Three-layer network security transmission method, system, device and readable storage medium

Abstract

The present invention discloses a three-layer network security transmission method, system, device and readable storage medium, the method comprising: obtaining the MAC address and frame sequence number of the sender of the PRP message to be sent, encrypting the MAC address and frame sequence number of the sender of the PRP message to be sent to generate a host fingerprint; adding the host fingerprint and SPRP frame identifier to the redundant check suffix of the PRP message to be sent to generate an SPRP message; adding an Ethernet header to the SPRP message, and sending it from multiple Ethernet cards. Compared with the prior art, the host fingerprint in the present invention changes continuously with the frame sequence number, ensuring the reliable transmission of the MAC address of the sender, thereby realizing the reliability of deduplication of the receiving end message; on the other hand, it can be judged whether there is an attacker who performs malicious operations on the message. At the same time, the present invention is compatible with the existing PRP protocol, can flexibly adjust the message transmission method based on the usage scenario, and has extremely strong flexibility and adaptability.

Description

Technical Field

[0001] The present invention belongs to the field of network communication technology, and in particular relates to a three-layer network security transmission method, system, device and readable storage medium. Background Art

[0002] Ethernet is currently the main data link layer transmission method. In order to meet the needs of high-reliability and high-real-time network transmission, some high-reliability protocols have been developed, such as the Parallel Redundancy Protocol, which provides a unique redundancy mechanism for redundant backup of network links.

[0003] In the PRP protocol, the source MAC address in the frame is used to distinguish the sender, that is, the same source MAC address is considered to be from the same sender. However, in Ethernet, when three-layer communication is carried out through a router, the source MAC in the Ethernet frame will be replaced with the MAC address of the router, resulting in the PRP receiver being unable to distinguish which sender the frame comes from, resulting in the inability to deduplicate. Therefore, the PRP protocol can only be applied to layer 2 network transmission.

[0004] On the other hand, if a malicious attacker intercepts and forges the frame sequence number and sends the forged frame, when the receiver receives the forged frame, it cannot tell whether it comes from the real sender and receives the frame, resulting in the normal frame being erroneously deduplicated.

[0005] Therefore, in view of the above technical problems, it is necessary to provide a secure and reliable message transmission strategy under the three-layer network.

[0006] The information disclosed in this background technology section is only intended to enhance the understanding of the overall background of the invention and should not be regarded as an acknowledgment or any form of suggestion that the information constitutes the prior art already known to a person skilled in the art. Summary of the invention

[0007] The object of the present invention is to provide a three-layer network secure transmission method, system, device and readable storage medium, which can realize the secure transmission of messages in a three-layer network environment.

[0008] In order to achieve the above object, a technical solution provided by a specific embodiment of the present invention is as follows:

[0009] In a first aspect, the present invention provides a three-layer network security transmission method, which comprises:

[0010] Obtaining a MAC address and a frame sequence number of a sender of a PRP message to be sent, and encrypting the MAC address and the frame sequence number of the sender of the PRP message to be sent to generate a host fingerprint;

[0011] Adding the host fingerprint and the SPRP frame identifier to the redundant check suffix of the PRP message to be sent to generate an SPRP message;

[0012] An Ethernet header is added to the SPRP message, and the message is sent out from multiple Ethernet cards.

[0013] In one or more implementations of the present invention, adding the host fingerprint and the SPRP frame identifier includes:

[0014] The SPRP frame identifier and the host fingerprint are spliced ​​in a preset order, and after the frame sequence number is inserted into the redundant check suffix, the redundant check suffix includes the PRP frame identifier, frame length, channel number and frame sequence number.

[0015] In one or more embodiments of the present invention, encrypting the sender MAC address and frame sequence number of the PRP message to be sent to generate a host fingerprint includes:

[0016] Arrange the frame sequence numbers of the messages to be sent and the MAC addresses of the senders in order;

[0017] Based on the key shared with the receiving end, the frame sequence number of the message to be sent and the MAC address of the sending end are encrypted in sequence to generate a host fingerprint.

[0018] In a second aspect, the present invention provides another three-layer network security transmission method, which comprises:

[0019] Obtain the host fingerprint in the redundant check suffix of the received SPRP message;

[0020] Decrypt the host fingerprint to obtain the MAC address and frame sequence number of the sender of the received SPRP message;

[0021] If the frame sequence number in the redundant check suffix is ​​consistent with the frame sequence number obtained by decrypting the host fingerprint, and the message corresponding to the frame sequence number has not been sent, the redundant check suffix and Ethernet header of the received SPRP message are stripped, and the message stripped of the redundant check suffix and Ethernet header is sent to the network layer;

[0022] If the frame sequence number in the redundant check suffix is ​​inconsistent with the frame sequence number obtained by decrypting the host fingerprint, and / or the SPRP message corresponding to the frame sequence number obtained by decrypting the host fingerprint has been sent, the received message is discarded.

[0023] In one or more embodiments of the present invention, the method further comprises:

[0024] After the SPRP message stripped of the redundant check suffix and Ethernet header is sent to the network layer, the sender MAC address and frame sequence number corresponding to the sent SPRP message are written into the preset table entry, and a mapping relationship between the sender MAC address and the frame sequence number is established.

[0025] In one or more embodiments of the present invention, the method further comprises:

[0026] If the frame sequence number of the redundant check suffix in the received SPRP message is consistent with the message frame sequence number obtained by decrypting the corresponding host fingerprint, then the preset table entry is indexed based on the sender MAC address of the received SPRP message;

[0027] If the index result contains a frame sequence number identical to that of the received SPRP message, the receiving end has sent the same SPRP message;

[0028] If the index result does not contain the same frame sequence number as the received SPRP message, the receiving end has not sent the same SPRP message.

[0029] In a third aspect, the present invention provides a three-layer network security transmission system, which applies the three-layer network security transmission method, and includes:

[0030] An encryption module, used to obtain a sender MAC address and a frame sequence number of a PRP message to be sent, and encrypt the sender MAC address and the frame sequence number of the PRP message to be sent to generate a host fingerprint;

[0031] An adding module, used to add the host fingerprint and the SPRP frame identifier to the redundant check suffix of the PRP message to be sent, and generate an SPRP message;

[0032] The sending module is used to add an Ethernet header to the SPRP message and send it out from multiple Ethernet cards.

[0033] In a fourth aspect, the present invention provides another three-layer network security transmission system, which applies the three-layer network security transmission method, and comprises:

[0034] An acquisition module is used to acquire the host fingerprint in the redundant check suffix of the received SPRP message;

[0035] A decryption module, used to decrypt the host fingerprint and obtain the MAC address and frame sequence number of the sender of the received SPRP message;

[0036] A first verification module is used for stripping the redundant check suffix and Ethernet header of the received SPRP message when the frame sequence number in the redundant check suffix is ​​consistent with the frame sequence number obtained by decrypting the host fingerprint, and the message corresponding to the frame sequence number has not been sent, and sending the message stripped of the redundant check suffix and Ethernet header to the network layer;

[0037] The second check module is used to discard the received message when the frame sequence number in the redundant check suffix is ​​inconsistent with the frame sequence number obtained by decrypting the host fingerprint, and / or when the SPRP message corresponding to the frame sequence number obtained by decrypting the host fingerprint is sent.

[0038] In a fifth aspect, the present invention provides a computer device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, computer instructions are stored in the memory, and the processor executes the three-layer network security transmission method by executing the computer instructions.

[0039] In a sixth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the three-layer network secure transmission method.

[0040] Compared with the prior art, the three-layer network security transmission method provided by the present invention sets a check field for carrying the MAC address of the sender, which will not be replaced in the three-layer network environment, thereby realizing the normal use of the PRP protocol; further, the frame sequence number and the MAC address of the message sender are encrypted to generate a host fingerprint. Since different messages have different frame sequence numbers, the host fingerprints of different messages change with the frame sequence numbers and cannot be forged, which ensures the reliable transmission of the MAC address of the sender, thereby realizing the reliability of message deduplication at the receiving end; on the other hand, at the receiving end, by comparing the frame sequence number obtained by decrypting the host fingerprint with the frame sequence number carried by the message check field, it can be determined whether there is an attacker who intercepts and replaces the message and other malicious operations. At the same time, the present invention is compatible with the existing PRP protocol, and can flexibly adjust the message transmission method based on the usage scenario, with extremely strong flexibility and adaptability. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1is a schematic diagram of a three-layer network security transmission scenario in one embodiment of the present invention;

[0043] Figure 2 is a schematic diagram of a process flow of a three-layer network security transmission method in one embodiment of the present invention;

[0044] Figure 3 is a structural block diagram of a three-layer network security transmission system in one embodiment of the present invention;

[0045] Figure 4 is a structural block diagram of an electronic device in one embodiment of the present invention;

[0046] Figure 5 is a schematic flow chart of a three-layer network security transmission method in another embodiment of the present invention;

[0047] Figure 6 It is a structural block diagram of a three-layer network secure transmission system in another embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to enable those skilled in the art to better understand the technical solutions in the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0049] Unless explicitly stated otherwise, throughout the specification and claims, the term “comprise” or variations such as “include” or “comprising”, etc., will be understood to include the stated elements or components but not to exclude other elements or components.

[0050] Under one technical scheme, there is a method for parallel redundant transmission with higher security, which specifically includes: configuring two logically or physically separated subnets, the sender copies the original information frame and adds a redundant check suffix to the two copied information frames, and sends the two identical information frames with the redundant check suffix from two ports respectively, passing through two independent subnets to reach the same receiver; after the receiver receives the two information frames from the two ports respectively, according to the principle of "first come, first served", the later arriving information frame is discarded, only the earlier arriving information frame is retained, and after removing the redundant check suffix, it is restored to an Ethernet frame and passed to the upper layer.

[0051] A key problem that this technical solution needs to solve in redundant transmission is deduplication at the receiving end. Since the receiving end will receive two identical frames, the received duplicate frames need to be discarded. A frame sequence number will be recorded in the redundant check suffix. When the receiving end receives a frame from the same sender with the same sequence number, the received frame will be discarded. However, in Ethernet, when three-layer communication is performed through a router, the source MAC in the Ethernet frame will be replaced with the MAC address of the router, making it impossible for the receiving end to distinguish which sender the frame comes from, resulting in the inability to deduplicate. Therefore, this technical solution is only applicable to message transmission in a two-layer network environment, and is subject to large environmental limitations and poor adaptability.

[0052] In another technical solution, the sender MAC can be recorded at the end of the information frame to be sent for deduplication. However, under this technical solution, since the sender MAC is recorded at the end of the frame as the basis for deduplication, and the source MAC recorded for each frame is the same, if a malicious attacker intercepts and forges the frame sequence number and sends the forged frame, when the receiver receives the forged frame, it cannot distinguish whether it comes from the real sender and receives the frame, which will cause the normal frame to be mistakenly deduplicated. Therefore, the security of this solution is extremely poor and can only be used in scenarios with high security and no risk of attack.

[0053] The inventor of the present invention has discovered the main shortcomings of the above technical solution, and based on the above shortcomings, has proposed a new technical implementation idea: a shared key is set between the sending end and the receiving end, and the frame sequence number and the sending end MAC address are encrypted at the sending end to form a host fingerprint. After the message with the host fingerprint is decrypted at the receiving end, it can be determined whether the message has been attacked during the transmission process based on the decrypted frame sequence number, and redundant messages can be deduplicated based on the decrypted sending end MAC address. A secure and reliable three-layer network transmission is achieved. At the same time, since the original PRP redundancy check suffix is ​​retained, this solution can be compatible with the above technical solution, further expanding the adaptability and flexibility of the solution.

[0054] Please refer to Figure 2 FIG. 1 is a schematic diagram of a process flow of three-layer network security transmission in one embodiment of the present invention. The three-layer network security transmission method specifically includes the following steps:

[0055] S201: Acquire a MAC address and a frame sequence number of a sender of a PRP message to be sent, and encrypt the MAC address and the frame sequence number of the sender of the PRP message to be sent to generate a host fingerprint;

[0056] It is understandable that the messages received by the receiving end may come from the same sender, that is, the MAC address of the sender carried by them is the same. For some encryption algorithms, if the content involved in encryption is the same, the configured encryption algorithm and / or key is the same, then the generated ciphertext is also the same. For the same ciphertext, malicious attackers can easily intercept and reverse crack the corresponding sender MAC address in the ciphertext. Therefore, if only the sender MAC address is encrypted, the transmission security is still low.

[0057] In order to solve the above problem, in an exemplary embodiment of the present invention, the sender MAC address and frame sequence number of the PRP message to be sent are selected to be encrypted together to generate a host fingerprint. The method specifically includes: arranging the frame sequence number of the message to be sent and the sender MAC address in sequence; based on the key shared with the receiving end, encrypting the frame sequence number of the message to be sent and the sender MAC address in sequence to generate a host fingerprint.

[0058] It is understandable that different messages correspond to different frame sequence numbers, so the corresponding encrypted host fingerprints are also different, and it is impossible to destroy the normal deduplication of the receiving end by forging the host fingerprint. It is ensured that during the transmission process, the receiving end can obtain the trusted MAC address of the message sender and the message frame sequence number. Based on this, the present invention can use the above-mentioned "encrypted content is the same, and the generated ciphertext is also the same" common encryption algorithm, that is, in the embodiment of the present invention, there is no restriction on the selection of encryption algorithm and decryption algorithm. Taking into account the conventional length of the frame sequence number and the sender MAC address, as well as the demand for encryption efficiency in the message transmission process, it is preferred to use encryption algorithms such as DES and AES.

[0059] On the other hand, after the receiving end decrypts the host fingerprint, it will read the decrypted information in sequence. Since the receiving end needs to first obtain the frame sequence number based on the host fingerprint to determine the security of the message, and then determine whether the current message has been sent based on the sender's MAC address. Therefore, in order to facilitate the operation of the receiving end and reduce the resource consumption caused by repeated reading, it is preferred to arrange the frame sequence number of the message to be sent and the sender's MAC address in the order of the receiving end operation during encryption, with the frame sequence number in front and the sender's MAC address in the back.

[0060] S202: Add the host fingerprint and the SPRP frame identifier to the redundant check suffix of the PRP message to be sent to generate an SPRP message;

[0061] It should be noted that, in order to improve the adaptability of the solution, the three-layer network security transmission method provided by the present invention is expected to be compatible with other data transmission methods such as the PRP protocol. To achieve this technical effect, the present invention retains the redundant check suffix under the PRP protocol and expands the redundant check suffix, such as Figure 1 Shown is a schematic diagram of the format of the redundant check suffix of the present invention.

[0062] Specifically, in order to transmit the sender MAC address to the receiver securely and reliably in a three-layer network environment, the host fingerprint generated based on the frame sequence number and the sender MAC needs to be added to the extended redundant check suffix. On the other hand, since the present invention is compatible with various message transmission methods, in an actual three-layer network environment, there may be messages with multiple different transmission methods, that is, different messages may correspond to different processing methods. Therefore, it is necessary to use frame identifiers to make the receiver clear about the subsequent processing flow that should be adopted for the received message. Therefore, the SPRP frame identifier needs to be added to the redundant check suffix to make the receiver clear that the current message is transmitted based on the three-layer network secure transmission method provided by the present invention.

[0063] S203: Adding an Ethernet header to the SPRP message, and sending it from multiple Ethernet cards;

[0064] It can be understood that after processing the message, the present invention also needs to send the message to be sent through multiple ports, passing through at least two independent subnets to reach the same receiving end. The receiving end retains the information frame that arrives first and discards the information frame that arrives later, thereby achieving reliable message transmission without packet loss.

[0065] Please refer to Figure 5 FIG. 2 is a flow chart of another embodiment of the present invention for secure transmission of a three-layer network. The three-layer network transmission method specifically includes the following steps:

[0066] S501: Obtain the host fingerprint in the redundant check suffix of the received SPRP message;

[0067] It should be noted that in actual application scenarios, before executing step S501 to obtain the host fingerprint in the redundant check suffix of the received SPRP message, the message type and subsequent processing flow should also be determined based on the frame identifier of the received message.

[0068] Specifically, if the received message does not have a PRP frame identifier, it means that the frame is not a PRP frame and does not need to be deduplicated. The frame can be directly processed as a standard Ethernet frame, and the Ethernet header can be stripped off and sent to the network layer; if the received message only has a PRP frame identifier but no SPRP frame identifier, it means that the frame is a standard PRP frame, and the source MAC address of the frame header can be directly extracted as an index to determine whether the same message has been sent up; if the received message contains both a PRP frame identifier and an SPRP frame identifier, it means that the frame is an information frame transmitted using the three-layer network security transmission method provided by the present invention.

[0069] For the message transmitted by the three-layer network security transmission method provided by the present invention, it is necessary to obtain the host fingerprint in the redundant check suffix. On the sending end side, the length of different fields is determined, and the host fingerprint can be extracted based on the location of the host fingerprint.

[0070] S502: decrypt the host fingerprint to obtain the MAC address and frame sequence number of the sender of the received SPRP message;

[0071] It should be noted that if the present invention uses a symmetric encryption algorithm, the key used for decryption is consistent with the key used by the sender for encryption; if the present invention uses an asymmetric encryption algorithm, the key used for decryption is inconsistent with the key used by the sender for encryption. The sender and the receiver should negotiate the encryption and decryption algorithms and the corresponding keys before the message is transmitted.

[0072] Compared with the two, the symmetric encryption algorithm has a small amount of calculation, fast encryption speed, and high encryption efficiency, but its security is slightly worse than that of the asymmetric encryption algorithm. At the same time, since the same receiving end may receive messages from multiple sending ends, it is more difficult to negotiate and match the key. The asymmetric encryption algorithm can make the public key public and only keep the private key of the receiving end confidential. Even if the ciphertext is intercepted and the public key is obtained, the private key cannot be obtained, and the ciphertext cannot be deciphered. It has extremely high security and is suitable for many-to-one transmission mode. However, the encryption algorithm of this scheme is complex, and the encryption and decryption efficiency is low.

[0073] S503: If the frame sequence number in the redundant check suffix is ​​consistent with the frame sequence number obtained by decrypting the host fingerprint, and the message corresponding to the frame sequence number has not been sent, the redundant check suffix and Ethernet header of the received SPRP message are stripped, and the message stripped of the redundant check suffix and Ethernet header is sent to the network layer;

[0074] It should be noted that the receiving end determines whether the same message has been sent based on the frame sequence number of the message. However, if a malicious attacker intercepts and forges the frame sequence number and sends the forged frame, when the receiving end receives the forged frame, it cannot distinguish whether it comes from the real sender and receives the frame, resulting in the normal frame being mistakenly deduplicated. Based on this, the present invention can compare the trusted frame sequence number obtained by decrypting the host fingerprint with the frame sequence number information carried by the original redundant check suffix to determine whether there is a malicious attacker.

[0075] Specifically, if the trusted frame sequence number obtained by decrypting the host fingerprint is the same as the frame sequence number carried by the original redundant check suffix, it is considered that the message has not been attacked during transmission, and it can continue to be determined whether a message with the same frame sequence number has been sent; if the trusted frame sequence number obtained by decrypting the host fingerprint is different from the frame sequence number carried by the original redundant check suffix, it means that the message has been maliciously attacked during transmission, resulting in a change in the frame sequence number in the redundant check suffix, or the message itself is a forged frame. At this time, the message content is no longer trustworthy and the message should be discarded.

[0076] It should be noted that the method also includes: after sending the SPRP message with the redundant check suffix and Ethernet header stripped off to the network layer, writing the sender MAC address and frame sequence number corresponding to the sent SPRP message into a preset table entry, and establishing a mapping relationship between the sender MAC address and the frame sequence number.

[0077] Since the same receiving end may communicate with multiple sending ends in a three-layer network environment, the sequence numbers of frames sent by each sending end may be different, so it is necessary to establish table entries for statistics. Based on the establishment of the above preset table entries, the sequence numbers of all message frames from the sending end sent by the receiving end can be indexed based on the trusted sending end MAC address. If the index result contains the same frame sequence number as the received SPRP message, the receiving end has sent the same SPRP message; if the index result does not contain the same frame sequence number as the received SPRP message, the receiving end has not sent the same SPRP message.

[0078] It can be understood that if a message with the same frame sequence number from the same sender has been uploaded, the currently received message should be discarded to avoid repeated uploading of the same message; if a message with the same frame sequence number from the same sender has not been uploaded, the redundant check suffix and Ethernet header should be stripped from the message and sent to the network layer.

[0079] S504: If the frame sequence number in the redundant check suffix is ​​inconsistent with the frame sequence number obtained by decrypting the host fingerprint, and / or the SPRP message corresponding to the frame sequence number obtained by decrypting the host fingerprint has been sent, the received message is discarded.

[0080] In order to further clarify the technical solution of the present invention, a specific embodiment is now given as follows:

[0081] On the sending side, the network layer first sends the IP message to the SPRP processing logic; the SPRP processing logic extracts the 6-byte sender MAC address and the 2-byte frame sequence number, puts the frame sequence number in front and the source MAC address in the back to form 8 bytes of data, encrypts the data with a pre-shared key, and generates an 8-byte host fingerprint. The host fingerprint is added to the end of the IP message, and a 2-byte hexadecimal number "88FC" is added after the MAC address as the SPRP identifier; the SPRP processing logic adds a 6-byte redundant check suffix after the SPRP identifier, including the sequence number, channel number, data length and a 2-byte hexadecimal number "88FB" as the standard PRP identifier; then the Ethernet header is added to the message to form an Ethernet frame and sent from two Ethernet cards DANP_A and DANP_B respectively.

[0082] On the receiving end, one of the Ethernet cards DANP_A and DANP_B receives the Ethernet frame and sends it to the SPRP processing logic; the SPRP processing logic checks whether there is a 2-byte hexadecimal number "88FB" standard PRP identifier at the end of the frame. If not, it means that the frame is not a PRP frame and does not need to be deduplicated. It is processed as a standard Ethernet frame and the Ethernet header is stripped and sent to the network layer; if it is a PRP frame, it checks whether the 7th to 8th bytes from the end are "88FC". If not, it means it is a standard PRP frame, then the frame header source MAC address is extracted as the index. If it is , then extract the host fingerprint of the 9th to 16th bytes starting from the end of the frame; use the pre-shared key to decrypt the host fingerprint; extract the first 2 bytes of the decrypted data and compare them with the frame sequence number. If the comparison is different, it means that the frame is a forged frame and the frame is discarded; if they are the same, use the last 6 bytes of the decrypted data as the source MAC, and use the MAC address as the index to query the sequence number of the frame sent by the sender; if the frame with the sequence number has been received, it means that the frame received at this time is a duplicate frame, and the frame is discarded; if the frame with the sequence number has not been received, the frame is stripped of the redundant check suffix and Ethernet header and sent to the network layer.

[0083] Please refer to Figure 3 As shown, based on the same inventive concept as the aforementioned three-layer network security transmission method, an embodiment of the present invention provides a three-layer network security transmission system 300, which includes: an encryption module 301, an adding module 302 and a sending module 303

[0084] Specifically, the encryption module 301 is used to obtain the sender MAC address and frame sequence number of the PRP message to be sent, and encrypt the sender MAC address and frame sequence number of the PRP message to be sent to generate a host fingerprint; the adding module 302 is used to add the host fingerprint and SPRP frame identifier to the redundant check suffix of the PRP message to be sent to generate an SPRP message; the sending module 303 is used to add an Ethernet header to the SPRP message, and send it from multiple Ethernet cards.

[0085] Please refer to Figure 6 As shown, based on the same inventive concept as the aforementioned three-layer network secure transmission method, another embodiment of the present invention provides another three-layer network secure transmission system 600, which includes: an acquisition module 601, a decryption module 602, a first verification module 603 and a second verification module 604.

[0086] Specifically, the acquisition module 601 is used to obtain the host fingerprint in the redundant check suffix of the received SPRP message; the decryption module 602 is used to decrypt the host fingerprint and obtain the MAC address and frame sequence number of the sender of the received SPRP message; the first verification module 603 is used to strip the redundant check suffix and Ethernet header of the received SPRP message when the frame sequence number in the redundant check suffix is ​​consistent with the frame sequence number obtained by decrypting the host fingerprint, and the message corresponding to the frame sequence number has not been sent up, and send the message stripped of the redundant check suffix and Ethernet header to the network layer; the second verification module 604 is used to discard the received message when the frame sequence number in the redundant check suffix is ​​inconsistent with the frame sequence number obtained by decrypting the host fingerprint, and / or the SPRP message corresponding to the frame sequence number obtained by decrypting the host fingerprint has been sent up.

[0087] Please refer to Figure 4 As shown, an embodiment of the present invention further provides an electronic device 400, which includes at least one processor 401, a memory 402 (e.g., a non-volatile memory), a memory 403, and a communication interface 404, and the at least one processor 401, the memory 402, the memory 403, and the communication interface 404 are connected together via an internal bus 405. At least one processor 401 is used to call at least one program instruction stored or encoded in the memory 402, so that the at least one processor 401 performs various operations and functions of the three-layer network security transmission method described in various embodiments of this specification.

[0088] In an embodiment of the present specification, the electronic device 400 may include, but is not limited to, a personal computer, a server computer, a workstation, a desktop computer, a laptop computer, a notebook computer, a mobile electronic device, a smart phone, a tablet computer, a cellular phone, a personal digital assistant (PDA), a handheld device, a messaging device, a wearable electronic device, a consumer electronic device, and the like.

[0089] An embodiment of the present invention also provides a computer-readable medium, which carries computer execution instructions. When the computer execution instructions are executed by a processor, they can be used to implement various operations and functions of the three-layer network security transmission method described in various embodiments of this specification.

[0090] The computer-readable medium in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device.

[0091] In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0092] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0093] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatuses, systems, and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as a combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process in the flowchart. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0094] The foregoing description of specific exemplary embodiments of the present invention is for the purpose of illustration and demonstration. These descriptions are not intended to limit the present invention to the precise form disclosed, and it is clear that many changes and variations can be made based on the above teachings. The purpose of selecting and describing the exemplary embodiments is to explain the specific principles of the present invention and its practical application, so that those skilled in the art can realize and utilize various different exemplary embodiments of the present invention and various different selections and changes. The scope of the present invention is intended to be limited by the claims and their equivalents.

[0095] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

[0096] In addition, it should be understood that although the present specification is described according to implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment may also be appropriately combined to form other implementation modes that can be understood by those skilled in the art.

Claims

1. A three-layer network security transmission method, characterized in that: include: Obtaining a MAC address and a frame sequence number of a sender of a PRP message to be sent, and encrypting the MAC address and the frame sequence number of the sender of the PRP message to be sent to generate a host fingerprint; Adding the host fingerprint and the SPRP frame identifier to the redundant check suffix of the PRP message to be sent to generate an SPRP message; An Ethernet header is added to the SPRP message, and the message is sent out from multiple Ethernet cards.

2. The three-layer network security transmission method according to claim 1 is characterized in that: Adding the host fingerprint and SPRP frame identifier includes: The SPRP frame identifier and the host fingerprint are spliced ​​in a preset order, and after the frame sequence number is inserted into the redundant check suffix, the redundant check suffix includes the PRP frame identifier, frame length, channel number and frame sequence number.

3. The three-layer network secure transmission method according to claim 1, characterized in that: Encrypting the MAC address of the sender and the frame sequence number of the PRP message to be sent to generate a host fingerprint, including: Arrange the frame sequence numbers of the messages to be sent and the MAC addresses of the senders in order; Based on the key shared with the receiving end, the frame sequence number of the message to be sent and the MAC address of the sending end are encrypted in sequence to generate a host fingerprint.

4. A three-layer network security transmission method, characterized in that: include: Obtain the host fingerprint in the redundant check suffix of the received SPRP message; Decrypt the host fingerprint to obtain the MAC address and frame sequence number of the sender of the received SPRP message; If the frame sequence number in the redundant check suffix is ​​consistent with the frame sequence number obtained by decrypting the host fingerprint, and the message corresponding to the frame sequence number has not been sent, the redundant check suffix and Ethernet header of the received SPRP message are stripped, and the message stripped of the redundant check suffix and Ethernet header is sent to the network layer; If the frame sequence number in the redundant check suffix is ​​inconsistent with the frame sequence number obtained by decrypting the host fingerprint, and / or the SPRP message corresponding to the frame sequence number obtained by decrypting the host fingerprint has been sent, the received message is discarded.

5. The three-layer network secure transmission method according to claim 4, characterized in that: The method further comprises: After the SPRP message stripped of the redundant check suffix and Ethernet header is sent to the network layer, the sender MAC address and frame sequence number corresponding to the sent SPRP message are written into the preset table entry, and a mapping relationship between the sender MAC address and the frame sequence number is established.

6. The three-layer network secure transmission method according to claim 5, characterized in that: The method further comprises: If the frame sequence number of the redundant check suffix in the received SPRP message is consistent with the message frame sequence number obtained by decrypting the corresponding host fingerprint, then the preset table entry is indexed based on the sender MAC address of the received SPRP message; If the index result contains a frame sequence number identical to that of the received SPRP message, the receiving end has sent the same SPRP message; If the index result does not contain the same frame sequence number as the received SPRP message, the receiving end has not sent the same SPRP message.

7. A three-layer network security transmission system, using the three-layer network security transmission method according to any one of claims 1 to 3, characterized in that: include: An encryption module, used to obtain a sender MAC address and a frame sequence number of a PRP message to be sent, and encrypt the sender MAC address and the frame sequence number of the PRP message to be sent to generate a host fingerprint; An adding module, used to add the host fingerprint and the SPRP frame identifier to the redundant check suffix of the PRP message to be sent, and generate an SPRP message; The sending module is used to add an Ethernet header to the SPRP message and send it out from multiple Ethernet cards.

8. A three-layer network security transmission system, using the three-layer network security transmission method according to any one of claims 4 to 6, characterized in that: include: An acquisition module is used to acquire the host fingerprint in the redundant check suffix of the received SPRP message; A decryption module, used to decrypt the host fingerprint and obtain the MAC address and frame sequence number of the sender of the received SPRP message; A first verification module is used for stripping the redundant check suffix and Ethernet header of the received SPRP message when the frame sequence number in the redundant check suffix is ​​consistent with the frame sequence number obtained by decrypting the host fingerprint, and the message corresponding to the frame sequence number has not been sent, and sending the message stripped of the redundant check suffix and Ethernet header to the network layer; The second check module is used to discard the received message when the frame sequence number in the redundant check suffix is ​​inconsistent with the frame sequence number obtained by decrypting the host fingerprint, and / or when the SPRP message corresponding to the frame sequence number obtained by decrypting the host fingerprint is sent.

9. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the three-layer network security transmission method described in any one of claims 1-6 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the three-layer network secure transmission method according to any one of claims 1 to 6.

Images