confirms that the message server has received the target message. At this time, the first client can determine that the target message has been successfully delivered to the message server, and can then release the publishing status information related to the target message.

[0111] If the first client does not receive the SECPUBREC data packet fed back from the message server, it indicates that the target message may fail to be sent, and the first client will send the target message (PUBLISH data packet) with a duplicate (DUP) flag to the message server again until the SECPUBREC message is received.

[0112] Step 604: In response to the third encrypted message fed back by the message server, release the storage status information of the target message.

[0113] In the embodiment of the present application, the third encrypted message is a SECPUBCOMP message. Figure 7 As shown, when the first client receives the SECPUBCOMP message fed back from the message server, it indicates that the message server has successfully received the target message, and all related confirmation messages (SECPUBREC message and SECPUBREL message) have been completed, then the first client can safely release the storage status information corresponding to the target message to avoid waste of resources and potential memory leaks. The storage status information is temporary status information stored when the first client interacts with the message server to send feedback on SECPUBREC message and SECPUBREL message, for example, message identifier (packetID), etc.

[0114] In this embodiment, the first client ensures the high-reliability delivery of the target message by interactively feeding back the first encrypted message, the second encrypted message, and the third encrypted message with the message server, and releases the storage status information in a timely manner after the message publishing and receiving process is completed, thereby preventing resource waste and potential memory leakage problems.

[0115] In one embodiment, Figure 8 As shown, a data distribution method is provided, which is applied to Figure 1 The second client in the example is used as an example to illustrate, including the following steps:

[0116] Step 802: Receive a target message sent by a message server.

[0117] The target message carries the service quality level.

[0118] In the embodiment of the present application, the first client publishes the target message to the message server, and instructs the message server to forward the target message to the second client that subscribes to the topic to which the target message belongs. The second client directly forwards the encrypted target message to the second client, and does not perform decryption processing in the message server, but decrypts the target message in the second client.

[0119] After the second client receives the target message, the structure of the target message includes subject, payload and service quality level, etc. When the service quality level is the target service quality level (QoS3), it indicates that the target message contains encrypted message data.

[0120] Step 804: If the service quality level is the target service quality level, the encrypted message data in the target message is decrypted according to the security module to obtain message data.

[0121] In an embodiment of the present application, the second client identifies the service quality level carried in the target message. If the service quality level is the target service quality level, the second client (the recipient of the target message) uses the security module to decrypt the encrypted message data in the target message according to the requirements for processing messages of the target service quality level pre-defined in the target protocol, and obtains the original message data after decryption.

[0122] Step 806, perform message processing based on the message data, obtain the message processing result, and provide encrypted feedback to the message server based on the interactive message of the target protocol type; the encrypted feedback is used to instruct the message server to release the storage status information corresponding to the target message.

[0123] In the embodiment of the present application, the second client performs corresponding message processing based on the decrypted message data, and the processing result may include executing specific operations, updating status, etc., for example, executing a port closing operation. Finally, in order to ensure that the message server knows that the second client has successfully processed the target message, so that the relevant resources can be safely released, the second client generates an interactive message according to the target protocol type and provides encrypted feedback to the message server.

[0124] In this embodiment, the second client ensures the security and reliability of high QoS level messages by decrypting and encrypting the target messages of the target service quality level, and collaborates with the message server through an encrypted feedback mechanism to manage message status and resources, thereby improving the security of data distribution.

[0125] In an exemplary embodiment, Fig. 9 As shown, after step 806, the method further includes steps 902 to 904. Among them:

[0126] Step 902: In response to the target message published by the message server, a first encrypted message is fed back to the message server.

[0127] In the embodiment of the present application, the first encrypted message is a SECPUBREC message. After receiving the target message forwarded by the message server, the second client feeds back the first encrypted message to the message server, which indicates that the second client is ready to process the target message and instructs the message server to proceed to the next step of confirmation.

[0128] Step 904: In response to the second encrypted message fed back by the message server, a third encrypted message is fed back to the message server, and the storage status information corresponding to the target message is released.

[0129] In the embodiment of the present application, the second encrypted message is SECPUBREL, and the third encrypted message is SECPUBCOMP message. After the message server feeds back the second encrypted message to the second client, the second client feeds back the third encrypted message to the message server, which can ensure that the second client processes the target message only once. After the second client feeds back the third encrypted message, the second client releases the storage status information related to the target message, including the message identifier (packetId) and the confirmation status, etc.

[0130] In this embodiment, through the interactive feedback between the second client and the message server, reliable message delivery of the target message under the target service quality level is achieved, effectively ensuring the accuracy and uniqueness of the message between the message server and the second client, and at the same time, through the feedback mechanism of encrypted messages, efficient management of resources and timely release of status information are achieved, thereby improving the overall stability and resource utilization of industrial PON technology.

[0131] In one embodiment, an example of a data distribution method is provided, which is applied to a scenario where an industrial PON controller (first client) collects port traffic information of thousands of industrial gateways (second clients) under an OLT, and the method includes:

[0132] Step 1: The industrial PON controller acts as a client and publishes a message a containing data collection instructions to the industrial gateway.

[0133] Step 2: The industrial gateway acts as a client and publishes message b of the port traffic information to the Broker at a publishing cycle of 15 seconds (the service quality level corresponding to message b is lower than the target service quality level, that is, QoS < 3).

[0134] Step 3: Broker publishes the message c containing all collected data to the industrial PON controller Client.

[0135] Step 4: The industrial PON controller determines that the traffic of a certain industrial gateway port a is abnormal, and generates a configuration instruction to close the industrial gateway port a.

[0136] Step 5: The industrial PON controller, as a Client, sends a PUBLISH message d to the Broker (the service quality level corresponding to the message d is the target service quality level, i.e., QoS=3). The message d is used to request port a to be closed.

[0137] Step 6: The security module of the industrial PON controller completes special security measures on message d, such as encryption, and distributes it to the Broker according to QoS=3.

[0138] Step 7: Broker confirms that it has successfully received the PUBLISH data packet of message d by sending a SECPUBREC message to the industrial PON controller Client.

[0139] Step 8: The industrial PON controller Client receives the SECPUBREC message, safely discards the initial PUBLISH packet, stores the SECPUBREC packet from the Broker, and responds with a SECPUBREL packet.

[0140] Step 9: After receiving the SECPUBREL packet, the Broker discards all storage states related to message d and responds with a SECPUBCOMP packet (the industrial PON controller Client also discards all storage states related to message d when it receives SECPUBCOMP). Before the industrial PON controller Client completes processing and sends the SECPUBCOMP packet back to the Broker, the industrial PON controller Client stores a reference to the packet identifier of the original SECPUBLISH packet.

[0141] In step 10, the Broker does not decrypt the QoS 3 message, but directly publishes message d (including the configuration instruction requiring port a to be closed) securely through QoS 3. The industrial gateway Client that subscribes to the control instructions receives message d and follows the same interactive feedback as steps 5 to 9. It ensures that the configuration instruction in message d is received once through the SECPUBREC, SECPUBREL, and SECPUBCOMP messages, and executes the instruction after decryption by the security module.

[0142] Step 11: After the industrial gateway executes the closing of port a, it returns a response message of the configuration instruction to the controller Client through the Broker (for example, <ok>), and follow the same steps as step 5 to step 10, completing two message forwardings through two QoS3 logical channels to ensure one forwarding. At this time, the configuration instructions in message d and the response message returned by the configuration complete the device control with higher security, preventing the device control instructions from being tampered with by attacks.

[0143] In one embodiment, a data distribution system is also provided, the system comprising:

[0144] The first client is used to obtain a target instruction and identify a service quality level corresponding to the target instruction.

[0145] If the service quality level of the target instruction is the target service quality level, the target instruction is encrypted according to the security module to obtain encrypted message data; the target message under the target protocol is generated according to the target service quality level and the encrypted message data, and the target message is sent to the message server based on the target protocol, instructing the message server to forward the target message to the second client.

[0146] The second client is used to receive a target message sent by a message server, where the target message carries a service quality level; if the service quality level is a target service quality level, the encrypted message data in the target message is decrypted according to the security module to obtain the message data; message processing is performed based on the message data to obtain a message processing result, and encrypted feedback is provided to the message server based on an interactive message of the target protocol type; the encrypted feedback is used to instruct the message server to release the storage status information corresponding to the target message.

[0147] The message server is used to forward the target message to the second client.

[0148] It should be understood that although Figure 3 , Figure 6 , Figure 8 and Fig. 9 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 3 , Figure 6 , Figure 8 and Fig. 9 At least part of the steps may include multiple steps or multiple stages. These steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed in turn or alternately with other steps or at least part of the steps or stages in other steps.

[0149] In one embodiment, Fig.10 As shown, a data distribution device 1000 is provided, which is applied to a first client and includes: an acquisition module 1001, an encryption module 1002 and a publishing module 1003, wherein:

[0150] The acquisition module 1001 is used to acquire a target instruction and identify a service quality level corresponding to the target instruction.

[0151] The encryption module 1002 is used to encrypt the target instruction according to the security module to obtain encrypted message data if the service quality level of the target instruction is the target service quality level.

[0152] The publishing module 1003 is used to generate a target message under a target protocol according to a target service quality level and encrypted message data, and send the target message to a message server based on the target protocol, instructing the message server to forward the target message to a second client.

[0153] In one embodiment, the quality of service level in the target protocol includes a target quality of service level. The apparatus 1000 also includes:

[0154] The pre-defined module is used to determine the service quality level when the values ​​of the two target bits representing the service quality level in the target protocol are both 1 as the target service quality level.

[0155] In one embodiment, the apparatus 1000 further includes:

[0156] The first feedback module is used to perform encrypted feedback with the message server based on the interactive message of the target protocol type. The encrypted feedback is used to instruct the message server to release the storage status information corresponding to the target message.

[0157] In one of the embodiments, the first feedback module is specifically configured to send a second encrypted message to the message server in response to the first encrypted message fed back by the message server.

[0158] In response to the third encrypted message fed back by the message server, the storage status information of the target message is released.

[0159] In one embodiment, Fig.11 As shown, a data distribution device 1100 is also provided. The device 1100 is applied to a second client and includes: a receiving module 1101, a decryption module 1102 and a processing module 1103, wherein:

[0160] The receiving module 1101 is used to receive a target message sent by a message server, where the target message carries a service quality level.

[0161] The decryption module 1102 is used to decrypt the encrypted message data in the target message according to the security module to obtain the message data if the service quality level is the target service quality level.

[0162] The processing module 1103 is used to process the message based on the message data, obtain the message processing result, and provide encrypted feedback to the message server based on the interactive message of the target protocol type. The encrypted feedback is used to instruct the message server to release the storage status information corresponding to the target message.

[0163] In one embodiment, the apparatus 1100 further includes:

[0164] The second feedback module is used to feedback the first encrypted message to the message server in response to the target message published by the message server.

[0165] The third feedback module is used to respond to the second encrypted message fed back by the message server, feed back a third encrypted message to the message server, and release the storage status information corresponding to the target message.

[0166] For the specific definition of the data distribution device, please refer to the definition of the data distribution method above, which will not be repeated here. Each module in the above-mentioned data distribution device can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0167] Fig.12 A schematic diagram of the structure of an access network device provided in an embodiment of the present application. The access network device may include a receiver 121, a memory 122, a processor 123, at least one communication bus 124 and a transmitter 125. The communication bus 124 is used to realize the communication connection between the components. The memory 122 may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk memory. Various programs may be stored in the memory 122 to complete various processing functions and implement the method steps of this embodiment. In this embodiment, the transmitter 125 may be a radio frequency processing module or a baseband processing module in the access network device, and the receiver 121 may also be a radio frequency processing module or a baseband processing module in the access network device. The transmitter 125 and the receiver 121 can be integrated together to realize a transceiver. The transmitter 125 and the receiver 121 can be coupled to the processor 123, and they can realize the receiving or sending action under the instruction or control of the processor 123.

[0168] In this embodiment, the receiver 121 is used to obtain the target instruction and identify the service quality level corresponding to the target instruction;

[0169] The processor 123 is configured to, if the service quality level of the target instruction is the target service quality level, encrypt the target instruction according to the security module to obtain encrypted message data; and generate a target message under the target protocol according to the target service quality level and the encrypted message data;

[0170] The sender 125 is used to send the target message to the message server based on the target protocol, and instruct the message server to forward the target message to the second client.

[0171] In one embodiment, the service quality level in the target protocol includes a target service quality level; the processor 123 is specifically configured to determine the service quality level when both target bit values ​​of the two target bits representing the service quality level in the target protocol are 1 as the target service quality level.

[0172] In one embodiment, the transmitter 125 is specifically used to perform encrypted feedback with the message server based on the interactive message of the target protocol type; the encrypted feedback is used to instruct the message server to release the storage status information corresponding to the target message.

[0173] In one embodiment, the transmitter 125 is specifically configured to send a second encrypted message to the message server in response to a first encrypted message fed back by the message server; and release the storage status information of the target message in response to a third encrypted message fed back by the message server.

[0174] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0175] Obtaining a target instruction and identifying a service quality level corresponding to the target instruction;

[0176] If the service quality level of the target instruction is the target service quality level, encrypt the target instruction according to the security module to obtain encrypted message data;

[0177] A target message under a target protocol is generated according to the target service quality level and the encrypted message data, and the target message is sent to a message server based on the target protocol, instructing the message server to forward the target message to the second client.

[0178] In one embodiment, the quality of service level in the target protocol includes a target quality of service level; when the computer program is executed by the processor, the following steps are also implemented:

[0179] In the target protocol, in the two target bits representing the service quality level, the service quality level when the values ​​of the two target bits are both 1 is determined as the target service quality level.

[0180] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0181] The interactive message based on the target protocol type performs encrypted feedback with the message server; the encrypted feedback is used to instruct the message server to release the storage status information corresponding to the target message.

[0182] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0183] In response to the first encrypted message fed back by the message server, sending a second encrypted message to the message server;

[0184] In response to the third encrypted message fed back by the message server, the storage status information of the target message is released.

[0185] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0186] Receive a target message sent by a message server, the target message carrying a service quality level;

[0187] If the service quality level is the target service quality level, the encrypted message data in the target message is decrypted according to the security module to obtain the message data;

[0188] Message processing is performed based on the message data to obtain the message processing result, and encrypted feedback is given to the message server based on the interactive message of the target protocol type; the encrypted feedback is used to instruct the message server to release the storage status information corresponding to the target message.

[0189] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0190] In response to the target message published by the message server, feeding back a first encrypted message to the message server;

[0191] In response to the second encrypted message fed back by the message server, a third encrypted message is fed back to the message server, and the storage status information corresponding to the target message is released.

[0192] The embodiments of the present application also provide a computer program product including instructions, which, when executed on a computer, enables the computer to execute the steps in the above-mentioned method embodiments.

[0193] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0194] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0195] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.< / ok>

Claims

1. A data distribution method, characterized in that: The method is applied to a first client, and the method includes: Acquire a target instruction, and identify a service quality level corresponding to the target instruction; If the service quality level of the target instruction is the target service quality level, encrypting the target instruction according to the security module to obtain encrypted message data; A target message under a target protocol is generated according to the target service quality level and the encrypted message data, and the target message is sent to a message server based on the target protocol, instructing the message server to forward the target message to the second client.

2. The method according to claim 1, characterized in that The service quality level in the target protocol includes the target service quality level; before obtaining the target instruction and identifying the service quality level corresponding to the target instruction, the method further includes: In the target protocol, among the two target bits representing the service quality level, the service quality level when the values ​​of the two target bits are both 1 is determined as the target service quality level.

3. The method according to claim 1, characterized in that After generating a target message under a target protocol according to the target service quality level and the encrypted message data, sending the target message to a message server based on the target protocol, and instructing the message server to forward the target message to the second client, the method further includes: The interactive message based on the target protocol type performs encrypted feedback with the message server; the encrypted feedback is used to instruct the message server to release the storage status information corresponding to the target message.

4. The method according to claim 3, characterized in that The interactive message based on the target protocol type is encrypted and fed back to the message server, including: In response to the first encrypted message fed back by the message server, sending a second encrypted message to the message server; In response to the third encrypted message fed back by the message server, the storage status information of the target message is released.

5. A data distribution method, characterized in that: The method is applied to a second client, and the method includes: receiving a target message sent by a message server, wherein the target message carries a service quality level; If the service quality level is the target service quality level, decrypting the encrypted message data in the target message according to the security module to obtain message data; Message processing is performed based on the message data to obtain a message processing result, and encrypted feedback is provided to the message server based on an interactive message of the target protocol type; the encrypted feedback is used to instruct the message server to release the storage status information corresponding to the target message.

6. The method according to claim 5, characterized in that After performing message processing based on the message data and obtaining a message processing result, the method further includes: In response to the target message published by the message server, feeding back a first encrypted message to the message server; In response to the second encrypted message fed back by the message server, a third encrypted message is fed back to the message server, and the storage status information corresponding to the target message is released.

7. A data distribution system, characterized in that: The system comprises: A first client is used to obtain a target instruction and identify a service quality level corresponding to the target instruction; If the service quality level of the target instruction is the target service quality level, encrypt the target instruction according to the security module to obtain encrypted message data; generate a target message under the target protocol according to the target service quality level and the encrypted message data, and send the target message to the message server based on the target protocol, instructing the message server to forward the target message to the second client; The second client is used to receive a target message sent by a message server, the target message carrying a service quality level; if the service quality level is the target service quality level, decrypt the encrypted message data in the target message according to the security module to obtain the message data; perform message processing based on the message data to obtain a message processing result, and provide encrypted feedback to the message server based on an interactive message of a target protocol type; the encrypted feedback is used to instruct the message server to release the storage status information corresponding to the target message; The message server is used to forward the target message to the second client.

8. A data distribution device, characterized in that: The device is applied to a first client, and the device includes: An acquisition module, used to acquire a target instruction and identify a service quality level corresponding to the target instruction; An encryption module, configured to encrypt the target instruction according to the security module to obtain encrypted message data if the service quality level of the target instruction is the target service quality level; A publishing module is used to generate a target message under a target protocol according to a target service quality level and the encrypted message data, and send the target message to a message server based on the target protocol, instructing the message server to forward the target message to a second client.

9. A communication device, characterized in that: include: transmitter, processor, and receiver; The processor is used to obtain a target instruction and identify a service quality level corresponding to the target instruction; If the service quality level of the target instruction is the target service quality level, encrypting the target instruction according to the security module to obtain encrypted message data; Generate a target message under a target protocol according to a target service quality level and the encrypted message data; The sender is used to send the target message to the message server based on the target protocol, and instruct the message server to forward the target message to the second client.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images