Network security transmission method for accessing electric power information intranet and related equipment

Abstract

The invention relates to the technical field of network security, and discloses a network security transmission method for accessing an electric power information intranet and related equipment.The method comprises the steps that an access request sent by a security agent module is received, and a control security channel interacting with the security agent module is established according to the access request; exchanging parameters with a security agent module in the control security channel, and authenticating the exchanged parameters to obtain an authentication result; exchanging a pre-shared key for data encryption with the security agent module based on the authentication result, and establishing a data security channel according to the pre-shared key for data encryption; the control security channel is used for negotiation and authentication of security parameters, the data security channel focuses on transmission of encrypted data, and the security control channel and the data security channel are established step by step, so that the security control channel and the data security channel are established step by step, and the security control channel and the security control channel are established step by step, and the security control channel and the security control channel are established step by step. And hierarchical protection of the communication process is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network security transmission method and related equipment for accessing an electric power information intranet. Background Art

[0002] With the rapid development of Internet of Things technology and the continuous expansion of its application scope, Internet of Things terminals have become an indispensable part of the modern power system. They are widely distributed in various links such as power generation, transmission, transformation, distribution and power consumption, realizing real-time monitoring, data collection and remote control of the power system operation status. The data interaction between these Internet of Things terminals and the power information intranet has not only greatly improved the intelligence level of the power system, but also promoted the optimal allocation and efficient use of power resources.

[0003] However, with the increasing frequency of data interaction, the complexity and uncertainty of the network environment are also increasing. Security threats in cyberspace are becoming increasingly severe, including but not limited to malicious attacks by hackers, illegal theft and tampering of data, and the spread and proliferation of viruses. These security threats may not only lead to the leakage or destruction of important data in the power information intranet, but also have a serious impact on the stable operation of the power system, and even cause serious consequences such as large-scale power outages, posing a huge threat to national security, social stability and people's lives.

[0004] Therefore, how to ensure that IoT terminals can achieve safe and efficient data transmission when accessing the power information intranet has become a key issue that needs to be urgently addressed in the current power industry. Summary of the invention

[0005] In order to overcome the defects of the above-mentioned prior art, the purpose of the present invention is to provide a network security transmission method and related equipment for accessing the power information intranet, so as to solve the technical problem of poor network transmission security in the prior art.

[0006] The present invention is achieved through the following technical solutions: In a first aspect, the present invention provides a network security transmission method for accessing an electric power information intranet, comprising: Receiving an access request sent by a security proxy module, and establishing a control security channel for interacting with the security proxy module according to the access request; exchanging parameters with the security proxy module in the control security channel, and authenticating the exchanged parameters to obtain an authentication result; Based on the authentication result, a pre-shared key for data encryption is exchanged with the security proxy module, and a data security channel is established according to the pre-shared key for data encryption; The data security channel processes the received SSL data packets and transmits them securely over the network through the data security channel.

[0007] Preferably, an access request sent by a security proxy module is received, and a control security channel for interaction with the security proxy module is established according to the access request, wherein the establishment process is as follows: Receiving an access request sent by a security proxy module, wherein the request includes identity information of the security proxy module, a service type requested for access, and security requirement information; Perform verification according to the accessed request and obtain the verification result; A protocol used for interacting with the security proxy module is established based on the verification result, and a control security channel is established based on the protocol used, wherein the protocol includes an encryption protocol, a key management protocol, and an authentication protocol.

[0008] Preferably, parameters are exchanged with the security proxy module in the control security channel, and the exchanged parameters are authenticated to obtain an authentication result, wherein the authentication process is as follows: Exchange initialization parameters and business parameters with the security proxy module; Performing integrity check and identity authentication on the initialization parameters and business parameters; If both the integrity check and identity authentication are passed, the authentication is successful and the communication service is carried out; otherwise, the authentication fails and the communication is terminated.

[0009] Furthermore, in integrity verification, the integrity of the parameters is determined by calculating the hash value or message authentication code of the parameters; in identity authentication, the identity is determined through digital signature and certificate verification.

[0010] Preferably, a pre-shared key for data encryption is exchanged with the security agent module based on the authentication result, wherein the pre-shared key is the same key as confirmed by the security agent module.

[0011] Preferably, the data security channel processes the received SSL data packet as follows: The data security channel first receives the SSL encrypted data packet transmitted from the external network or data source; Verify the integrity and identity authentication of SSL packets; Decrypt the SSL data packet using the AES algorithm using the key in the SSL / TLS protocol; Parse the decrypted data to extract specific application layer data, where the parsing process includes identifying the data format and extracting the fields; The extracted data is processed, including data format conversion and data content cleaning.

[0012] Preferably, the processed SSL data is transmitted securely over the data security channel through one-way isolation.

[0013] In a second aspect, the present invention provides a network security transmission system for accessing an electric power information intranet, comprising: A control security channel establishment module, used to receive an access request sent by the security proxy module, and establish a control security channel for interacting with the security proxy module according to the access request; An authentication module, used to exchange parameters with the security proxy module in the control security channel, and authenticate the exchanged parameters to obtain an authentication result; A pre-shared key data security channel establishment module, used to exchange a pre-shared key for data encryption with the security proxy module based on the authentication result, and establish a data security channel according to the pre-shared key for data encryption; The data transmission module is used for processing the received SSL data packets through the data security channel to perform network security transmission through the data security channel.

[0014] In a third aspect, the present invention also provides a mobile terminal comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the network secure transmission method for accessing an electric power information intranet as described above is implemented.

[0015] In a fourth aspect, the present invention further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the network security transmission method for accessing an electric power information intranet as described above.

[0016] Compared with the prior art, the present invention has the following beneficial technical effects: The present invention provides a network security transmission method for accessing an electric power information intranet. By establishing a data security channel and using a pre-shared key to encrypt data, it ensures that the data in the transmission process is not stolen or snooped by an unauthorized third party, and effectively protects the security of sensitive data in the electric power information intranet. Parameters are exchanged with a security proxy module in a control security channel and strict authentication is performed. This process not only verifies the identities of both parties, but also ensures the legality and credibility of subsequent communications, reducing the risk of counterfeit attacks. By establishing a control security channel and a data security channel in steps, hierarchical protection of the communication process is achieved. The control security channel is used for the negotiation and authentication of security parameters, while the data security channel focuses on the transmission of encrypted data. This hierarchical design improves the security and flexibility of the overall system.

[0017] Furthermore, the present invention supports the reception and processing of SSL data packets and transmits them through a data security channel, which means that even in a complex and changeable network environment, the security and integrity of the data can be guaranteed, meeting the needs of the power information intranet for high-security communications.

[0018] Furthermore, the present invention reduces the complexity of system management and maintenance through standardized secure channel establishment and data encryption processes. At the same time, due to the use of mechanisms such as pre-shared keys, it is also convenient to update and manage keys when necessary, ensuring the long-term safe and stable operation of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 This is a flow chart of a network security transmission method for accessing an electric power information intranet in an embodiment of the present invention; Figure 2 This is a structural diagram of a network security transmission system accessed to an electric power information intranet in an embodiment of the present invention; In the figure: 1-control security channel establishment module; 2-authentication module; 3-pre-shared key data security channel establishment module; 4-data transmission module. DETAILED DESCRIPTION

[0020] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0021] The present invention is further described in detail below in conjunction with the accompanying drawings: The purpose of the present invention is to provide a network security transmission method and related equipment for accessing an electric power information intranet, so as to solve the technical problem of poor network transmission security in the prior art.

[0022] See also Figure 1 In one embodiment of the present invention, a network security transmission method for accessing an electric power information intranet is provided, comprising: Step 1, receiving an access request sent by a security proxy module, and establishing a control security channel for interaction with the security proxy module according to the access request; Specifically, an access request sent by a security proxy module is received, and a control security channel for interaction with the security proxy module is established according to the access request, wherein the establishment process is as follows: Receiving an access request sent by a security proxy module, wherein the request includes identity information of the security proxy module, a service type requested for access, and security requirement information; Perform verification according to the accessed request and obtain the verification result; A protocol used for interacting with the security proxy module is established based on the verification result, and a control security channel is established based on the protocol used, wherein the protocol includes an encryption protocol, a key management protocol, and an authentication protocol.

[0023] In the specific process of this embodiment, the system receives an access request sent from the security proxy module, wherein the request content includes the identity information of the security proxy module, the service type requested for access, and security requirement information; The system performs verification based on the identity information in the received access request, which usually involves checking the validity of the certificate, the correctness of the digital signature, etc., to ensure that the identity of the security proxy module is authentic.

[0024] Based on the verification results and the security requirements in the access request, the system will select an appropriate protocol to establish a control security channel. The protocols include: Encryption protocol: used to ensure the confidentiality of data transmitted in the channel, such as TLS / SSL protocol.

[0025] Key management protocol: used to negotiate and manage encryption keys to ensure key security and validity.

[0026] Authentication protocol: used to perform identity authentication between communicating parties to ensure that the identities of both parties are authentic and reliable.

[0027] Finally, according to the selected protocol, the system and the security agent module begin to establish a control security channel. This process usually includes key negotiation, identity authentication, encrypted communication and other steps to ensure the security and reliability of the channel.

[0028] Step 2, exchanging parameters with the security proxy module in the control security channel, and authenticating the exchanged parameters to obtain an authentication result; Specifically, the authentication process is as follows: Exchange initialization parameters and business parameters with the security proxy module; Performing integrity check and identity authentication on the initialization parameters and business parameters; If both the integrity check and identity authentication are passed, the authentication is successful and the communication service is carried out; otherwise, the authentication fails and the communication is terminated.

[0029] Among them, in the integrity check, the integrity of the parameters is determined by calculating the hash value or message authentication code of the parameters; in the identity authentication, the identity is determined by digital signature and certificate verification.

[0030] Specifically, integrity checking the exchanged initialization parameters and service parameters is an important step to ensure that the parameters have not been tampered with during transmission. This is achieved by calculating the hash value of the parameter (such as MD5, SHA-256, etc.) and comparing it with the received hash value. If the hash values ​​are consistent, it means that the parameters remain intact during transmission; otherwise, tampering may have occurred.

[0031] After completing the integrity check, both parties need to perform identity authentication. This usually involves using security mechanisms such as digital certificates and digital signatures to verify the identity of the other party. For example, the security agent module may provide its digital certificate to the system, and the system confirms the identity of the security agent module by verifying the validity of the certificate (such as checking the certificate chain, certificate revocation list, etc.). At the same time, the system can also require the security agent module to provide a digital signature of its identity, and further confirm its identity by verifying the correctness of the signature.

[0032] Step 3: exchanging a pre-shared key for data encryption with the security proxy module based on the authentication result, and establishing a data security channel according to the pre-shared key for data encryption; Specifically, after completing the parameter exchange and authentication process in the control security channel, the system will determine whether to continue communicating with the security proxy module based on the authentication result. Only when the authentication result is successful will the subsequent pre-shared key exchange step be performed.

[0033] In order to exchange pre-shared keys securely, a key negotiation protocol is used between the system and the security agent module. This protocol can ensure that the key is not eavesdropped or tampered with during the exchange process. Common key negotiation protocols include Diffie-Hellman (DH) protocol, RSA key exchange, etc.

[0034] According to the key negotiation protocol, the system and the security proxy module will jointly generate a pre-shared key, or one party will generate a key and distribute it to the other party in a secure manner. This pre-shared key will serve as the basis for subsequent data encryption.

[0035] After obtaining the pre-shared key during the establishment of the data security channel, the system and the security agent module will negotiate and select a suitable encryption protocol to establish the data security channel. This encryption protocol will be used to protect the confidentiality, integrity and availability of the data transmitted in the channel. When the data security channel is successfully established, all communications between the system and the security agent module will be carried out through the channel, and all transmitted data will be encrypted and decrypted using the pre-shared key. In this way, even if the data is intercepted during the transmission process, it cannot be decrypted and read by an unauthorized third party.

[0036] Step 4: The data security channel processes the received SSL data packet and transmits it securely through the data security channel.

[0037] Specifically, the data security channel processes the received SSL data packets as follows: The data security channel first receives the SSL encrypted data packet transmitted from the external network or data source; Verify the integrity and identity authentication of SSL packets; Decrypt the SSL data packet using the AES algorithm using the key in the SSL / TLS protocol; Parse the decrypted data to extract specific application layer data, where the parsing process includes identifying the data format and extracting the fields; The extracted data is processed, including data format conversion, data content cleaning, invalid data removal, erroneous data correction and data format conversion.

[0038] Among them, the data security channel will perform integrity verification on the received SSL data packets in the verification of SSL data packet integrity and identity authentication. This is usually achieved by verifying the hash value of the data packet (such as MD5, SHA-256, etc.) to ensure that the data packet has not been tampered with during transmission. At the same time, the data security channel will also authenticate the data packet. This involves verifying the identity of the sender of the data packet to ensure that the data packet is sent by a legitimate sender. In the SSL / TLS protocol, this is usually achieved by verifying digital certificates and signatures.

[0039] Among them, after the SSL data packet is verified in the AES algorithm decryption by the key in the SSL / TLS protocol, the data security channel will use the pre-shared key negotiated in the SSL / TLS protocol to decrypt the SSL data packet. The AES algorithm is a symmetric encryption algorithm used to encrypt and decrypt data. However, the SSL / TLS protocol actually combines two technologies, symmetric encryption and asymmetric encryption. In the handshake phase, the two parties will use asymmetric encryption (such as RSA) to negotiate a symmetric encryption key, and then use this symmetric key for encryption and decryption in the data transmission phase.

[0040] The decrypted data is the encrypted form of the application layer data. The data security channel needs to parse it to extract the specific application layer data. The parsing process includes the identification of the data format and the extraction of the fields.

[0041] The extracted data is processed, including data format conversion and data content cleaning. Data format conversion converts the extracted data into different formats as needed to adapt to different application scenarios or system requirements; data content cleaning includes removing invalid data, correcting erroneous data, and converting data formats to ensure data accuracy and availability. These operations help improve the efficiency and quality of subsequent data processing and application.

[0042] Specifically, in this embodiment, the processed SSL data is securely transmitted in a data security channel through a one-way isolation method.

[0043] The one-way isolation method in this embodiment ensures that data can only flow in one direction, usually from a low-security level area to a high-security level area, effectively preventing potential network attacks and data leaks. In a data security channel, this means that processed SSL data can only be transmitted one-way from one security area (such as an external network) to another area with a higher security level (such as an internal network).

[0044] Among them, unidirectional isolation can be achieved through physical means (such as unidirectional network gates) or logical means (such as unidirectional data transmission protocols implemented by software). Physical isolation usually involves the use of specialized hardware devices to ensure the unidirectionality of data flow; while logical isolation relies on software algorithms and protocols to simulate unidirectional data flow.

[0045] In summary, the present invention provides a network security transmission method for accessing the electric power information intranet. By establishing a data security channel and using a pre-shared key to encrypt data, it ensures that the data in the transmission process is not stolen or snooped by unauthorized third parties, and effectively protects the security of sensitive data in the electric power information intranet. The parameters are exchanged with the security agent module in the control security channel and strict authentication is performed. This process not only verifies the identities of both parties, but also ensures the legality and credibility of subsequent communications, reducing the risk of counterfeit attacks. By establishing a control security channel and a data security channel in steps, hierarchical protection of the communication process is achieved. The control security channel is used for the negotiation and authentication of security parameters, while the data security channel focuses on the transmission of encrypted data. This layered design improves the security and flexibility of the overall system.

[0046] Example 2 according to Figure 2 As shown, this embodiment provides a network security transmission system for accessing the power information intranet, including a control security channel establishment module 1, an authentication module 2, a pre-shared key data security channel establishment module 3 and a data transmission module 4; A control security channel establishment module 1 is used to receive an access request sent by a security proxy module and establish a control security channel for interacting with the security proxy module according to the access request; Authentication module 2, used for exchanging parameters with the security proxy module in the control security channel, and authenticating the exchanged parameters to obtain an authentication result; A pre-shared key data security channel establishing module 3 is used to exchange a pre-shared key for data encryption with the security proxy module based on the authentication result, and establish a data security channel according to the pre-shared key for data encryption; The data transmission module 4 is used for processing the received SSL data packets through the data security channel to perform network security transmission through the data security channel.

[0047] Example 3 The present invention also provides a mobile terminal, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, such as a network security transmission program accessing an electric power information intranet.

[0048] When the processor executes the computer program, the steps of the above-mentioned network security transmission method for accessing the power information intranet are implemented, for example: Receiving an access request sent by a security proxy module, and establishing a control security channel for interacting with the security proxy module according to the access request; exchanging parameters with the security proxy module in the control security channel, and authenticating the exchanged parameters to obtain an authentication result; Based on the authentication result, a pre-shared key for data encryption is exchanged with the security proxy module, and a data security channel is established according to the pre-shared key for data encryption; The data security channel processes the received SSL data packets and transmits them securely over the network through the data security channel.

[0049] Alternatively, when the processor executes the computer program, the functions of each module in the above system are realized, for example: A control security channel establishment module 1 is used to receive an access request sent by a security proxy module and establish a control security channel for interacting with the security proxy module according to the access request; Authentication module 2, used for exchanging parameters with the security proxy module in the control security channel, and authenticating the exchanged parameters to obtain an authentication result; A pre-shared key data security channel establishing module 3 is used to exchange a pre-shared key for data encryption with the security proxy module based on the authentication result, and establish a data security channel according to the pre-shared key for data encryption; The data transmission module 4 is used for processing the received SSL data packets through the data security channel and performing network security transmission through the data security channel.

[0050] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to implement the present invention. The one or more modules / units may be a series of computer program instruction segments capable of implementing specific functions, which are used to describe the execution process of the computer program in the mobile terminal.

[0051] For example, the computer program may be divided into a control secure channel establishment module 1, an authentication module 2, a pre-shared key data secure channel establishment module 3, and a data transmission module 4; The specific functions of each module are as follows: A control security channel establishment module 1 is used to receive an access request sent by a security proxy module and establish a control security channel for interacting with the security proxy module according to the access request; Authentication module 2, used for exchanging parameters with the security proxy module in the control security channel, and authenticating the exchanged parameters to obtain an authentication result; A pre-shared key data security channel establishing module 3 is used to exchange a pre-shared key for data encryption with the security proxy module based on the authentication result, and establish a data security channel according to the pre-shared key for data encryption; The data transmission module 4 is used for processing the received SSL data packets through the data security channel and performing network security transmission through the data security channel.

[0052] The mobile terminal may be a computing device such as a desktop computer, a notebook, a palm computer, a cloud server, etc. The mobile terminal may include, but is not limited to, a processor and a memory.

[0053] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the mobile terminal, and uses various interfaces and lines to connect various parts of the entire mobile terminal.

[0054] The memory may be used to store the computer programs and / or modules, and the processor implements various functions of the mobile terminal by running or executing the computer programs and / or modules stored in the memory and calling the data stored in the memory.

[0055] The memory may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (SmartMediaCard, SMC), a secure digital (SecureDigital, SD) card, a flash card (FlashCard), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0056] Example 4 The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the network secure transmission method for accessing an electric power information intranet are implemented.

[0057] If the module / unit integrated in the mobile terminal is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0058] Based on such understanding, the present invention implements all or part of the processes in the above method, and can also be completed by instructing related hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and when the computer program is executed by a processor, the steps of the above-mentioned network security transmission method for accessing the power information intranet can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc.

[0059] The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal and software distribution medium, etc.

[0060] It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media does not include electrical carrier signals and telecommunication signals.

[0061] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A network security transmission method for accessing an electric power information intranet, characterized in that: include: Receiving an access request sent by a security proxy module, and establishing a control security channel for interacting with the security proxy module according to the access request; exchanging parameters with the security proxy module in the control security channel, and authenticating the exchanged parameters to obtain an authentication result; Based on the authentication result, a pre-shared key for data encryption is exchanged with the security proxy module, and a data security channel is established according to the pre-shared key for data encryption; The data security channel processes the received SSL data packets and transmits them securely over the network through the data security channel.

2. A network security transmission method for accessing an electric power information intranet according to claim 1, characterized in that: Receive an access request sent by the security proxy module, and establish a control security channel for interacting with the security proxy module according to the access request, wherein the establishment process is as follows: receiving an access request sent by a security proxy module, wherein the request includes identity information of the security proxy module, a service type requested for access, and security requirement information; Perform verification according to the accessed request and obtain the verification result; A protocol used for interacting with the security proxy module is established based on the verification result, and a control security channel is established based on the protocol used, wherein the protocol includes an encryption protocol, a key management protocol, and an authentication protocol.

3. A network security transmission method for accessing an electric power information intranet according to claim 1, characterized in that: Parameters are exchanged with the security proxy module in the control security channel, and the exchanged parameters are authenticated to obtain an authentication result, wherein the authentication process is as follows: Exchange initialization parameters and business parameters with the security proxy module; Performing integrity check and identity authentication on the initialization parameters and business parameters; If both the integrity check and identity authentication are passed, the authentication is successful and the communication service is carried out; otherwise, the authentication fails and the communication is terminated.

4. A network security transmission method for accessing an electric power information intranet according to claim 3, characterized in that: In integrity verification, the integrity of the parameters is determined by calculating the hash value or message authentication code of the parameters; in identity authentication, the identity is determined through digital signature and certificate verification.

5. A network security transmission method for accessing an electric power information intranet according to claim 1, characterized in that: Based on the authentication result, a pre-shared key for data encryption is exchanged with the security agent module, wherein the pre-shared key is the same key as that confirmed by the security agent module.

6. A network security transmission method for accessing an electric power information intranet according to claim 1, characterized in that: The data security channel processes the received SSL data packets as follows: The data security channel first receives the SSL encrypted data packet transmitted from the external network or data source; Verify the integrity and identity authentication of SSL packets; Decrypt the SSL data packet using the AES algorithm using the key in the SSL / TLS protocol; Parse the decrypted data to extract specific application layer data, where the parsing process includes identifying the data format and extracting the fields; The extracted data is processed, including data format conversion and data content cleaning.

7. The method for secure transmission of power information network accessed to an intranet according to claim 1, characterized in that: The processed SSL data is transmitted securely over the data security channel through one-way isolation.

8. A network security transmission system connected to an electric power information intranet, characterized in that: include A control security channel establishment module (1) is used to receive an access request sent by a security proxy module and establish a control security channel for interacting with the security proxy module according to the access request; An authentication module (2) is used to exchange parameters with the security proxy module in the control security channel, and authenticate the exchanged parameters to obtain an authentication result; A pre-shared key data security channel establishment module (3), used to exchange a pre-shared key for data encryption with the security proxy module based on the authentication result, and to establish a data security channel according to the pre-shared key for data encryption; The data transmission module (4) is used for the data security channel to process the received SSL data packet and perform network security transmission through the data security channel.

9. A mobile terminal, characterized in that: It includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the network security transmission method for accessing the power information intranet as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the network security transmission method for accessing the power information intranet as claimed in any one of claims 1 to 7 is implemented.

Images