Data transmission method, data sending device and data receiving device

Abstract

The invention discloses a data transmission method, data sending equipment, data receiving equipment, a reverse isolation device, a power system and a computer readable storage medium, and belongs to the technical field of data transmission. The data transmission method comprises the following steps: acquiring a first data packet; determining a corresponding compression strategy according to the size of the first data packet; compressing the first data packet according to a compression strategy to obtain a second data packet; encrypting and signing the second data packet to obtain a third data packet; and sending the third data packet to a data receiving device. Therefore, the transmission rate of the data packets is improved, the influence of the encryption operation on the data transmission performance is reduced, the compression time of the first data packets with different sizes is controlled within a reasonable range, and the influence of too long compression time on the data transmission performance of the reverse isolation device is prevented.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and in particular to a data transmission method, a data sending device, a data receiving device, a reverse isolation device, a power system and a computer-readable storage medium. Background Art

[0002] In the power system, there is a need to access data from the low security area to the high security area. In order to ensure the safety, efficiency and reliability of the access communication, it is necessary to install a one-way isolation safety protection device at the boundary between the low security area and the high security area. Among them, the reverse isolation device is used to transmit data from the low security area to the high security area. Since the reverse transmission not only requires verification of the data format, but also encryption of the data message, the transmission performance is reduced. Therefore, how to reduce the impact of encryption on transmission performance is an urgent problem to be solved. Summary of the invention

[0003] The embodiments of the present invention provide a data transmission method, a data sending device, a data receiving device, a reverse isolation device, a power system and a computer-readable storage medium to solve at least one of the above-mentioned technical problems.

[0004] The data transmission method of the embodiment of the present invention is applied to a data sending device of a reverse isolation device, wherein the reverse isolation device further comprises a data receiving device, wherein the data sending device is communicatively connected to the data receiving device, and the data receiving device is connected to an application service device, wherein the data transmission method comprises: Get the first data packet; Determining a corresponding compression strategy according to the size of the first data packet; Compressing the first data packet according to the compression strategy to obtain a second data packet; Performing encryption and signing on the second data packet to obtain a third data packet; The third data packet is sent to the data receiving device so that the data receiving device: performs signature verification and decryption on the third data packet to obtain a fourth data packet; decompresses the fourth data packet according to the compression strategy to obtain a fifth data packet; and sends the fifth data packet to the application service device.

[0005] In some implementations, before determining the corresponding compression strategy according to the size of the first data packet, the data transmission method further includes: Determining whether the size of the first data packet is greater than or equal to a data packet size threshold; When the size of the first data packet is greater than or equal to the data packet size threshold, determining that the first data packet needs to be compressed; When the size of the first data packet is smaller than the data packet size threshold, it is determined that the first data packet does not need to be compressed.

[0006] In some implementations, before determining whether the size of the first data packet is greater than or equal to a data packet size threshold, the data transmission method further includes: Perform encryption signing and signature verification and decryption on multiple test data packets of different sizes, and record the first encryption signing time and the first signature verification and decryption time; Compress, encrypt, sign, verify, decrypt and decompress the test data packets of multiple different sizes, and record the first compression time, the second encryption signing time, the second verification and decryption time and the first decompression time; The data packet size threshold is determined according to the first encryption signing time, the first signature verification and decryption time, the first compression time, the second encryption signing time, the second signature verification and decryption time, and the first decompression time corresponding to each of the test data packets.

[0007] In some implementations, determining the data packet size threshold according to the first encryption signing time, the first signature verification and decryption time, the first compression time, the second encryption signing time, the second signature verification and decryption time, and the first decompression time corresponding to each of the test data packets includes: Determine whether the first encryption signing time, the first signature verification and decryption time, the first compression time, the second encryption signing time, the second signature verification and decryption time, and the first decompression time corresponding to each of the test data packets meet predetermined evaluation indicators; Determining the data packet size threshold according to the size of the test data packet that meets the predetermined evaluation index; The predetermined evaluation indicators include: The difference between the first compression time and the encryption signature time difference is less than a first preset threshold, and the encryption signature time difference is the difference between the first encryption signature time and the second encryption signature time; The difference between the first decompression time and the signature verification and decryption time difference is less than a second preset threshold, and the signature verification and decryption time difference is the difference between the first signature verification and decryption time and the second signature verification and decryption time.

[0008] In some implementations, the compression strategy includes a compression control parameter, and determining the corresponding compression strategy according to the size of the first data packet includes: When the first data packet needs to be compressed, determining the corresponding compression control parameter according to the size of the first data packet, wherein the compression control parameter is positively correlated with the size of the first data packet; The compressing the first data packet according to the compression strategy to obtain a second data packet includes: compressing the first data packet according to the compression control parameter to obtain the second data packet; The data transmission method further comprises: When there is no need to compress the first data packet, the first data packet is used as the second data packet.

[0009] In some implementations, before compressing the first data packet according to the compression control parameter to obtain the second data packet, the data transmission method further includes: Obtain multiple candidate compression algorithms; Performing compression performance tests on the multiple candidate compression algorithms to determine the preset compression algorithm; The compressing the first data packet according to the compression control parameter to obtain the second data packet includes: The first data packet is compressed using the preset compression algorithm according to the compression control parameters to obtain the second data packet.

[0010] In some implementations, the encrypting and signing the second data packet to obtain a third data packet includes: encrypting the second data packet to obtain an encrypted data packet; Performing hash value calculation on the second data packet to determine a first signature of the second data packet; The encrypted data packet and the first signature are encapsulated according to a custom private protocol to obtain the third data packet.

[0011] The data transmission method of the embodiment of the present invention is applied to a data receiving device of a reverse isolation device, wherein the reverse isolation device further comprises a data sending device, wherein the data receiving device is respectively connected to the data sending device and the application service device for communication, and the data transmission method comprises: receiving a third data packet sent by the data sending device, the third data packet originating from the data sending device: obtaining a first data packet; determining a corresponding compression strategy according to a size of the first data packet; compressing the first data packet according to the compression strategy to obtain a second data packet; and encrypting and signing the second data packet to obtain the third data packet; Performing signature verification and decryption on the third data packet to obtain a fourth data packet; decompressing the fourth data packet according to the compression strategy to obtain a fifth data packet; The fifth data packet is sent to the application service device.

[0012] In some implementations, the performing signature verification and decryption on the third data packet to obtain a fourth data packet includes: Parsing the third data packet according to a custom private protocol to obtain a parsed data packet and a first signature; Decrypting the parsed data packet to obtain a decrypted data packet; Performing hash value calculation on the decrypted data packet to determine a second signature of the decrypted data packet; Determining whether the first signature is identical to the second signature; When the first signature is identical to the second signature, the decrypted data packet is determined to be qualified, and the decrypted data packet is used as the fourth data packet.

[0013] In some implementations, the compression strategy includes a compression control parameter, and decompressing the fourth data packet according to the compression strategy to obtain the fifth data packet includes: Determining whether the fourth data packet needs to be decompressed; When the fourth data packet needs to be decompressed, decompress the fourth data packet according to the compression control parameter to obtain the fifth data packet; The data transmission method further comprises: When the fourth data packet does not need to be decompressed, the fourth data packet is used as the fifth data packet.

[0014] The data sending device of the embodiment of the present invention is applied to a reverse isolation device, the reverse isolation device also includes a data receiving device, the data sending device is communicatively connected with the data receiving device, the data receiving device is connected with an application service device, and the data sending device includes: An acquisition module, used for acquiring a first data packet; A determination module, configured to determine a corresponding compression strategy according to the size of the first data packet; A compression module, configured to compress the first data packet according to the compression strategy to obtain a second data packet; An encryption signature module, used for performing encryption signature on the second data packet to obtain a third data packet; The first sending module is used to send the third data packet to the data receiving device, so that the data receiving device: verifies and decrypts the third data packet to obtain a fourth data packet; decompresses the fourth data packet according to the compression strategy to obtain a fifth data packet; verifies the fifth data packet, and sends the verified fifth data packet to the application service device.

[0015] The data receiving device of the embodiment of the present invention is applied to the reverse isolation device, and the reverse isolation device also includes a data sending device, and the data receiving device is respectively connected to the data sending device and the application service device for communication, and the data receiving device includes: A receiving module, configured to receive a third data packet sent by the data sending device, the third data packet originating from the data sending device: obtaining a first data packet; determining a corresponding compression strategy according to a size of the first data packet; compressing the first data packet according to the compression strategy to obtain a second data packet; and encrypting and signing the second data packet to obtain a third data packet; a signature verification and decryption module, configured to perform signature verification and decryption on the third data packet to obtain a fourth data packet; a decompression module, configured to decompress the fourth data packet according to the compression strategy to obtain a fifth data packet; The second sending module is used to send the fifth data packet to the application service device.

[0016] The reverse isolation device of the embodiment of the present invention comprises one or more processors and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the data transmission method of any of the above embodiments is implemented.

[0017] The power system according to the embodiment of the present invention comprises the reverse isolation device according to any one of the above embodiments.

[0018] The computer-readable storage medium of the embodiment of the present invention stores a computer program thereon, and when the program is executed by a processor, the data transmission method of any of the above embodiments is implemented.

[0019] In the data transmission method, data transmission device, data receiving device, reverse isolation device, power system and computer-readable storage medium of the embodiment of the present invention, the first data packet is compressed and then encrypted and signed to obtain a third data packet, and the compression strategy is determined according to the size of the first data packet. In this way, the transmission rate of the data packet is improved, and while reducing the impact of the encryption operation on the data transmission performance, the compression time of the first data packets of different sizes is controlled within a reasonable range, preventing the data transmission performance of the reverse isolation device from being affected by the long compression time.

[0020] Additional aspects and advantages of the embodiments of the present invention will be given in part in the following description and in part will become apparent from the following description or will be learned through the practice of the embodiments of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The above and / or additional aspects and advantages of the present invention will become apparent and easily understood from the description of the embodiments in conjunction with the following drawings, in which: Figure 1 is a flowchart of a data transmission method according to certain embodiments of the present invention; Figure 2 is a schematic diagram of a module of a reverse isolation device according to some embodiments of the present invention; Figure 3 is a flow chart of a data transmission method according to certain embodiments of the present invention; Figure 4 is a schematic diagram of a module of a power system according to some embodiments of the present invention; Figure 5 is a flowchart of a data transmission method according to certain embodiments of the present invention; Figure 6 is a flowchart of a data transmission method according to certain embodiments of the present invention; Figure 7 is a flowchart of a data transmission method according to certain embodiments of the present invention; Figure 8 is a flow chart of a data transmission method according to certain embodiments of the present invention; Fig. 9 is a flow chart of a data transmission method according to certain embodiments of the present invention; Fig.10 is a flowchart of a data transmission method according to certain embodiments of the present invention; Fig.11 is a flowchart of a data transmission method according to certain embodiments of the present invention; Fig.12 is a flowchart of a data transmission method according to certain embodiments of the present invention; Fig.13 is a flowchart of a data transmission method according to certain embodiments of the present invention; Fig.14 is a flowchart of a data transmission method according to certain embodiments of the present invention; Fig.15 It is a schematic diagram comparing the transmission performance of 1KB data packets in different isolation devices; Fig.16 It is a schematic diagram comparing the transmission performance of 2KB data packets in different isolation devices; Fig.17 It is a schematic diagram comparing the transmission performance of 4KB data packets in different isolation devices; Fig.18 It is a schematic diagram comparing the transmission performance of 8KB data packets in different isolation devices; Fig.19It is a schematic diagram comparing the transmission performance of 16KB data packets in different isolation devices; Fig. 20 It is a schematic diagram comparing the transmission performance of 32KB data packets in different isolation devices; Fig.21 It is a schematic diagram comparing the transmission performance of 63KB data packets in different isolation devices; Fig. 22 is a schematic diagram of a module of a data sending device in some embodiments of the present invention; Fig.23 is a schematic diagram of a module of a data sending device in some embodiments of the present invention; Fig.24 is a schematic diagram of a module for data reception in certain embodiments of the present invention; Fig.25 is a schematic diagram of a module of a reverse isolation device according to some embodiments of the present invention; Fig.26 It is a schematic diagram of the connection status between a computer-readable storage medium and a processor in certain embodiments of the present invention. DETAILED DESCRIPTION

[0022] The embodiments of the present invention are further described below in conjunction with the accompanying drawings. The same or similar reference numerals in the accompanying drawings represent the same or similar elements or elements with the same or similar functions from beginning to end. In addition, the embodiments of the present invention described below in conjunction with the accompanying drawings are exemplary and are only used to explain the embodiments of the present invention, and cannot be understood as limiting the present invention.

[0023] See also Figures 1 to 3 The embodiment of the present invention provides a data transmission method, which is applied to a data sending device 100 of a reverse isolation device 300. The reverse isolation device 300 also includes a data receiving device 200, the data sending device 100 is communicatively connected to the data receiving device 200, and the data receiving device 200 is connected to an application service device. The data transmission method includes: S101: Acquire a first data packet; S102: Determine a corresponding compression strategy according to the size of the first data packet; S103: compressing the first data packet according to the compression strategy to obtain a second data packet; S104: Encrypt and sign the second data packet to obtain a third data packet; S105: Send the third data packet to the data receiving device 200, so that the data receiving device 200: verify and decrypt the third data packet to obtain a fourth data packet; decompress the fourth data packet according to the compression strategy to obtain a fifth data packet; and send the fifth data packet to the application service device.

[0024] In the data transmission method of the embodiment of the present invention, the first data packet is compressed and then encrypted and signed to obtain a third data packet, and the compression strategy is determined according to the size of the first data packet. In this way, the transmission rate of the data packet is improved, and while reducing the impact of the encryption and signature operation on the data transmission performance, the compression time of the first data packets of different sizes is controlled within a reasonable range, preventing the data transmission performance of the reverse isolation device 300 from being affected by the long compression time.

[0025] Specifically, Figure 4 As shown, the reverse isolation device 300 may be an isolation device of the power system 400, used to transmit data from a low security area to a high security area of ​​the power system 400. Figure 2 As shown, the reverse isolation device 300 includes a data transmission device 100 and a data receiving device 200. The data transmission device 100 can be set in a low security area to obtain data packets in the low security area. The data receiving device 200 can be set in a high security area and communicate with the data transmission device 100 to receive data packets sent by the data transmission device 100. The data receiving device 200 is also communicated with the application service device to send the received data packets to the application service device. The application service device can receive the data packets and further process and analyze the data packets according to the business needs of the power system 400.

[0026] The data processing and transmission process of the data sending device 100 is described in detail below. The data sending device 100 obtains a data packet that needs to be transmitted in the low security zone, that is, a first data packet. The number of first data packets can be one or more. After obtaining the first data packet, a data format check can be performed on the first data packet to prevent abnormal data packets that do not conform to the data format from being transmitted to other devices. After the format check is completed, the compression strategy corresponding to each first data packet can be determined according to the size of each first data packet. In other words, different compression strategies can be used for first data packets of different sizes.

[0027] It can be understood that when the same compression strategy is adopted, the compression time of first data packets of different sizes is different, and the compression time is positively correlated with the size of the first data packet. Therefore, different compression strategies are adopted to compress first data packets of different sizes, and the compression time of first data packets of different sizes is controlled within a reasonable range to prevent the data transmission performance of the reverse isolation device 300 from being affected by too long compression time.

[0028] The first data packet is compressed according to the compression strategy to obtain a second data packet. The second data packet is encrypted and signed to obtain a third data packet. After obtaining the third data packet, the third data packet can be sent to the data receiving device 200. After receiving the third data packet, the data receiving device 200 can verify the signature and decrypt the third data packet to obtain a fourth data packet. The fourth data packet is then decompressed according to the compression strategy to obtain a fifth data packet. Finally, the fifth data packet is sent to the application service device.

[0029] In the related art, data packets are directly encrypted before transmission, and encryption requires the execution of complex algorithms, which increases the computational complexity, reduces the processing speed, and increases the amount of data to be transmitted. When transmitting large amounts of data, there is a problem of insufficient performance.

[0030] In an embodiment of the present invention, the first data packet obtained is compressed before encryption and signing. By compression, the amount of data that needs to be encrypted and signed is reduced, which can effectively improve the speed of encryption and signing. The third data packet obtained by first compressing and then encrypting and signing has less data than the data packet obtained by direct encryption. In this way, the transmission rate of the reverse isolation device 300 can be improved, and the impact of the encryption operation on the data transmission performance can be reduced; under the same physical environment and network bandwidth, the data transmission performance of the reverse isolation device 300 can be effectively improved without changing the hardware configuration of the reverse isolation device 300.

[0031] See also Figure 3 and Figure 5 In some implementations, before determining the corresponding compression strategy according to the size of the first data packet (ie, S102), the data transmission method further includes: S107: Determine whether the size of the first data packet is greater than or equal to a data packet size threshold; S108: When the size of the first data packet is greater than or equal to the data packet size threshold, determine that the first data packet needs to be compressed; S109: When the size of the first data packet is smaller than the data packet size threshold, determine that the first data packet does not need to be compressed.

[0032] Specifically, before determining the corresponding compression strategy according to the size of the first data packet, it is necessary to first determine whether the first data packet needs to be compressed. The determination can be made according to the size of the first data packet and a data packet size threshold.

[0033] A preset data packet size threshold is obtained, and it is determined whether the size of the first data packet is greater than or equal to the data packet size threshold. When the size of the first data packet is greater than or equal to the data packet size threshold, it is determined that the first data packet needs to be compressed. When the size of the first data packet is less than the data packet size threshold, it is determined that the first data packet does not need to be compressed. In other words, only the first data packet with a larger size is compressed, and the first data packet with a smaller size is not compressed.

[0034] It can be understood that for a first data packet of a smaller size, the amount of data reduced by compression is small, the effect of improving the encryption signature speed is not obvious, and compression will take a certain amount of time, and thus the improvement of data transmission performance is not obvious. Therefore, there is no need to compress the first data packet of a smaller size, so that the data processing process can be simplified, the consumption of computing resources can be reduced, and the overall performance of the reverse isolation device 300 can be optimized.

[0035] The specific process of determining the data packet size threshold is described in detail below.

[0036] See also Figure 6 In some embodiments, before determining whether the size of the first data packet is greater than or equal to the data packet size threshold (ie, S107), the data transmission method further includes: S110: Perform encryption signing and signature verification and decryption on multiple test data packets of different sizes, and record a first encryption signing time and a first signature verification and decryption time; S111: compress, encrypt, sign, verify, decrypt and decompress multiple test data packets of different sizes, and record the first compression time, the second encryption signing time, the second verification and decryption time and the first decompression time; S112: Determine a data packet size threshold according to the first encryption signing time, the first signature verification and decryption time, the first compression time, the second encryption signing time, the second signature verification and decryption time, and the first decompression time corresponding to each test data packet.

[0037] Specifically, before data transmission, a plurality of test data packets with different sizes may be used for testing to determine a data packet size threshold.

[0038] Obtain multiple test data packets of different sizes, and perform encryption signing and signature verification and decryption on each test data packet in turn. Record the encryption signing time as the first encryption signing time, and record the signature verification and decryption time as the first signature verification and decryption time. Then compress, encrypt, sign, verify and decrypt, and decompress each test data packet in turn, record the compression time as the first compression time, record the encryption signing time as the second encryption signing time, record the signature verification and decryption time as the second signature verification and decryption time, and record the decompression time as the second decompression time.

[0039] According to the first encryption signature time, the first signature verification and decryption time, the first compression time, the second encryption signature time, the second signature verification and decryption time, and the first decompression time corresponding to each test data packet, the relationship between the compression time and the encryption signature time, as well as the relationship between the decompression time and the signature verification and decryption time of data packets of different sizes can be evaluated; thus, according to the relationship between the compression time and the encryption signature time, as well as the relationship between the decompression time and the signature verification and decryption time, an appropriate data packet size threshold can be determined. In this way, the first data packets that need to be compressed and those that do not need to be compressed can be divided more accurately.

[0040] See also Figure 7 In some implementations, determining a data packet size threshold (i.e., S112) according to a first encryption signing time, a first signature verification and decryption time, a first compression time, a second encryption signing time, a second signature verification and decryption time, and a first decompression time corresponding to each test data packet includes: S1121: Determine whether the first encryption signing time, the first signature verification and decryption time, the first compression time, the second encryption signing time, the second signature verification and decryption time, and the first decompression time corresponding to each test data packet meet predetermined evaluation indicators; S1122: Determine a data packet size threshold according to the size of a test data packet that meets a predetermined evaluation index; The predetermined evaluation indicators include: The difference between the first compression time and the encryption signature time difference is less than a first preset threshold, and the encryption signature time difference is the difference between the first encryption signature time and the second encryption signature time; The difference between the first decompression time and the signature verification and decryption time difference is less than a second preset threshold, and the signature verification and decryption time difference is the difference between the first signature verification and decryption time and the second signature verification and decryption time.

[0041] Specifically, the difference between the first encryption signature time and the second encryption signature time corresponding to each test data packet is calculated to obtain the corresponding encryption signature time difference. The difference between the first signature verification and decryption time and the second signature verification and decryption time corresponding to each test data packet is calculated to obtain the corresponding signature verification and decryption time difference.

[0042] Determine whether the first compression time, encryption signature time difference, first decompression time, and signature verification and decryption time difference corresponding to each test data packet meet the predetermined evaluation indicators. The predetermined evaluation indicators include that the difference between the first compression time and the encryption signature time difference is less than the first preset threshold, and the difference between the first decompression time and the signature verification and decryption time difference is less than the second preset threshold. Among them, the first preset threshold and the second preset threshold can be the same or different, and the specific value can be set according to the actual situation, which is not limited here.

[0043] For example, the first preset threshold and the second preset threshold can be set to positive numbers approaching zero, then the difference between the first compression time and the encryption signature time difference is less than the first preset threshold, including: the first compression time is less than or equal to the encryption signature time difference, and the first compression time is greater than the encryption signature time difference and the difference between the first compression time and the encryption signature time difference is approaching zero. The difference between the first decompression time and the signature verification and decryption time difference is less than the second preset threshold, including: the first decompression time is less than or equal to the signature verification and decryption time difference, and the first decompression time is greater than the signature verification and decryption time difference and the difference between the first decompression time and the signature verification and decryption time difference is approaching zero. Of course, the first preset threshold and the second preset threshold can be set to zero.

[0044] The sizes of the test data packets that meet the predetermined evaluation index are counted, and the size of the test data packet with the smallest size that meets the predetermined evaluation index can be used as the data packet size threshold.

[0045] See also Figure 3 and Figure 8 In some embodiments, the compression strategy includes a compression control parameter. Determining a corresponding compression strategy according to the size of the first data packet (ie, S102) includes: S1021: When the first data packet needs to be compressed, determine a corresponding compression control parameter according to the size of the first data packet, wherein the compression control parameter is positively correlated with the size of the first data packet; At this time, the first data packet is compressed according to the compression strategy to obtain a second data packet (ie, S103), including: S1031: compressing the first data packet according to the compression control parameter to obtain a second data packet; At this time, the data transmission method further includes: S113: When there is no need to compress the first data packet, use the first data packet as the second data packet.

[0046] Specifically, the compression strategy includes compression control parameters. When the first data packet needs to be compressed, the corresponding compression control parameters are first determined according to the size of the first data packet. The compression control parameters may include a compression ratio.

[0047] In one example, multiple test data packets of different sizes are encrypted, signed, verified, and decrypted, and the third encryption signing time and the fourth verification and decryption time are recorded. Multiple test data packets of different sizes are compressed, encrypted, signed, verified, decrypted, and decompressed according to different compression ratios, and the second compression time, the fourth encryption signing time, the fourth verification and decryption time, and the second decompression time are recorded. According to the third encryption signing time, the third verification and decryption time, the second compression time, the fourth encryption signing time, the fourth verification and decompression time, and the second decompression time corresponding to each test data packet, the compression control parameters corresponding to the test data packets of different sizes are determined.

[0048] The difference between the third encryption signature time and the fourth encryption signature time corresponding to each test data packet is calculated to obtain the corresponding encryption signature time difference. The difference between the third signature verification and decryption time and the fourth signature verification and decryption time corresponding to each test data packet is calculated to obtain the corresponding signature verification and decryption time difference.

[0049] Determine whether the second compression time, encryption signature time difference, second decompression time and signature verification and decryption time difference corresponding to each test data packet meet the parameter evaluation index. The parameter evaluation index includes that the absolute value of the difference between the second compression time and the encryption signature time difference is less than the third preset threshold. The third preset threshold can be set according to actual conditions and is not limited here. For example, the third preset threshold can be set to a value close to zero, that is, the parameter evaluation index includes: second compression time ≈ encryption signature time difference. In this way, the overall time consumption of data transmission will not be increased.

[0050] The parameter evaluation index also includes that the absolute value of the difference between the second decompression time and the signature verification and decryption time difference is less than a fourth preset threshold. The fourth preset threshold can be set according to actual conditions and is not limited here. The fourth preset threshold may be the same as the third preset threshold or may be different. The fourth preset threshold may be set to a value close to zero, that is, the parameter evaluation index includes: the second decompression time ≈ the signature verification and decryption time difference. In this way, the overall time consumption of data transmission will not be increased.

[0051] For each test compression packet, a corresponding compression ratio can be determined according to the parameter evaluation index, and the compression ratio is the compression control parameter corresponding to the size of the test compression packet. For multiple test data packets of different sizes, a compression ratio can be determined respectively, so as to obtain the compression control parameter corresponding to each size. In one example, the compression ratio ranges from 2:1 to 3:1.

[0052] The corresponding compression control parameter can be determined according to the size of the first data packet. The first data packet is compressed according to the compression control parameter to obtain a second data packet. According to research, it is found that the compression control parameter is positively correlated with the size of the first data packet. When the size of the first data packet is small, the determined compression control parameter is small, so that the first data packet can be compressed faster. When the size of the first data packet is large, the determined compression control parameter is large, so that the amount of data in the second data packet after compression is smaller, and the transmission rate is faster in the subsequent transmission process.

[0053] In some implementations, the compression control parameter is determined according to a transmission strategy model, which is shown in the following formula:

[0054] Where Q represents the device throughput. Indicates the compression control parameter (ie, compression ratio). Indicates the transmission time difference, . , Indicates the compression time, Indicates the decompression time. , Indicates the encryption signature time, Indicates the signature verification and decryption time. It can be understood that when the compression control parameters satisfy the above transmission strategy model, the transmission performance can be effectively improved.

[0055] In the embodiment of the present invention, the first data packet is compressed according to a compression control parameter that is positively correlated with the size of the first data packet, and the compression control parameter can be determined according to the parameter evaluation index. In this way, the compression time of the first data packets of different sizes can be controlled within a reasonable range, and the data transmission performance of the reverse isolation device 300 can be optimized without changing the hardware configuration at the same time.

[0056] In addition, when there is no need to compress the first data packet, the first data packet can be directly used as the second data packet.

[0057] See also Fig. 9 In some embodiments, before compressing the first data packet according to the compression control parameter to obtain the second data packet (ie, S103), the data transmission method further includes: S114: Acquire multiple candidate compression algorithms; S115: Perform compression performance tests on multiple candidate compression algorithms to determine a preset compression algorithm; At this time, the first data packet is compressed according to the compression control parameter to obtain a second data packet (ie, S1031), including: S10311: Compress the first data packet using a preset compression algorithm according to the compression control parameters to obtain a second data packet.

[0058] Specifically, before compressing the first data packet, a compression algorithm needs to be determined. A plurality of candidate compression algorithms may be obtained first, and compression performance tests may be performed on the plurality of candidate compression algorithms. The plurality of compression algorithms may include any plurality of compression algorithms such as LZ4 compression algorithm, Zstandard (Zstd) compression algorithm, Snappy compression algorithm, Brotli compression algorithm, Gzip compression algorithm, Bzip2 compression algorithm, LZMA compression algorithm (such as 7-Zip compression algorithm) or Zlib compression algorithm, and no limitation is made here.

[0059] Compression performance test, for example: using multiple candidate compression algorithms to compress and decompress test data packets of the same size, and record the third compression time, the third decompression time, and the compression loss. The third compression time, the third decompression time, and the compression loss can all be used as evaluation indicators of compression performance. The third compression time, the third decompression time, and the compression loss of multiple candidate compression algorithms are compared, and the candidate compression algorithm with the best compression performance is comprehensively determined as the preset compression algorithm.

[0060] It is also possible to use multiple candidate compression algorithms to compress and decompress multiple test data packets of different sizes to perform compression performance testing and determine a preset compression algorithm. In this way, an efficient and lossless preset compression algorithm can be determined to avoid the compression operation from having an adverse effect on data transmission performance.

[0061] In one example, for test data packets of different sizes, the compression performance of the LZ4 compression algorithm is the best, so the LZ4 compression algorithm is selected as the preset compression algorithm.

[0062] See also Figure 3 and Fig.10 In some implementations, encrypting and signing the second data packet to obtain a third data packet (ie, S104) includes: S1041: Encrypt the second data packet to obtain an encrypted data packet; S1042: Calculate a hash value for the second data packet to determine a first signature for the second data packet; S1043: Encapsulate the encrypted data packet and the first signature according to a custom private protocol to obtain a third data packet.

[0063] Specifically, any national secret encryption algorithm may be used to encrypt the second data packet to obtain an encrypted data packet. National secret encryption algorithms include SM1 encryption algorithm, SM4 encryption algorithm, etc. In one example, the SM4 encryption algorithm is used to encrypt the second data packet.

[0064] The second data packet also needs to be integrity protected, and the specific process is as follows: a hash value is calculated for the second data packet, and the calculated hash value can be used as the first signature of the second data packet. The first signature is used for integrity verification in the data receiving device 200 (which will be described in detail later).

[0065] Afterwards, the encrypted data packet and the first signature are encapsulated according to the custom private protocol to obtain the third data packet. The custom private protocol root can be set according to actual application requirements. Compared with the public protocol, the security and reliability of communication can be guaranteed.

[0066] The data processing and transmission process of the data receiving device 200 is described in detail below.

[0067] See also Figure 2 , Fig.11 and Fig.12 The embodiment of the present invention also provides a data transmission method, which is applied to the data receiving device 200 of the reverse isolation device 300. The reverse isolation device 300 also includes a data sending device 100, and the data receiving device 200 is respectively connected to the data sending device 100 and the application service device. The data transmission method includes: S201: receiving a third data packet sent by the data sending device 100, the third data packet originating from the data sending device 100: obtaining a first data packet; determining a corresponding compression strategy according to the size of the first data packet; compressing the first data packet according to the compression strategy to obtain a second data packet; encrypting and signing the second data packet to obtain a third data packet; S202: Verify and decrypt the third data packet to obtain a fourth data packet; S203: decompressing the fourth data packet according to the compression strategy to obtain a fifth data packet; S204: Send the fifth data packet to the application service device.

[0068] In the data transmission method of the embodiment of the present invention, the first data packet is compressed and then encrypted and signed to obtain a third data packet, and the compression strategy is determined according to the size of the first data packet. In this way, the transmission rate of the data packet is improved, and while reducing the impact of the encryption operation on the data transmission performance, the compression time of the first data packets of different sizes is controlled within a reasonable range, preventing the data transmission performance of the reverse isolation device 300 from being affected by the long compression time.

[0069] Specifically, after the data sending device 100 obtains the third data packet, it sends the third data packet to the data receiving device 200. The data receiving device 200 receives the third data packet, verifies the signature and decrypts the third data packet, and obtains a fourth data packet. Then, according to the compression strategy determined by the data sending device 100, the fourth data packet is decompressed to obtain a fifth data packet. The fifth data packet can be sent by the data receiving device 200 to the application service device for further processing and analysis.

[0070] See also Fig.12 and Fig.13 In some implementations, the third data packet is signature verified and decrypted to obtain a fourth data packet (ie, S202), including: S2021: Parse the third data packet according to the custom private protocol to obtain a parsed data packet and a first signature; S2022: decrypt the parsed data packet to obtain a decrypted data packet; S2023: Calculate a hash value for the decrypted data packet to determine a second signature for the decrypted data packet; S2024: Determine whether the first signature is identical to the second signature; S2025: When the first signature is identical to the second signature, determine that the decrypted data packet has passed the verification, and use the decrypted data packet as the fourth data packet.

[0071] Specifically, after receiving the third data packet, the third data packet is parsed according to the custom private protocol corresponding to the data sending device 100 to obtain a parsed data packet and a first signature. Thereafter, the parsed data packet is decrypted using a decryption algorithm corresponding to the encryption algorithm in the data sending device 100 to obtain a decrypted data packet.

[0072] During the data transmission process, the data packet may be damaged or tampered with due to various reasons, such as hardware failure, software vulnerability, etc. Therefore, the decrypted data packet can be checked for integrity at the data receiving device 200. The checking process is as follows: a hash value is calculated for the decrypted data packet, and the calculated hash value can be used as the second signature of the decrypted data packet.

[0073] It can be understood that if the data packet is not damaged or tampered with, the data in the decrypted data packet should be the same as the data in the second data packet in the aforementioned implementation mode, and the second signature is calculated based on the decrypted data packet, and the first signature is calculated based on the second data packet, then the second signature should be consistent with the first signature.

[0074] The first signature and the second signature are compared. If the first signature is the same as the second signature, it means that the data packet has not been damaged or tampered with during the transmission process, and the integrity check is qualified. The decrypted data packet that has passed the verification is used as the fourth data packet. If the first signature is not the same as the second signature, it means that the data packet has been damaged or tampered with during the transmission process, and the integrity check fails. At this time, a problem alarm can be issued.

[0075] In this way, the accuracy and credibility of the data packet content are guaranteed, and the tampered data is prevented from causing adverse effects on the power system 400. Hardware failures, software vulnerabilities and other problems in the power system 400 can also be discovered in a timely manner.

[0076] See also Fig.12 and Fig.14 In some embodiments, the compression strategy includes compression control parameters. Decompressing the fourth data packet according to the compression strategy to obtain a fifth data packet (ie, S203) includes: S2031: Determine whether the fourth data packet needs to be decompressed; S2032: when the fourth data packet needs to be decompressed, decompress the fourth data packet according to the compression control parameter to obtain a fifth data packet; At this time, the data transmission method further includes: S205: When the fourth data packet does not need to be decompressed, the fourth data packet is used as the fifth data packet.

[0077] It is understandable that the third data packet may be obtained by encryption and signature after compression, or may be obtained by encryption and signature directly. Therefore, after the third data packet is verified and decrypted to obtain the fourth data packet, it is necessary to determine whether to decompress the fourth data packet.

[0078] For example, when the data sending device 100 compresses the first data packet, a compression flag may be added to the compressed second data packet, so that the compression flag may be checked for the fourth data packet in the data receiving device 200. When the compression flag is checked, it is determined that the fourth data packet needs to be decompressed, and when the compression flag is not checked, it is determined that the fourth data packet does not need to be decompressed.

[0079] When the fourth data packet needs to be decompressed, the fourth data packet is decompressed according to the compression strategy determined in the data sending device 100 using the preset compression algorithm determined in the data sending device 100 to obtain the fifth data packet. When the fourth data packet does not need to be decompressed, the fourth data packet is directly used as the fifth data packet.

[0080] The following describes in detail the effect of optimizing the transmission performance of data transmission using the data transmission method according to the embodiment of the present invention in conjunction with Tables 1 to 4.

[0081] For comparison, the transmission performance indicators of the forward isolation device can be tested. Eight different sized data packets are used for multiple transmissions in the forward isolation device, and the transmission rate is recorded in Gigabits per second (Gbps). The test results are shown in Table 1: Table 1: Transmission performance index test results of forward isolation device

[0082] The transmission performance of the reverse isolation device in the related art was tested. Eight different-sized data packets were used to transmit multiple times in the reverse isolation device, and the transmission rate was recorded. The test results are shown in Table 2: Table 2: Transmission performance index test results of reverse isolation devices in related technologies

[0083] The transmission performance of the reverse isolation device 300 using the data transmission method of the embodiment of the present invention was tested. Eight different-sized data packets were used to perform multiple transmissions in the reverse isolation device 300, and the transmission rates were recorded. The test results are shown in Table 3: Table 3: Performance index test results of the reverse isolation device 300 in the embodiment of the present invention

[0084] Comparing Table 1 and Table 3 with Table 2, we can obtain Table 4, as shown below: Table 4: Transmission performance comparison

[0085] For a more intuitive comparison, a curve graph can be drawn based on Tables 1 to 3, such as Figures 15 to 21 As shown, the legend “forward” corresponds to the forward isolation device, the legend “reverse” corresponds to the reverse isolation device in the related art, and the legend “reverse optimization” corresponds to the reverse isolation device 300 of the embodiment of the present invention.

[0086] Combined with Tables 1 to 4, and Figures 15 to 21 It can be seen that the reverse isolation device 300 using the data transmission method according to the embodiment of the present invention improves the transmission performance by an average of 74% when transmitting data packets of different sizes, and the larger the size of the transmitted data packet, the higher the transmission performance improvement.

[0087] See also Figure 2 and Fig. 22, the embodiment of the present invention also provides a data sending device 100, which is applied to the reverse isolation device 300. The reverse isolation device 300 also includes a data receiving device 200, the data sending device 100 is communicatively connected with the data receiving device 200, and the data receiving device 200 is connected with the application service device. The data sending device 100 includes an acquisition module 10, a determination module 20, a compression module 30, an encryption signature module 40 and a first sending module 50. The acquisition module 10 is used to acquire a first data packet. The determination module 20 is used to determine a corresponding compression strategy according to the size of the first data packet. The compression module 30 is used to compress the first data packet according to the compression strategy to obtain a second data packet. The encryption signature module 40 is used to encrypt and sign the second data packet to obtain a third data packet. The first sending module 50 is used to send the third data packet to the data receiving device 200, so that the data receiving device 200: verifies and decrypts the third data packet to obtain a fourth data packet; decompresses the fourth data packet according to the compression strategy to obtain a fifth data packet; and sends the fifth data packet to the application service device.

[0088] See also Fig.23 In some embodiments, the data sending device 100 further includes a test module 60. Before determining a corresponding compression strategy according to the size of the first data packet, the test module 60 is used to determine whether the size of the first data packet is greater than or equal to a data packet size threshold; when the size of the first data packet is greater than or equal to the data packet size threshold, it is determined that the first data packet needs to be compressed; when the size of the first data packet is less than the data packet size threshold, it is determined that the first data packet does not need to be compressed.

[0089] In some embodiments, before determining whether the size of the first data packet is greater than or equal to the data packet size threshold, the test module 60 is specifically used to encrypt, sign, verify and decrypt multiple test data packets of different sizes, and record the first encryption signing time and the first verification and decryption time; compress, encrypt, sign, verify and decrypt, and decompress multiple test data packets of different sizes, and record the first compression time, the second encryption signing time, the second verification and decryption time and the first decompression time; determine the data packet size threshold according to the first encryption signing time, the first verification and decryption time, the first compression time, the second encryption signing time, the second verification and decompression time and the first decompression time corresponding to each test data packet.

[0090] In some embodiments, the test module 60 is specifically used to determine whether the first encryption signing time, the first signature verification and decryption time, the first compression time, the second encryption signing time, the second signature verification and decryption time, and the first decompression time corresponding to each test data packet meet the predetermined evaluation indicators; and determine the data packet size threshold according to the size of the test data packet that meets the predetermined evaluation indicators. Among them, the predetermined evaluation indicators include: the difference between the first compression time and the encryption signing time difference is less than the first preset threshold, and the encryption signing time difference is the difference between the first encryption signing time and the second encryption signing time; the difference between the first decompression time and the signature verification and decryption time difference is less than the second preset threshold, and the signature verification and decryption time difference is the difference between the first signature verification and decryption time.

[0091] In some embodiments, the compression strategy includes a compression control parameter. The determination module 20 is specifically used to determine the corresponding compression control parameter according to the size of the first data packet when the first data packet needs to be compressed, wherein the compression control parameter is positively correlated with the size of the first data packet. At this time, the compression module 30 is specifically used to compress the first data packet according to the compression control parameter to obtain a second data packet. At this time, the compression module 30 is also used to use the first data packet as the second data packet when the first data packet does not need to be compressed.

[0092] In some embodiments, before compressing the first data packet according to the compression control parameters to obtain the second data packet, the test module 60 is further used to obtain multiple candidate compression algorithms; and perform compression performance tests on the multiple candidate compression algorithms to determine the preset compression algorithm. At this time, the compression module 30 is specifically used to compress the first data packet using the preset compression algorithm according to the compression control parameters to obtain the second data packet.

[0093] In some embodiments, the encryption signature module 40 is specifically used to encrypt the second data packet to obtain an encrypted data packet; calculate a hash value on the second data packet to determine the first signature of the second data packet; and encapsulate the encrypted data packet and the first signature according to a custom private protocol to obtain a third data packet.

[0094] It should be noted that the explanation of the data transmission method in the foregoing embodiment is also applicable to the data sending device 100 in the embodiment of the present invention, and will not be further described here.

[0095] See also Figure 2 and Fig.24, the embodiment of the present invention also provides a data receiving device 200, which is applied to the reverse isolation device 300. The reverse isolation device 300 also includes a data sending device 100, and the data receiving device 200 is respectively connected to the data sending device 100 and the application service device. The data receiving device 200 includes a receiving module 210, a decompression module 230, a signature verification and decryption module 220, and a second sending module 240. The receiving module 210 is used to receive a third data packet sent by the data sending device 100, and the third data packet comes from the data sending device 100: obtain a first data packet; determine a corresponding compression strategy according to the size of the first data packet; compress the first data packet according to the compression strategy to obtain a second data packet; encrypt and sign the second data packet to obtain a third data packet. The signature verification and decryption module 220 is used to verify and decrypt the third data packet to obtain a fourth data packet. The decompression module 230 is used to decompress the fourth data packet according to the compression strategy to obtain a fifth data packet. The second sending module 240 is used to send the fifth data packet to the application service device.

[0096] In some implementations, the signature verification and decryption module 220 is specifically configured to parse the third data packet according to a custom private protocol to obtain a parsed data packet; and perform signature verification and decryption on the parsed data packet to obtain a fourth data packet.

[0097] In some embodiments, the compression strategy includes a compression control parameter. The decompression module 230 is specifically used to determine whether the fourth data packet needs to be decompressed; when the fourth data packet needs to be decompressed, the fourth data packet is decompressed according to the compression control parameter to obtain a fifth data packet; the decompression module 230 is also used to use the fourth data packet as the fifth data packet when the fourth data packet does not need to be decompressed.

[0098] In some embodiments, in the process of parsing the third data packet according to the custom private protocol, the second sending module 240 is also used to obtain the first signature obtained by parsing. At this time, the second sending module 240 is specifically used to calculate the hash value of the fifth data packet to determine the second signature of the fifth data packet; determine whether the first signature is the same as the second signature; when the first signature is the same as the second signature, determine that the fifth data packet is verified to be qualified; and send the verified fifth data packet to the application service device.

[0099] It should be noted that the explanation of the data transmission method in the foregoing embodiment is also applicable to the data receiving device 200 in the embodiment of the present invention, and will not be further described here.

[0100] See also Figure 2 and Fig.25The embodiment of the present invention further provides a reverse isolation device 300. The reverse isolation device 300 includes one or more processors 310 and a memory 320. The memory 320 stores a computer program. When the computer program is executed by the processor 310, the data transmission method of any of the above embodiments is implemented.

[0101] For example, when the computer program is executed by the processor 310, the following data transmission method is implemented: S101: Acquire a first data packet; S102: Determine a corresponding compression strategy according to the size of the first data packet; S103: compressing the first data packet according to the compression strategy to obtain a second data packet; S104: Encrypt and sign the second data packet to obtain a third data packet; S105: Send the third data packet to the data receiving device 200, so that the data receiving device 200: verify and decrypt the third data packet to obtain a fourth data packet; decompress the fourth data packet according to the compression strategy to obtain a fifth data packet; and send the fifth data packet to the application service device.

[0102] For another example, when the computer program is executed by the processor 310, the following data transmission method is implemented: S201: receiving a third data packet sent by the data sending device 100, the third data packet originating from the data sending device 100: obtaining a first data packet; determining a corresponding compression strategy according to the size of the first data packet; compressing the first data packet according to the compression strategy to obtain a second data packet; encrypting and signing the second data packet to obtain a third data packet; S202: Verify and decrypt the third data packet to obtain a fourth data packet; S203: decompressing the fourth data packet according to the compression strategy to obtain a fifth data packet; S204: Send the fifth data packet to the application service device.

[0103] It should be noted that the explanation of the data transmission method in the aforementioned embodiment is also applicable to the reverse isolation device 300 in the embodiment of the present invention, and will not be elaborated here.

[0104] See also Figure 4 The embodiment of the present invention further provides a power system 400. The power system 400 includes the reverse isolation device 300 of any of the above embodiments.

[0105] It should be noted that the explanation of the data transmission method in the aforementioned embodiment is also applicable to the power system 400 of the embodiment of the present invention, and will not be elaborated here.

[0106] See also Fig.26 The embodiment of the present invention further provides a computer-readable storage medium 500 on which a computer program 510 is stored. When the program is executed by a processor 520, the data transmission method of any of the above embodiments is implemented.

[0107] For example, when the computer program 510 is executed by the processor 520, the following data transmission method is implemented: S101: Acquire a first data packet; S102: Determine a corresponding compression strategy according to the size of the first data packet; S103: compressing the first data packet according to the compression strategy to obtain a second data packet; S104: Encrypt and sign the second data packet to obtain a third data packet; S105: Send the third data packet to the data receiving device 200, so that the data receiving device 200: verify and decrypt the third data packet to obtain a fourth data packet; decompress the fourth data packet according to the compression strategy to obtain a fifth data packet; and send the fifth data packet to the application service device.

[0108] For another example, when the computer program 510 is executed by the processor 520, the following data transmission method is implemented: S201: receiving a third data packet sent by the data sending device 100, the third data packet originating from the data sending device 100: obtaining a first data packet; determining a corresponding compression strategy according to the size of the first data packet; compressing the first data packet according to the compression strategy to obtain a second data packet; encrypting and signing the second data packet to obtain a third data packet; S202: Verify and decrypt the third data packet to obtain a fourth data packet; S203: decompressing the fourth data packet according to the compression strategy to obtain a fifth data packet; S204: Send the fifth data packet to the application service device.

[0109] It should be noted that the explanation of the data transmission method in the foregoing embodiment is also applicable to the computer-readable storage medium 500 in the embodiment of the present invention, and will not be further described here.

[0110] In summary, in the data transmission method, data sending device 100, data receiving device 200, reverse isolation device 300, power system 400 and computer-readable storage medium 500 of the embodiment of the present invention, the first data packet is compressed and then encrypted and signed to obtain a third data packet, and the compression strategy is determined according to the size of the first data packet. In this way, the transmission rate of the data packet is improved, and while reducing the impact of the encryption operation on the data transmission performance, the compression time of the first data packets of different sizes is controlled within a reasonable range, preventing the data transmission performance of the reverse isolation device 300 from being affected by the long compression time.

[0111] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0112] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention belong.

[0113] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable storage medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, a computer-readable storage medium can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples (non-exhaustive list) of computer-readable storage media include the following: an electrical connection portion with one or more wirings (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable storage medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0114] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0115] A person of ordinary skill in the art can understand that all or part of the steps carried by the method of the above-mentioned embodiment can be completed by instructing the relevant hardware through a program, and the program can be stored in a computer-readable storage medium, and the program, when executed, includes one or a combination of the steps of the method embodiment. In addition, each functional unit in each embodiment of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into one module. The above-mentioned integrated module can be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. The above-mentioned storage medium can be a read-only memory, a disk or an optical disk, etc.

[0116] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations on the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention. The scope of the present invention is defined by the claims and their equivalents.

Claims

1. A data transmission method, characterized in that: A data sending device applied to a reverse isolation device, the reverse isolation device further comprising a data receiving device, the data sending device being communicatively connected to the data receiving device, the data receiving device being connected to an application service device, the data transmission method comprising: Get the first data packet; Determining a corresponding compression strategy according to the size of the first data packet; Compressing the first data packet according to the compression strategy to obtain a second data packet; Performing encryption and signing on the second data packet to obtain a third data packet; The third data packet is sent to the data receiving device so that the data receiving device: performs signature verification and decryption on the third data packet to obtain a fourth data packet; decompresses the fourth data packet according to the compression strategy to obtain a fifth data packet; and sends the fifth data packet to the application service device.

2. The data transmission method according to claim 1, characterized in that: Before determining the corresponding compression strategy according to the size of the first data packet, the data transmission method further includes: Determining whether the size of the first data packet is greater than or equal to a data packet size threshold; When the size of the first data packet is greater than or equal to the data packet size threshold, determining that the first data packet needs to be compressed; When the size of the first data packet is smaller than the data packet size threshold, it is determined that the first data packet does not need to be compressed.

3. The data transmission method according to claim 2, characterized in that: Before determining whether the size of the first data packet is greater than or equal to a data packet size threshold, the data transmission method further includes: Perform encryption signing and signature verification and decryption on multiple test data packets of different sizes, and record the first encryption signing time and the first signature verification and decryption time; Compress, encrypt, sign, verify, decrypt and decompress the test data packets of multiple different sizes, and record the first compression time, the second encryption signing time, the second verification and decryption time and the first decompression time; The data packet size threshold is determined according to the first encryption signing time, the first signature verification and decryption time, the first compression time, the second encryption signing time, the second signature verification and decryption time, and the first decompression time corresponding to each of the test data packets.

4. The data transmission method according to claim 3, characterized in that: Determining the data packet size threshold according to the first encryption signing time, the first signature verification and decryption time, the first compression time, the second encryption signing time, the second signature verification and decryption time, and the first decompression time corresponding to each of the test data packets includes: Determine whether the first encryption signing time, the first signature verification and decryption time, the first compression time, the second encryption signing time, the second signature verification and decryption time, and the first decompression time corresponding to each of the test data packets meet predetermined evaluation indicators; Determining the data packet size threshold according to the size of the test data packet that meets the predetermined evaluation index; The predetermined evaluation indicators include: The difference between the first compression time and the encryption signature time difference is less than a first preset threshold, and the encryption signature time difference is the difference between the first encryption signature time and the second encryption signature time; The difference between the first decompression time and the signature verification and decryption time difference is less than a second preset threshold, and the signature verification and decryption time difference is the difference between the first signature verification and decryption time and the second signature verification and decryption time.

5. The data transmission method according to claim 2, characterized in that: The compression strategy includes a compression control parameter, and the determining the corresponding compression strategy according to the size of the first data packet includes: When the first data packet needs to be compressed, determining the corresponding compression control parameter according to the size of the first data packet, wherein the compression control parameter is positively correlated with the size of the first data packet; The compressing the first data packet according to the compression strategy to obtain a second data packet includes: compressing the first data packet according to the compression control parameter to obtain the second data packet; The data transmission method further comprises: When there is no need to compress the first data packet, the first data packet is used as the second data packet.

6. The data transmission method according to claim 5, characterized in that: Before compressing the first data packet according to the compression control parameter to obtain the second data packet, the data transmission method further includes: Obtain multiple candidate compression algorithms; Performing compression performance tests on the multiple candidate compression algorithms to determine a preset compression algorithm; The compressing the first data packet according to the compression control parameter to obtain the second data packet includes: The first data packet is compressed using the preset compression algorithm according to the compression control parameters to obtain the second data packet.

7. The data transmission method according to claim 1, characterized in that: The step of encrypting and signing the second data packet to obtain a third data packet includes: encrypting the second data packet to obtain an encrypted data packet; Performing hash value calculation on the second data packet to determine a first signature of the second data packet; The encrypted data packet and the first signature are encapsulated according to a custom private protocol to obtain the third data packet.

8. A data transmission method, characterized in that: A data receiving device applied to a reverse isolation device, wherein the reverse isolation device further comprises a data sending device, wherein the data receiving device is respectively connected to the data sending device and the application service device for communication, and the data transmission method comprises: receiving a third data packet sent by the data sending device, the third data packet originating from the data sending device: obtaining a first data packet; determining a corresponding compression strategy according to a size of the first data packet; compressing the first data packet according to the compression strategy to obtain a second data packet; and encrypting and signing the second data packet to obtain the third data packet; Performing signature verification and decryption on the third data packet to obtain a fourth data packet; decompressing the fourth data packet according to the compression strategy to obtain a fifth data packet; The fifth data packet is sent to the application service device.

9. The data transmission method according to claim 8, characterized in that: The performing signature verification and decryption on the third data packet to obtain a fourth data packet includes: Parsing the third data packet according to a custom private protocol to obtain a parsed data packet and a first signature; Decrypting the parsed data packet to obtain a decrypted data packet; Performing hash value calculation on the decrypted data packet to determine a second signature of the decrypted data packet; Determining whether the first signature is identical to the second signature; When the first signature is identical to the second signature, the decrypted data packet is determined to be qualified, and the decrypted data packet is used as the fourth data packet.

10. The data transmission method according to claim 8, characterized in that: The compression strategy includes a compression control parameter, and the decompressing the fourth data packet according to the compression strategy to obtain a fifth data packet includes: Determining whether the fourth data packet needs to be decompressed; When the fourth data packet needs to be decompressed, decompress the fourth data packet according to the compression control parameter to obtain the fifth data packet; The data transmission method further comprises: When the fourth data packet does not need to be decompressed, the fourth data packet is used as the fifth data packet.

11. A data transmission device, characterized in that: Applied to a reverse isolation device, the reverse isolation device further includes a data receiving device, the data sending device is communicatively connected to the data receiving device, the data receiving device is connected to an application service device, and the data sending device includes: An acquisition module, used for acquiring a first data packet; A determination module, configured to determine a corresponding compression strategy according to the size of the first data packet; A compression module, configured to compress the first data packet according to the compression strategy to obtain a second data packet; An encryption signature module, used for performing encryption signature on the second data packet to obtain a third data packet; The first sending module is used to send the third data packet to the data receiving device, so that the data receiving device: verifies and decrypts the third data packet to obtain a fourth data packet; decompresses the fourth data packet according to the compression strategy to obtain a fifth data packet; and sends the fifth data packet to the application service device.

12. A data receiving device, characterized in that: Applied to a reverse isolation device, the reverse isolation device further includes a data sending device, the data receiving device is respectively connected to the data sending device and the application service device for communication, and the data receiving device includes: A receiving module, configured to receive a third data packet sent by the data sending device, the third data packet originating from the data sending device: obtaining a first data packet; determining a corresponding compression strategy according to a size of the first data packet; compressing the first data packet according to the compression strategy to obtain a second data packet; and encrypting and signing the second data packet to obtain a third data packet; a signature verification and decryption module, configured to perform signature verification and decryption on the third data packet to obtain a fourth data packet; a decompression module, configured to decompress the fourth data packet according to the compression strategy to obtain a fifth data packet; The second sending module is used to send the fifth data packet to the application service device.

13. A reverse isolation device, characterized in that: The reverse isolation device includes one or more processors and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the data transmission method according to any one of claims 1 to 7 or the data transmission method according to any one of claims 8 to 10 is implemented.

14. A power system, characterized in that: Includes the reverse isolation device as described in claim 13.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the data transmission method described in any one of claims 1 to 7 or the data transmission method described in any one of claims 8 to 10 is implemented.

Images