Method and system for realizing penetration of forward and reverse isolation devices based on MQTT

Abstract

The invention discloses a method and system for realizing penetration of a forward and reverse isolation device based on MQTT, and the method comprises the steps: determining a network architecture needing forward and reverse isolation, and marking each security domain and equipment needing communication; an MQTT proxy server is arranged in each security domain, and corresponding configuration is carried out; establishing a forward communication channel and a reverse communication channel; in the equipment of each security domain, setting an MQTT client, and setting a QoS (Quality of Service) level and a message retention mark; and configuring an access control rule on the MQTT proxy server. According to the invention, security isolation communication among different security domains is realized. The flexibility and expandability of the MQTT protocol are utilized, so that equipment in different security domains can communicate safely and reliably. The method is suitable for different equipment and network environments. The invention provides a reliable subscribing and publishing machine. MQTT clients are arranged in the devices of all the security domains, and subscription and publishing of related themes are achieved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method and system for implementing forward and reverse isolation device penetration based on MQTT. Background Art

[0002] In the existing network security field, forward and reverse isolation devices are a common measure used to isolate networks and systems with different security levels. However, with the development of the Internet of Things and the increase in device interconnection, traditional isolation devices face some challenges in achieving communication between devices.

[0003] With the rise of smart hardware, the Internet of Things is developing rapidly, but its security issues are also facing severe challenges. IoT devices are often restricted devices with limited computing power and limited resource space, which makes it difficult to copy the security solutions of the Internet on these devices. Instead, a set of lightweight security solutions needs to be designed specifically for this purpose. The MQTT (Message Queuing Telemetry Transport) protocol is the mainstream protocol for IoT communication. The research on IoT communication security based on MQTT is a hot topic in current research.

[0004] MQTT (Message Queue Telemetry Transport) is a client-server based message publish / subscribe transport protocol. MQTT can be interpreted as a low-overhead, low-bandwidth instant messaging protocol that can provide real-time and reliable message services for remote devices with minimal code and bandwidth. It is suitable for remote devices with low hardware performance and poor network conditions. Therefore, the MQTT protocol is widely used in IoT (Internet of Things), communication between small devices, and mobile communications. However, the conventional MQTT protocol still has security vulnerabilities. For example, multiple clients can interact with each other by publishing / subscribing messages to the server. In this process, the client only needs to subscribe to the corresponding topic message from the server to receive the message content of the topic, which poses a risk of information being eavesdropped by illegal devices.

[0005] The application of network technology can certainly provide great convenience for the development of related communication work, but due to the open source characteristics of the Internet itself, it also causes certain risks. Therefore, in order to give full play to the advantages of the Internet, it is necessary to actively apply Internet security protection technology to ensure the comprehensive security of the network. Therefore, it is necessary to propose a method based on MQTT to achieve forward and reverse isolation device penetration to solve the above problems.

[0006] Faced with the need of various industries to open part of the information and business of the intranet to the Internet and provide information services, traditional firewalls can no longer meet the security needs, and low-efficiency and low-reliability solutions such as isolation cards and mobile media cannot meet the needs of enterprise informatization. In my country, the government, enterprises, institutions, etc. all use isolation technology to solve the security issues of information exchange between confidential networks and public networks, and ensure the confidentiality, integrity and high availability of the network.

[0007] MQTT (Message Queuing Telemetry Transport) is a lightweight communication protocol based on the Publish / Subscribe model. The protocol is built on the TCP / IP protocol and was released by IBM in 1999. The latest version is v3.1.1. The biggest advantage of MQTT is that it can provide real-time and reliable message services to remote devices with very little code and limited bandwidth. As an instant messaging protocol with low overhead and low bandwidth, MQTT is widely used in the Internet of Things, small devices, mobile applications, etc. MQTT is a client-server based message publish / subscribe transmission protocol. The MQTT protocol is lightweight, simple, open and easy to implement.

[0008] At present, the common practice is to use MQTT, WebSocket and other protocols on the Internet side for communication between mobile applications and home smart terminals. Since there is no NAT traversal problem on the LAN side, TCP / UDP is directly used for socket programming communication. Due to the different protocols used, different implementation methods need to be used for communication on the Internet and LAN sides, which greatly increases the complexity of the program and reduces the maintainability of the software system. At the same time, since this method needs to make communication route decisions based on the network status itself, it is often impossible for each message to dynamically select the optimal communication route.

[0009] In order to solve the problems existing in the prior art, the present invention aims to provide a method for penetrating a forward and reverse isolation device based on MQTT to solve the problems in the prior art. The method utilizes the flexibility and scalability of the MQTT protocol to enable devices in different security domains to communicate securely and reliably. Summary of the invention

[0010] In view of the above-mentioned problems, the present invention is proposed.

[0011] Therefore, the technical problem solved by the present invention is: how to solve the need for secure and efficient communication between devices across multiple security domains, especially the technical problem of ensuring the security and reliability of data transmission through the MQTT protocol in a network architecture that implements forward and reverse isolation.

[0012] In order to solve the above technical problems, the present invention provides the following technical solutions: a method for realizing penetration of forward and reverse isolation devices based on MQTT, comprising: determining a network architecture that needs forward and reverse isolation, identifying each security domain and a device that needs to communicate;

[0013] Set up an MQTT proxy server in each security domain and configure it accordingly;

[0014] Establishing channels for forward and reverse communication;

[0015] In the devices of each security domain, set up the MQTT client, set the QoS level and the message retention flag;

[0016] Configure access control rules on the MQTT broker.

[0017] As a preferred solution of the method for realizing forward and reverse isolation device penetration based on MQTT described in the present invention, wherein: the network architecture for determining the need for forward and reverse isolation includes:

[0018] When the network architecture involves communication across security domains with different security levels, it is determined to be a network architecture that requires forward and reverse isolation;

[0019] If the network architecture includes sensitive data processing, critical infrastructure management, or involves the transmission of highly confidential information from a high-security level area to a low-security level area or vice versa, it is determined to be a network architecture that requires forward and reverse isolation;

[0020] When the communication in the network architecture is limited to the security domain of the same security level, or when the network architecture is designed to process non-sensitive information and does not involve data transmission across security domains, it is determined to be a network architecture that does not require forward and reverse isolation.

[0021] As a preferred solution of the method for realizing forward and reverse isolation device penetration based on MQTT described in the present invention, wherein: the setting of the MQTT proxy server includes:

[0022] Each MQTT proxy server refers to a listening port, receiving connection requests from devices within the security domain;

[0023] Implement a secure authentication mechanism, use TLS / SSL encryption protocol, and authenticate based on username and password to establish connections only with authorized devices;

[0024] For cross-security zone communications, configure routing rules, including:

[0025] When a device requests to send a message from one security domain to another, the authentication and authorization status of the device is checked. If the device has passed the security authentication and has the corresponding communication authority, the message is allowed to pass; otherwise, the communication request is rejected.

[0026] When a message needs to be transmitted from a high-security domain to a low-security domain, a security check is performed on the message, including content filtering and virus scanning.

[0027] When a message is transmitted from a low-security domain to a high-security domain, a security check is performed and identity authentication and data encryption are performed.

[0028] When there are multiple possible routing paths, the optimal path is selected according to a predefined routing priority rule, where the priority is determined based on the security level and communication delay of the path.

[0029] As a preferred solution of the method for realizing penetration of forward and reverse isolation devices based on MQTT described in the present invention, wherein: the corresponding configuration includes setting up intelligent load balancing and monitoring the workload of each MQTT proxy server in real time;

[0030] Use the evaluation algorithm to analyze the monitored data, predict the future load of each MQTT proxy server, and determine whether load adjustment is needed;

[0031] Based on the prediction results, new or existing MQTT connections are automatically adjusted to the less loaded proxy servers.

[0032] As a preferred solution of the method for realizing forward and reverse isolation device penetration based on MQTT described in the present invention, wherein: the data monitored by the evaluation algorithm analysis includes the formula:

[0033]

[0034] Where P represents the system performance evaluation result, U represents the network bandwidth utilization, μ and σ represent the mean and standard deviation of the packet size, respectively, α, β, γ, δ, ζ and ∈ are weight parameters adjusted according to the system performance evaluation requirements; the integral part represents the cumulative distribution function (CDF) of the packet size distribution, which is used to measure the system's ability to handle packets of different sizes; ln ( The term λC) takes into account the relationship between the packet arrival rate and the system processing capacity, indicating the amount of data that the system can efficiently process, λ represents the data arrival rate, and C represents the system processing capacity; the term cos(∈U) is used to introduce periodic changes and simulate the impact of changes in network bandwidth utilization over time; represents an integral expression for calculating the probability of a packet size smaller than the mean μ, where x represents the packet size.

[0035] As a preferred solution of the method for realizing penetration of forward and reverse isolation devices based on MQTT described in the present invention, wherein: the establishment of channels for forward communication and reverse communication includes initializing the MQTT proxy server in each security domain and setting basic parameters for forward and reverse communication;

[0036] Two-way authentication is performed through TLS / SSL certificates. Communication permissions are dynamically allocated based on the security level of the device and the sensitivity of the communication content, allowing only authorized devices to participate in forward and reverse communications.

[0037] Dynamically select the most appropriate routing path based on real-time network conditions and security level differences between security domains;

[0038] All data transmitted through forward and reverse channels is end-to-end encrypted, and content filtering mechanisms are implemented;

[0039] When pushing data from a low-security domain to a high-security domain, a forward channel is established, which allows data to be uploaded and ensures the integrity and confidentiality of the data;

[0040] When it is necessary to configure or issue control commands to devices in a high-security domain, they are executed through the forward channel and the authenticity and authorization of the command source are ensured;

[0041] When users and devices in a low-security domain request access to resources and services in a high-security domain, they are processed through the forward channel and authenticated and authorized at the same time;

[0042] When the high-security domain needs to send processing results, operation feedback, and alarm information to the low-security domain, the information is transmitted through the back channel;

[0043] When data synchronization or backup is performed, when data in a high-security domain needs to be backed up to a storage system in a low-security domain, this is done through a reverse channel;

[0044] When a request in a low-security domain is accepted and processed by a high-security domain, the processing result and service response need to be returned to the low-security domain through a reverse channel.

[0045] As a preferred solution of the method for realizing forward and reverse isolation device penetration based on MQTT described in the present invention, wherein: the access control rules configured on the MQTT proxy server include:

[0046] Set up an authentication mechanism to ensure that only authenticated clients can connect to the MQTT broker server;

[0047] Based on the MQTT topic subscription model, set access permissions for different topics to ensure that clients can only subscribe to and publish topics they have access to;

[0048] Force all communications through the MQTT broker to use encrypted TLS / SSL transport;

[0049] Introduce a message content filtering mechanism to check the content of messages entering and leaving the MQTT proxy server, and automatically intercept messages containing sensitive information or that do not comply with security policies;

[0050] Set limits on connection frequency and quantity to prevent malicious connection attacks from affecting the MQTT proxy server.

[0051] A system for realizing penetration of forward and reverse isolation devices based on MQTT, characterized in that: it includes:

[0052] Network architecture and security domain identification module: determines the network architecture that needs to be isolated in both the forward and reverse directions, and identifies each security domain and the devices that need to communicate;

[0053] MQTT proxy server configuration module: Set up the MQTT proxy server in each security domain and perform corresponding configuration;

[0054] Communication channel establishment module: establishes channels for forward communication and reverse communication;

[0055] Device client configuration module: Set up MQTT client, QoS level and message retention flag in devices in each security domain;

[0056] Access control rule configuration module: configure access control rules on the MQTT proxy server.

[0057] Beneficial effects of the present invention: The present invention realizes a method for penetrating forward and reverse isolation devices based on MQTT, and realizes secure isolation communication between different security domains. The flexibility and scalability of the MQTT protocol are utilized to enable devices in different security domains to communicate securely and reliably. Applicable to different devices and network environments. Reliable subscription and publishing machine. In the devices of each security domain, an MQTT client is set to subscribe to and publish related topics. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0059] Figure 1An overall flow chart of a method for implementing forward and reverse isolation device penetration based on MQTT provided in the first embodiment of the present invention;

[0060] Figure 2 An architectural diagram of a method for implementing forward and reverse isolation device penetration based on MQTT provided in the first embodiment of the present invention. DETAILED DESCRIPTION

[0061] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0062] Example 1

[0063] Reference Figure 1-2 , as an embodiment of the present invention, provides a method for penetrating a forward and reverse isolation device based on MQTT, comprising:

[0064] S1: Determine the network architecture that requires forward and reverse isolation, and identify each security domain and the devices that need to communicate.

[0065] When the network architecture involves communications across security domains with different security levels, it is determined to be a network architecture that requires forward and reverse isolation.

[0066] If the network architecture includes sensitive data processing, critical infrastructure management, or involves the transmission of highly confidential information from a high-security level area to a low-security level area or vice versa, it is determined to be a network architecture that requires forward and reverse isolation.

[0067] When the communication in the network architecture is limited to the security domain of the same security level, or when the network architecture is designed to process non-sensitive information and does not involve data transmission across security domains, it is determined to be a network architecture that does not require forward and reverse isolation.

[0068] Furthermore, security domains are network areas defined based on the security needs, sensitivity levels, and trust levels of devices, applications, or users. This step involves analyzing the organization's business processes, data flows, and security policies to determine which areas should be divided into a separate security domain. For example, an enterprise may divide its network into three security domains: internal network, DMZ (demilitarized zone), and public Internet. Within each security domain, all network devices, computing resources, and storage resources need to be identified. This includes but is not limited to servers, workstations, routers, switches, databases, and any other network-connected devices or systems. This step ensures that the resources within each security domain are fully understood, laying the foundation for further security configuration and communication control.

[0069] Going a step further, a detailed analysis of the communication requirements between various security domains and between devices within a domain is performed. This involves determining which devices need to communicate, the nature of the communication (data type, sensitivity, etc.), the frequency of communication, and any specific security or performance requirements. This helps to design appropriate network architectures and security measures to meet various communication needs while ensuring data security and network efficiency. After completing the communication needs analysis, the communication devices and interfaces between and within security domains are further mapped. This includes determining the physical location of the device, the network interface, and the specific details of the connection. This step is critical to the design and implementation of a network isolation strategy because it provides a specific basis for implementing security control measures (such as firewall rules, access control lists, etc.).

[0070] It should be noted that by implementing a network architecture with forward and reverse isolation, sensitive data can be effectively protected from unauthorized access or leakage. For security domains that handle sensitive information, more stringent security measures can be taken, such as encrypted transmission and access control, to ensure that the confidentiality and integrity of the data are protected. In the face of network attacks or system failures, the network architecture with forward and reverse isolation can limit the scope of the problem. By dividing the network into multiple security domains, even if one area is attacked, it will not affect the security and stability of other areas.

[0071] S2: Set up an MQTT proxy server in each security domain and configure it accordingly.

[0072] Each MQTT proxy server listens to the port and receives connection requests from devices in the security domain. It implements a security authentication mechanism, uses TLS / SSL encryption protocol, and only establishes connections with authorized devices based on username and password authentication.

[0073] For cross-security zone communications, configure routing rules, including:

[0074] When the device requests to send a message from one security domain to another, the authentication and authorization status of the device is checked. If the device has passed the security authentication and has the corresponding communication permissions, the message is allowed to pass; otherwise, the communication request is rejected.

[0075] When a message needs to be transmitted from a security domain with a high security level to a security domain with a low security level, a security check is performed on the message, including content filtering and virus scanning.

[0076] When a message is transmitted from a security domain with a low security level to a security domain with a high security level, a security check is performed and authentication and data encryption processing are carried out.

[0077] When there are multiple possible routing paths, the optimal path is selected according to the predefined routing priority rules, and the priority is determined based on the security level and communication delay of the path.

[0078] Intelligent load balancing settings are made to monitor the workload of each MQTT broker server in real time; the monitored data is analyzed using an evaluation algorithm to predict the future load conditions of each MQTT broker server and determine whether load adjustment is required.

[0079] The data monitored by the evaluation algorithm includes the formula:

[0080]

[0081] Where P represents the system performance evaluation result, U represents the network bandwidth utilization rate, μ and σ represent the average value and standard deviation of the packet size respectively, and α, β, γ, δ, ζ and ∈ are weight parameters adjusted according to the system performance evaluation requirements; the integral part represents the cumulative distribution function (CDF) of the packet size distribution, which is used to measure the system's ability to process packets of different sizes; ln ( The term λC) takes into account the relationship between the packet arrival rate and the system processing capacity, indicating the amount of data that the system can process efficiently, where λ represents the data arrival rate and C represents the system processing capacity; the term cos(∈U) is used to introduce periodic changes and simulate the impact of the network bandwidth utilization rate changing over time; represents an integral expression used to calculate the probability of a packet size less than the average value μ, and x represents the packet size.

[0082] The value range of P is 0 < P ≤ 1. When P is close to 1, it indicates that the system has a high performance under the current network conditions and data load; when the value of P is low, it indicates that the system performance is poor and it may be necessary to optimize network resources or improve the system processing capacity. This formula provides a method to comprehensively consider multiple key factors to evaluate the performance of the network system. By adjusting the weight parameters, it can adapt to different evaluation requirements and scenarios, demonstrating innovation and wide application.

[0083] Furthermore, the integral expression in the formula In this example, x represents a variable representing the possible values ​​of the packet size. This integral expression is part of the Gaussian (or normal) distribution function and is used to calculate the probability distribution of packet sizes below the mean μ.

[0084] When the predicted value of P(t) is significantly higher than the current load L(t), the system can allocate resources or adjust the load balancing strategy in advance to prevent potential service degradation or interruption. This forward-looking resource management can significantly improve system stability and user experience. P(t) can also serve as an early warning mechanism. When the predicted value exceeds a certain threshold, the system can automatically notify the administrator or trigger the automatic expansion process to ensure the continuous availability of the service. For situations where the P(t) value is close to 0, the system can consider reducing resource allocation, improving resource utilization, or performing other optimization measures to reduce operating costs.

[0085] The introduction of P(t) provides a scientific and dynamic method for load management of MQTT proxy servers. By accurately predicting future loads, the system can make more reasonable and efficient decisions in terms of resource management, performance optimization, and cost control. This not only improves the quality and reliability of services, but also provides strong support for the ever-changing network environment and business needs.

[0086] Based on the prediction results, new or existing MQTT connections are automatically adjusted to the less loaded proxy servers.

[0087] Furthermore, a unique listening port is specified for each MQTT proxy server, and an encryption protocol based on TLS / SSL is implemented to ensure the security of the data transmission process. Device authentication is performed using a username and password to ensure that only authorized devices can establish a connection. Such an authentication mechanism is a key part of building a secure MQTT communication foundation. For communication requests across security domains, fine-grained control is performed through the authentication and authorization status of the device to ensure that only communications that meet security requirements are allowed. In particular, strict content filtering and virus scanning are performed on data transmission from high security levels to low security levels to prevent sensitive data leakage or malware propagation. When data flows to a security domain with a higher security level, more stringent security checks are implemented, including identity authentication and data encryption processing. This ensures that even if the data is intercepted, unauthorized third parties cannot interpret its content.

[0088] It should be noted that, through precise security configuration and management, the present invention significantly improves the security of data during transmission, especially when communicating across security domains, and can effectively prevent data leakage and unauthorized access. Through intelligent load balancing and load prediction algorithms, the system can automatically adjust resource allocation according to real-time load conditions, avoid server overload, reduce communication delays, and improve the overall system response speed and stability. Through fine control and optimization of cross-domain communications, the present invention improves the utilization efficiency of network resources and ensures that critical tasks and data transmission can obtain sufficient network resource support. The present invention supports flexible cross-domain communication strategies, which can meet the data transmission requirements under different security levels and different business needs, and provides an effective solution for complex network environments.

[0089] S3: Establish channels for forward and reverse communication.

[0090] Initialize the MQTT proxy server in each security domain and set the basic parameters for forward and reverse communications. Perform two-way identity authentication through TLS / SSL certificates, dynamically allocate communication permissions based on the security level of the device and the sensitivity of the communication content, and only allow authorized devices to participate in forward and reverse communications. Dynamically select the most appropriate routing path based on real-time network conditions and differences in security levels between security domains. Perform end-to-end encryption on all data transmitted through forward and reverse channels, and implement content filtering mechanisms.

[0091] When pushing data from a low security level domain to a high security level domain, a forward channel is established, which allows data to be uploaded and ensures the integrity and confidentiality of the data.

[0092] When it is necessary to configure or issue control commands to devices in a high-security domain, they are executed through the forward channel, and the authenticity and authorization of the command source are ensured.

[0093] When users and devices in a low-security domain request access to resources and services in a high-security domain, the request is processed through the forward channel, and authentication and authorization are performed simultaneously.

[0094] When the high-security-level domain needs to send processing results, operation feedback, and alarm information to the low-security-level domain, the information is transmitted through the back channel.

[0095] During data synchronization or backup, when data in a high-security domain needs to be backed up to a storage system in a low-security domain, this is accomplished through a reverse channel.

[0096] When a request in a low-security domain is accepted and processed by a high-security domain, the processing result and service response need to be returned to the low-security domain through a reverse channel.

[0097] Furthermore, the initialization process includes configuring the MQTT proxy server to support basic parameters for forward and reverse communication, such as communication protocols, port configurations, and security policies. The key to this stage is to ensure the compatibility and security of the communication infrastructure, providing a solid foundation for subsequent communications. Two-way authentication is achieved through TLS / SSL certificates, which not only ensures the authenticity of the identities of both parties in communication, but also protects the communication content from man-in-the-middle attacks. The strategy for dynamically allocating communication permissions is adjusted according to the security level of the device and the sensitivity of the communication content. This mechanism provides fine-grained access control, thereby strengthening the security of data transmission.

[0098] Furthermore, end-to-end encryption of data during transmission ensures that even if the data is intercepted during transmission, attackers cannot read the data content, thus ensuring the confidentiality of the data. The content filtering mechanism checks the transmitted data to ensure that it does not contain malicious code or sensitive information that is transmitted without authorization. This measure is crucial to preventing data leakage and keeping the network security environment clean.

[0099] It should be noted that dynamic routing selection is performed based on real-time network conditions and security level differences between security domains, which ensures that data can be transmitted through the safest and most efficient path. This strategy not only improves the efficiency of communication, but also enhances the security during data transmission. The establishment of forward and reverse channels is customized according to different business needs and security requirements to ensure the rationality and security of data flow. The forward channel is mainly used for uplink data, while the reverse channel is used for feedback and downlink data transmission. The combination of the two provides a comprehensive communication solution.

[0100] S4: In the devices of each security domain, set up the MQTT client, set the QoS level and the message retention flag.

[0101] The MQTT protocol defines three QoS levels: 0 (at most once), 1 (at least once), and 2 (exactly once). Selecting the appropriate QoS level is crucial for different communication requirements, as it determines the level of guarantee for message delivery. For example, for control messages that cannot tolerate loss, QoS2 should be selected, while for regular data collection, QoS 0 or 1 may be more cost-effective.

[0102] MQTT allows messages to be marked as "retained", which means that the last retained message will be stored by the broker server and immediately distributed to new clients subscribing to the corresponding topic. This feature is very useful for ensuring that new clients can immediately receive critical configuration information or the latest status updates.

[0103] Furthermore, in order to improve the flexibility and adaptability of the system, a dynamic QoS level adjustment mechanism can be implemented to automatically select the most appropriate QoS level based on the current network conditions and message priority. This mechanism can further optimize the use of network resources and improve the efficiency of message transmission. In addition to simply turning on or off the message retention flag, a more intelligent message retention management strategy can be introduced, such as automatically deciding whether to retain a message based on the message type, source or importance. This helps reduce unnecessary network traffic and server load while ensuring the timely availability of critical information.

[0104] It should be noted that by carefully configuring the QoS level and message retention flag, the reliability, timeliness and network resource consumption of message transmission can be balanced according to actual needs, achieving more efficient communication. The introduction of dynamic QoS level adjustment and intelligent message retention strategy enables the system to better adapt to network changes and load fluctuations, thereby improving overall reliability and stability. By ensuring that only authorized devices can set and modify QoS levels and message retention flags, potential security risks such as unauthorized information leakage or abuse can be avoided.

[0105] S5: Configure access control rules on the MQTT proxy server.

[0106] Set up an authentication mechanism to ensure that only authenticated clients can connect to the MQTT broker server;

[0107] Based on the MQTT topic subscription model, set access permissions for different topics to ensure that clients can only subscribe to and publish topics they have access to;

[0108] Force all communications through the MQTT broker to use encrypted TLS / SSL transport;

[0109] Introduce a message content filtering mechanism to check the content of messages entering and leaving the MQTT proxy server, and automatically intercept messages containing sensitive information or that do not comply with security policies;

[0110] Set limits on connection frequency and quantity to prevent malicious connection attacks from affecting the MQTT proxy server.

[0111] Furthermore, by requiring the client to authenticate before connecting to the MQTT broker server, unauthorized devices can be effectively prevented from accessing network resources. This usually involves username and password verification, or more advanced authentication methods such as digital certificates or two-factor authentication, thus providing a secure communication starting point. Access permission settings based on the MQTT topic subscription model allow fine-grained access control to different topics. This ensures that the client can only subscribe to and publish topics that it is authorized to access, preventing illegal access and distribution of sensitive information, while also reducing the risk of information overload.

[0112] Furthermore, the mandatory use of TLS / SSL encryption protocol to encrypt all communications through the MQTT proxy server not only protects the privacy and integrity of data during transmission, but also enhances the security of data exchange and prevents data from being intercepted or tampered with during transmission. The introduction of message content filtering mechanism is to further strengthen data security protection. By checking the content of messages entering and leaving the MQTT proxy server and automatically intercepting messages containing sensitive information or violating security policies, this mechanism helps to avoid potential security threats and data leaks. Setting limits on the frequency and number of connections is one of the effective strategies for defending against malicious attacks. This prevents malware or attackers from trying to disrupt the services of the MQTT proxy server through a large number of connection requests, thereby ensuring the reliability and stability of the server.

[0113] It should be noted that the above measures can significantly improve the security of the entire MQTT communication system, prevent unauthorized access and data leakage, and protect the security of sensitive information. Limiting the frequency and number of connections, as well as implementing message content filtering, can help reduce the load on the MQTT proxy server, prevent denial of service attacks (DoS), and ensure the high availability and stability of the system. Through meticulous access control and identity authentication, the system can more effectively manage and allocate network resources, improve service efficiency, and reduce invalid or malicious network traffic. Ensuring the implementation of communication encryption and data protection measures can help meet the requirements of data protection regulations and industry standards and reduce legal and compliance risks.

[0114] The above embodiments also include an image segmentation and building shadow extraction system based on edge constraints, specifically:

[0115] Resource selection and priority determination module: selects fast frequency control resources and determines their control priority according to the response time and action cost of frequency control resources;

[0116] Extended frequency modulation control defense line configuration module: select continuously adjustable resources as extended frequency modulation control defense line, and set the active frequency regulation strategy parameters of the control resources;

[0117] Long-delay control strategy module: When the grid frequency is lower than 49.8Hz for a long time, a long delay is set to automatically cut off fast controllable resources to restore the system frequency to the normal range;

[0118] Short-delay response module: When the system frequency drops and a large frequency difference ≥ 0.4Hz is generated, a short delay is set to automatically cut off fast controllable resources;

[0119] Operation status monitoring module: uses decentralized control devices to centrally monitor the operation status of each controllable resource.

[0120] The computer device may be a server. The computer device includes a processor, a memory, an input / output interface (I / O for short) and a communication interface. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface is connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data cluster data of the power monitoring system. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a method for penetrating a forward and reverse isolation device based on MQTT is implemented.

[0121] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0122] Example 2

[0123] As an embodiment of the present invention, a method for realizing penetration of forward and reverse isolation devices based on MQTT is provided. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation / comparative experiments.

[0124] This embodiment considers a large-scale Internet of Things (IoT) application scenario, which includes thousands of devices distributed in multiple geographical locations. These devices are divided into different security domains, and each domain carries different types of data and services. Such an environment places extremely high demands on data processing speed, security, efficient use of system resources, and network load balancing.

[0125] Evaluate and compare the real-time performance of MQTT message processing. Verify the security of data transmission and reduce security violations. Optimize the utilization of system resources and improve the overall operating efficiency of the system. Improve the response speed of network load balancing and ensure the stability and reliability of network communication. Compare the communication success rate to demonstrate the improvement of system reliability.

[0126] Three groups of experimental objects are designed: prior art A, prior art B and the present invention. Each group runs the same communication and data processing tasks under the same hardware and network environment.

[0127] Analyze key indicators such as MQTT message processing delay, number of data transmission security violations, system resource utilization, network load balancing response time, and communication success rate for each group. Use statistical analysis methods to compare the average performance of the three groups and identify improvements in various indicators of the invention embodiment. Explore how the technical strategies used in the invention embodiment can specifically improve system performance and security.

[0128] Through comparative analysis, the embodiments of the invention adopt advanced encryption technology, intelligent load balancing algorithm and efficient resource management strategy, which significantly reduces the consumption of system resources while ensuring communication security, improves the real-time nature of message processing and the overall performance of the system. This invention not only solves the challenges faced by the prior art in processing high-density and high-frequency IoT data communications, but also demonstrates significant innovation and application value in improving communication efficiency, ensuring data security and optimizing resource allocation. The experimental data can be found in Table 1.

[0129] Table 1 Experimental data reference table

[0130]

[0131] From the above table data, it can be clearly seen that the present invention significantly reduces the delay time of message processing, from 93ms of prior art A and 88ms of technology B to 47ms, which is almost halved, which is crucial for IoT applications that require real-time or near real-time processing. The present invention achieves zero violation events, while prior art A and B record 5 and 4 violation events respectively. This result highlights the significant advantages of the invention in ensuring data transmission security. By optimizing algorithms and strategies, the present invention also performs well in system resource utilization, which is reduced to 58%, compared with 72% of prior art A and 69% of technology B, making more efficient use of system resources and reducing costs. The present invention reduces the response time to 95ms, compared with 205ms of prior art A and 190ms of technology B, significantly improving the network's responsiveness and ability to handle high-load situations. The present invention achieves a communication success rate of 99%, which further improves the reliability of communication compared to 94% of prior art A and 96% of technology B.

[0132] Through comparative analysis, it can be clearly seen that the embodiments of the invention are significantly improved in terms of improving the performance and security of the MQTT communication system compared to the prior art. This innovation is not only reflected in reducing message processing delays and improving the security of data transmission, but also includes more efficient resource utilization and faster network load response capabilities, as well as a higher communication success rate. These advantages together provide IoT applications with a more reliable, efficient and secure data communication solution, demonstrating the application value and potential of the invention in the field of modern network communications.

[0133] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A method for penetrating a forward and reverse isolation device based on MQTT, characterized in that: include: Determine the network architecture that requires forward and reverse isolation, and identify each security domain and the devices that need to communicate; Set up an MQTT proxy server in each security domain and configure it accordingly; Establishing channels for forward and reverse communication; In the devices of each security domain, set up the MQTT client, set the QoS level and the message retention flag; Configure access control rules on the MQTT broker.

2. The method for penetrating a forward and reverse isolation device based on MQTT as claimed in claim 1, characterized in that: The network architecture that needs to be isolated in both forward and reverse directions includes: When the network architecture involves communication across security domains with different security levels, it is determined to be a network architecture that requires forward and reverse isolation; If the network architecture includes sensitive data processing, critical infrastructure management, or involves the transmission of highly confidential information from a high-security level area to a low-security level area or vice versa, it is determined to be a network architecture that requires forward and reverse isolation; When the communication in the network architecture is limited to the security domain of the same security level, or when the network architecture is designed to process non-sensitive information and does not involve data transmission across security domains, it is determined to be a network architecture that does not require forward and reverse isolation.

3. The method for penetrating a forward and reverse isolation device based on MQTT as claimed in claim 2, characterized in that: The setting of the MQTT proxy server includes: Each MQTT proxy server refers to a listening port, receiving connection requests from devices within the security domain; Implement a secure authentication mechanism, use TLS / SSL encryption protocol, and authenticate based on username and password to establish connections only with authorized devices; For cross-security zone communications, configure routing rules, including: When a device requests to send a message from one security domain to another, the authentication and authorization status of the device is checked. If the device has passed the security authentication and has the corresponding communication authority, the message is allowed to pass; otherwise, the communication request is rejected. When a message needs to be transmitted from a high-security domain to a low-security domain, a security check is performed on the message, including content filtering and virus scanning. When a message is transmitted from a low-security domain to a high-security domain, a security check is performed and identity authentication and data encryption are performed. When there are multiple possible routing paths, the optimal path is selected according to a predefined routing priority rule, where the priority is determined based on the security level and communication delay of the path.

4. The method for realizing penetration of forward and reverse isolation devices based on MQTT as claimed in claim 3, characterized in that: The corresponding configuration includes setting up intelligent load balancing and real-time monitoring of the workload of each MQTT proxy server; Use the evaluation algorithm to analyze the monitored data, predict the future load of each MQTT proxy server, and determine whether load adjustment is needed; Based on the prediction results, new or existing MQTT connections are automatically adjusted to the less loaded proxy servers.

5. The method for penetrating a forward and reverse isolation device based on MQTT as claimed in claim 4, characterized in that: The data analyzed and monitored by the evaluation algorithm include the formula: Among them, P represents the system performance evaluation result, U represents the network bandwidth utilization, μ and σ represent the mean and standard deviation of the packet size respectively, α, β, γ, δ, ζ and ∈ are weight parameters adjusted according to the system performance evaluation requirements; the integral part represents the cumulative distribution function (CDF) of the packet size distribution, which is used to measure the system's ability to handle packets of different sizes; the ln(λC) term considers the relationship between the packet arrival rate and the system processing capacity, indicating the amount of data that the system can efficiently process, λ represents the data arrival rate, and C represents the system processing capacity; the cos(∈U) term is used to introduce periodic changes to simulate the impact of network bandwidth utilization changing over time; represents an integral expression for calculating the probability of a packet size smaller than the mean μ, where x represents the packet size.

6. The method for penetrating a forward and reverse isolation device based on MQTT as claimed in claim 5, characterized in that: The establishment of the forward communication and reverse communication channels includes initializing the MQTT proxy server in each security domain and setting basic parameters for forward and reverse communication; Two-way authentication is performed through TLS / SSL certificates. Communication permissions are dynamically allocated based on the security level of the device and the sensitivity of the communication content, allowing only authorized devices to participate in forward and reverse communications. Dynamically select the most appropriate routing path based on real-time network conditions and security level differences between security domains; All data transmitted through forward and reverse channels is end-to-end encrypted, and content filtering mechanisms are implemented; When pushing data from a low-security domain to a high-security domain, a forward channel is established, which allows data to be uploaded and ensures the integrity and confidentiality of the data; When it is necessary to configure or issue control commands to devices in a high-security domain, they are executed through the forward channel and the authenticity and authorization of the command source are ensured; When users and devices in a low-security domain request access to resources and services in a high-security domain, they are processed through the forward channel and authenticated and authorized at the same time; When the high-security domain needs to send processing results, operation feedback, and alarm information to the low-security domain, the information is transmitted through the back channel; When data synchronization or backup is performed, when data in a high-security domain needs to be backed up to a storage system in a low-security domain, this is done through a reverse channel; When a request in a low-security domain is accepted and processed by a high-security domain, the processing result and service response need to be returned to the low-security domain through a reverse channel.

7. The method for penetrating a forward and reverse isolation device based on MQTT as claimed in claim 6, characterized in that: The configuration of access control rules on the MQTT proxy server includes: Set up an authentication mechanism to ensure that only authenticated clients can connect to the MQTT broker server; Based on the MQTT topic subscription model, set access permissions for different topics to ensure that clients can only subscribe to and publish topics they have access to; Force all communications through the MQTT broker to use encrypted TLS / SSL transport; Introduce a message content filtering mechanism to check the content of messages entering and leaving the MQTT proxy server, and automatically intercept messages containing sensitive information or that do not comply with security policies; Set limits on connection frequency and quantity to prevent malicious connection attacks from affecting the MQTT proxy server.

8. A system for implementing forward and reverse isolation device penetration based on MQTT using the method according to any one of claims 1 to 7, characterized in that: Network architecture and security domain identification module: determines the network architecture that needs to be isolated in both the forward and reverse directions, and identifies each security domain and the devices that need to communicate; MQTT proxy server configuration module: Set up the MQTT proxy server in each security domain and perform corresponding configuration; Communication channel establishment module: establishes channels for forward communication and reverse communication; Device client configuration module: Set up MQTT client, QoS level and message retention flag in devices in each security domain; Access control rule configuration module: configure access control rules on the MQTT proxy server.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images