Cross-security domain SNMP protocol message data transmission method and system, and storage medium

Abstract

The invention discloses a cross-security domain SNMP protocol message data transmission method and system and a storage medium, and belongs to the field of power system communication. The method is suitable for a communication security protection device in each security domain in a cross-security domain SNMP message data transmission system, and comprises the following steps of: signing to-be-transmitted SNMP message data in the current security domain, adding timestamp information, and performing encryption processing to generate encrypted transmission data. And transmitting the encrypted transmission data to the communication security protection devices of the other security domains through the constructed transmission link, so that the communication security protection devices of the other security domains carry out decryption and signature verification on the encrypted transmission data to obtain final SNMP protocol message data. And in the case of signature verification failure, discarding the encrypted transmission data and disconnecting the transmission link. By implementing the method and the device, the problems of high calculation overhead and incapability of cross-security domain communication in the prior art are solved, and quantum attacks occurring in the future can be resisted.

Description

Technical Field

[0001] The present invention relates to the technical field of power system communications, and in particular to a method, system and storage medium for transmitting SNMP protocol message data across security domains. Background Art

[0002] With the development of smart grids, the automation level of power systems continues to increase, and network management has become a key means of power system operation and maintenance. The Simple Network Management Protocol (SNMP), a widely used network management standard, is used in power systems to monitor the status of network devices, collect network performance data, and configure network devices. However, in practice, the network security environment of power systems is often divided into different security domains, each with strict data access control policies. This poses challenges to traditional SNMP message transmission.

[0003] Currently, security is primarily ensured by adding layers of data encryption and strengthening key management to enable cross-security domain data exchange. However, the addition of encryption layers significantly increases computational overhead, while enhanced key management cannot effectively address security threats in cross-security domain communications, such as data tampering attacks, making it difficult to meet the requirements of power systems. Furthermore, these classical cryptographic algorithms are vulnerable to quantum attacks, posing potential security risks in the face of rapidly developing quantum computing technology.

[0004] Therefore, it is urgent to solve the problems in existing technologies such as high computational overhead and inability to cope with security threats in cross-security domain communications. Summary of the Invention

[0005] The embodiment of the present invention provides a cross-security domain SNMP protocol message data transmission method, system and storage medium, which can effectively solve the problems of high computational overhead and inability to cope with security threats in cross-security domain communications in the prior art.

[0006] An embodiment of the present invention provides a cross-security domain SNMP protocol message data transmission method, which is applicable to a communication security protection device in each security domain in a cross-security domain SNMP protocol message data transmission system; the cross-security domain SNMP protocol message data transmission system also includes a plurality of communication devices and switches; a security domain includes a communication security protection device and a plurality of communication devices;

[0007] The cross-security domain SNMP protocol message data transmission method includes:

[0008] Obtain the SNMP protocol message data to be transmitted by the communication device in the current security zone;

[0009] Perform hash calculation on the SNMP protocol message data to be transmitted to generate a message digest; and perform signing on the message digest to generate a digital signature;

[0010] Adding timestamp information to the SNMP protocol message data to be transmitted to obtain first communication data; performing encryption processing based on the digital signature and the first communication data to generate encrypted transmission data;

[0011] A transmission link is built based on the switch and the communication security protection devices of the remaining security domains, and the encrypted transmission data is transmitted to the communication security protection devices of the remaining security domains through the transmission link, so that the communication security protection devices of the remaining security domains decrypt and verify the encrypted transmission data to obtain the final SNMP protocol message data, and send the final SNMP protocol message data to the communication equipment of the remaining security domains; if the signature verification fails, the encrypted transmission data is discarded and the transmission link is disconnected.

[0012] Furthermore, it also includes:

[0013] Determine the data format corresponding to the security level of the SNMP protocol message data to be transmitted, wherein the security level and the data format correspond to each other.

[0014] According to the corresponding data format, the message format of the SNMP protocol message data to be transmitted is converted to obtain the final SNMP protocol message data to be transmitted.

[0015] Furthermore, signing the information digest to generate a digital signature includes:

[0016] Signing the information digest according to the private key of the preset signature key pair and the preset cryptographic hash function to generate a data signature;

[0017] Among them, the communication security protection device in each security domain stores a preset signature key pair; the preset signature key pair is updated regularly.

[0018] Furthermore, encryption processing is performed according to the digital signature and the first communication data to generate encrypted transmission data, including:

[0019] Encapsulating the digital signature and the first communication data to obtain target communication data representing that the first communication data has the digital signature;

[0020] Encrypting the target communication data according to the private key of the preset encryption key pair to generate encrypted transmission data;

[0021] Among them, the communication security protection device in each security domain stores a preset encryption key pair; the preset encryption key pair is updated regularly.

[0022] Furthermore, the communication security protection devices of the remaining security domains decrypt and verify the encrypted transmission data to obtain the final SNMP protocol message data, including:

[0023] Decrypting the encrypted transmission data according to the public key of the preset encryption key pair to obtain decrypted data; the decrypted data includes: a decrypted digital signature and second communication data; wherein the second communication data represents SNMP protocol message data with timestamp information after the encrypted transmission data is decrypted by the communication security protection device of the remaining security domains;

[0024] Performing a hash operation on the second communication data to generate a new information digest;

[0025] Decrypt the decrypted digital signature according to the public key of the preset signature key pair to obtain the original information summary;

[0026] Compare the new information digest with the original information digest; if they are consistent, it is confirmed that the encrypted transmission data meets the data integrity conditions; if they are inconsistent, it is confirmed that the encrypted transmission data does not meet the data integrity conditions;

[0027] Verify whether the timestamp information corresponding to the second communication data is within a preset valid time window; if so, confirm that the encrypted transmission data meets the timeliness condition; if not, confirm that the encrypted transmission data does not meet the timeliness condition;

[0028] When both the data integrity condition and the timeliness condition are met, the second communication data is used as the final SNMP protocol message data;

[0029] If at least one of the data integrity condition and the timeliness condition is not met, the transmission link is disconnected; and it is determined whether the number of times the transmission link is disconnected exceeds the preset number threshold; if so, an alarm message is generated to enable staff to check.

[0030] Furthermore, the cross-security domain SNMP protocol message data communication data transmission system further includes a gateway;

[0031] The gateway is used to build an encrypted channel between the communication security protection device and the communication equipment after obtaining the final SNMP protocol message data, and transmit the SNMP protocol message data to be transmitted to the communication security protection device through the gateway through the encrypted channel;

[0032] It is also used to transmit the SNMP protocol message data to be transmitted in the current security domain according to the SNMP protocol message data transmission request when an SNMP protocol message data transmission request is received.

[0033] Furthermore, the SNMP protocol message data to be transmitted includes SNMP protocol encrypted message data.

[0034] As an improvement to the above solution, another embodiment of the present invention provides a cross-security domain SNMP protocol message data transmission system, comprising: communication security protection devices, communication equipment and switches within a plurality of security domains; a security domain includes a communication security protection device and a plurality of communication equipment;

[0035] The communication device is used to send the SNMP protocol message data to be transmitted to the communication security protection device;

[0036] The communication security protection device is used to obtain the SNMP protocol message data to be transmitted by the communication equipment in the current security domain;

[0037] Perform hash calculation on the SNMP protocol message data to be transmitted to generate a message digest; and perform signing on the message digest to generate a digital signature;

[0038] Adding timestamp information to the SNMP protocol message data to be transmitted to obtain first communication data; performing encryption processing based on the digital signature and the first communication data to generate encrypted transmission data;

[0039] The switch is used to establish a transmission link with the communication security protection devices of other security domains;

[0040] The communication security protection device is also used to transmit the encrypted transmission data to the communication security protection devices of the remaining security domains through the transmission link, so that the communication security protection devices of the remaining security domains decrypt and verify the encrypted transmission data to obtain the final SNMP protocol message data, and send the final SNMP protocol message data to the communication equipment of the remaining security domains; if the signature verification fails, the encrypted transmission data is discarded and the transmission link is disconnected.

[0041] Furthermore, the communication security protection device includes: an instruction anti-tampering device, a front-end communication device and a protocol message conversion device;

[0042] The instruction anti-tampering device is used to obtain SNMP protocol message data to be transmitted from a communication device in the current security domain; perform a hash calculation based on the SNMP protocol message data to be transmitted to generate a message digest; and perform a signature based on the message digest to generate a digital signature; add timestamp information to the SNMP protocol message data to be transmitted to obtain first communication data; and perform encryption processing based on the digital signature and the first communication data to generate encrypted transmission data;

[0043] The front-end communication device is used to transmit the encrypted transmission data to the protocol message conversion device of the communication security protection device of the other security domains through the transmission link established with the communication security protection device of the other security domains;

[0044] The protocol message conversion device is used to send the final SNMP protocol message data to the communication devices of other security domains after obtaining the final communication data; in the case of signature verification failure, the encrypted transmission data is discarded and the transmission link is disconnected.

[0045] Another embodiment of the present invention provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute a cross-security domain communication data transmission method described in the above embodiment.

[0046] By implementing the present invention, at least the following beneficial effects are achieved:

[0047] The present invention provides a method, system and storage medium for SNMP protocol message data transmission across security domains. The method can be applied to communication security protection devices in various security domains. By generating a digital signature from the information summary of the SNMP protocol message data to be transmitted by the communication equipment in the current security domain, the integrity of the data can be guaranteed and the amount of hash calculation can be reduced. At the same time, timestamp information is added to resist replay attacks and ensure the timeliness of the data. The digital signature and the first communication data are encrypted to generate encrypted transmission data, encryption and signature processing are realized, and the security of the encrypted transmission data is improved. A transmission chain is established based on the switch in the current security domain and the communication security protection devices in the other security domains. The encrypted transmission data is transmitted to the communication security protection devices of other security domains through the transmission link, so that the communication security protection devices in the other security domains can decrypt the encrypted transmission data to ensure that the data has not been tampered with or replayed during the transmission process. This can meet the communication needs of different security domains and can complete the encryption and decryption of the SNMP protocol message data to be transmitted without adding a data encryption layer, reducing communication overhead. At the same time, only one encryption and decryption is required, without the need to use too many keys for encryption and decryption. This can also ensure that the SNMP protocol message data to be transmitted can be correctly transmitted to other security domains, realizing cross-domain communication transmission, meeting the communication needs of the power system, and reducing cross-domain communication threats. In addition, after receiving the transmitted encrypted transmission data, the communication security protection devices in the other security domains can perform signature verification and decryption to obtain the final SNMP protocol message data. If the signature verification fails, it means that the encrypted transmission data may have been tampered with or an error occurred during the transmission process. The encrypted transmission data will be discarded and the transmission link will be disconnected, refusing to accept the encrypted transmission data, achieving a short connection while ensuring communication security within the current security domain. The present invention is not limited to a specific encryption and decryption algorithm during the encryption and decryption process. Therefore, in the case of resisting quantum attacks, a corresponding encryption and decryption algorithm can also be selected to achieve the transmission of SNMP protocol message data to be transmitted based on the data transmission framework of the present invention. Therefore, the present invention can reduce communication overhead while also addressing security threats in cross-security domain communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a flow chart of a method for transmitting SNMP protocol message data across security domains provided by one embodiment of the present invention;

[0049] Figure 2 This is a schematic diagram of the uplink data interaction and downlink data interaction process provided by an embodiment of the present invention;

[0050] Figure 3 The present invention provides a schematic structural diagram of a cross-security domain SNMP protocol message data transmission system. DETAILED DESCRIPTION

[0051] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0052] See also Figure 1 To address the existing issues of high computational overhead and inability to address security threats in cross-security domain communications, one embodiment of the present invention provides a flow chart illustrating a method for transmitting SNMP protocol messages across security domains. The method for transmitting SNMP protocol messages across security domains is applicable to communication security protection devices within each security domain in a cross-security domain SNMP protocol message data transmission system. The cross-security domain SNMP protocol message data transmission system also includes several communication devices and switches. A security domain includes a communication security protection device and several communication devices for enabling data transmission and interaction between different security domains.

[0053] Specifically, the cross-security domain SNMP protocol message data transmission system includes several security domains, each of which includes a communication security protection device and several communication devices, each of which also includes a switch. Communication devices represent communication terminals within a security domain. Security domains represent network areas with the same or similar security protection requirements and policies. The SNMP protocol message data to be transmitted represents the data that communication devices need to transmit between security domains.

[0054] The cross-security zone SNMP protocol message data transmission method includes:

[0055] S1. Obtain SNMP protocol message data to be transmitted from communication devices in the current security domain;

[0056] Specifically, the communication security protection device in the current security domain obtains the SNMP protocol message data to be transmitted by the communication device. This is the initial step of data transmission, ensuring that the communication security protection device can receive the data to be processed.

[0057] Preferably, it also includes:

[0058] Determine the data format corresponding to the security level of the SNMP protocol message data to be transmitted, wherein the security level and the data format correspond to each other.

[0059] According to the corresponding data format, the message format of the SNMP protocol message data to be transmitted is converted to obtain the final SNMP protocol message data to be transmitted.

[0060] In a preferred embodiment of the present invention, the SNMP protocol message data to be transmitted is converted into a message format based on the security level corresponding to the SNMP protocol message data to be transmitted, thereby obtaining the final SNMP protocol message data to be transmitted. Different security levels correspond to different data processing specifications and protocol requirements. Through the protocol message conversion, the data is ensured to conform to the transmission standards of the target security domain.

[0061] Specifically, security levels represent the level of data protection based on factors such as the sensitivity of the data. Different security levels correspond to different security protection strategies and data processing requirements. Data formats represent the organization and representation of data and correspond one-to-one with security levels. Different data formats are suitable for data transmission and processing at different security levels, such as specific communication protocol formats. For example, security levels include no authentication and no privacy (noAuthNoPriv), authentication and no privacy (authNoPriv), and authentication and privacy (authPriv). SNMPv3 allows for the configuration of different security levels to ensure that keys at different levels can only be accessed and used by authorized devices and users.

[0062] In a preferred embodiment of the present invention, the communication security protection device can automatically select an applicable format conversion algorithm according to the security level corresponding to the SNMP protocol type, and convert the format of the message so that it complies with the communication standard of the target device. After the communication device receives the SNMP request sent by the manager Manager (communication device), the agent (Agent) of the corresponding communication device generates an SNMP message (SNMP protocol message data to be transmitted) as required. Combined with the event-driven characteristics of the SNMP Trap mechanism, the network bandwidth occupancy rate is significantly reduced compared to the TCP protocol, meeting the concurrent monitoring needs of large-scale devices. The SNMPTrap mechanism is an important component of the SNMP protocol. Its event-driven characteristics refer to the mechanism actively sending alarms or notifications through "event triggering" rather than relying on periodic polling to obtain information.

[0063] In a preferred embodiment of the present invention, the data format corresponding to the security level of the SNMP protocol message data to be transmitted is first determined. For example, a high security level corresponds to a data format with a strong encryption and authentication mechanism, and a low security level corresponds to a relatively simple data format. Then, based on the determined data format, the decrypted SNMP protocol message data to be transmitted is subjected to protocol message conversion so that the data meets the data format requirements of the target security level, thereby obtaining the converted message data. By correspondingly converting the security level and the data format, the data processing is refined and targeted. A complex and secure data format is used for high-security level data to ensure data security; a simple and efficient data format is used for low-security level data to reduce computing resource consumption and further reduce computing overhead.

[0064] S2. Perform hash calculation on the SNMP protocol message data to be transmitted to generate a message digest; and perform signing on the message digest to generate a digital signature;

[0065] Preferably, signing according to the information digest to generate a digital signature includes:

[0066] Signing the information digest according to the private key of the preset signature key pair and the preset cryptographic hash function to generate a data signature;

[0067] Among them, the communication security protection device in each security domain stores a preset signature key pair; the preset signature key pair is updated regularly.

[0068] In a preferred embodiment of the present invention, a hash operation is performed on the SNMP protocol message data to be transmitted to generate a message digest. A hash operation is an algorithm that maps data of any length to a fixed-length digest. This allows for rapid verification of data integrity. The generated message digest is then signed to generate a digital signature. The digital signature is used to ensure the authenticity of the data source.

[0069] Specifically, a pre-set signature key pair refers to a key pair pre-distributed and stored in the communication security protection device within each security domain. It consists of a private key and a public key, used to sign and verify data. The private key is kept secret by the protection device, while the public key can be used by other devices to verify signatures. A cryptographic hash function is a function used to convert data into a fixed-length message digest, such as the common SM3 national encryption algorithm. These functions are irreversible and unique, ensuring that identical input data produces the same message digest after processing.

[0070] In a preferred embodiment of the present invention, a signature operation is performed on the information digest generated by the hash operation according to the private key of the preset signature key pair and the preset cryptographic hash function to generate a data signature. The signing process actually uses the private key to encrypt the information digest, and the generated digital signature is bound to the original data for subsequent verification of the authenticity and integrity of the data. The communication security protection device in each security domain stores a preset signature key pair, and the preset signature key pair is updated regularly to enhance security and prevent security risks caused by the key being cracked. The use of the preset signature key pair and the cryptographic hash function for signing operations provides a reliable means of source authentication for the data. Regularly updating the key pair effectively reduces the risk of the key being cracked, enhances the security during data transmission, further resists security threats such as data forgery, and ensures the authenticity and integrity of the data.

[0071] In a preferred embodiment of the present invention, the communication security protection device also includes an instruction anti-tampering device, which uses the SM3 algorithm to generate an information digest for the SNMP protocol message. The current security domain acts as the sending end, and first performs an SM3 hash operation on the SNMP protocol message M to generate a 32-byte information digest H(M): H(M) = SM3(M). The communication security protection device also includes a front-end communication device, which performs an SM2 algorithm signature on the information digest while maintaining the SNMP UDP transmission efficiency. The information digest is digitally signed using the SM2 algorithm to generate a signature S: S = SM2_Sign(H(M), d), where d is the private key of the preset signature key pair. The preset signature key pair and the preset encryption key pair comply with the relevant standards of the State Cryptography Administration and are generated using a key negotiation mechanism based on a PKI certificate. In order to resist the attack of quantum computers, the data signature algorithm of this protocol can be replaced by the CRYSTALS-Dilithium post-quantum signature algorithm. The specific implementation process is as follows: the sender first generates a public-private key pair through (pk, sk) = Dilithium_KeyGen(Dilithium5), where pk is the public key and sk is the private key. Then, the SNMP protocol message data M is signed using the private key sk and the cryptographic hash function CRH to generate S1 = Dilithium_Sign CRH (M, sk); Finally, the signature S1 is sent together with the original message.

[0072] S3, adding timestamp information to the SNMP protocol message data to be transmitted to obtain first communication data; encrypting the first communication data according to the digital signature to generate encrypted transmission data;

[0073] Specifically, the first communication data represents data obtained by appending timestamp information to the SNMP protocol message data to be transmitted. The timestamp information is appended to the SNMP protocol message data to be transmitted to obtain the first communication data. The timestamp information is used to record the time when the data was generated or processed to prevent data replay attacks. The digital signature and the first communication data are encrypted to generate encrypted transmission data.

[0074] Preferably, performing encryption processing based on the digital signature and the first communication data to generate encrypted transmission data includes:

[0075] Encapsulating the digital signature and the first communication data to obtain target communication data representing that the first communication data has the digital signature;

[0076] Encrypting the target communication data according to the private key of the preset encryption key pair to generate encrypted transmission data;

[0077] Among them, the communication security protection device in each security domain stores a preset encryption key pair; the preset encryption key pair is updated regularly.

[0078] Specifically, the preset encryption key pair, similar to the preset signature key pair, is pre-distributed and stored in the communication security protection device within each security domain. It is used to encrypt and decrypt data. The target communication data represents the data obtained by encapsulating the digital signature and the first communication data. This data contains the complete signature information and the original SNMP protocol message data with a timestamp, and is used for subsequent encryption processing.

[0079] In a preferred embodiment of the present invention, the digital signature and the first communication data are first encapsulated, and the relevant information is integrated together to obtain the target communication data with the digital signature used to characterize the first communication data, so that it becomes a complete data unit. Then, the target communication data is encrypted according to the private key of the preset encryption key pair to generate encrypted transmission data. The encrypted transmission data is transmitted in the network, and only the device with the corresponding public key can decrypt and obtain the original data. Similarly, the communication security protection device in each security domain stores a preset encryption key pair, and the preset encryption key pair is updated regularly. By encrypting the encapsulated target communication data, the confidentiality of the data during transmission is further guaranteed, and the data is prevented from being stolen and illegally viewed. Regularly updating the preset encryption key pair improves the security of the encryption system, effectively resists security threats such as encryption cracking, and ensures the confidentiality and security of data transmission.

[0080] In a preferred embodiment of the present invention, the front-end communication device adds timestamp information to the decrypted SNMP protocol message data to be transmitted to obtain the first communication data; then the digital signature and the first communication data are encrypted according to the SM4 algorithm to generate encrypted transmission data C: C = SM4_Encrypt (M||S, K), where K is a preset encryption key pair. The preset encryption key pair also complies with the relevant standards of the State Cryptography Administration and is generated using a key negotiation mechanism based on a PKI certificate. The timestamp information is used to prevent message replay attacks and improve the security of communications. The encrypted transmission data is sent to the front-end communication devices of other security domains through the front-end communication device across security domains. Similarly, in order to cope with the attack of quantum computers, the SM4 encryption algorithm can be replaced with the CRYSTALS-Kyber post-quantum encryption algorithm. The specific implementation process is as follows: the application server calls the data tamper-proof device using (pk enc ,sk enc )=Kyber_keyGen(Keyber1024) generates an encryption key pair, where pk enc is the public key, sk encis the private key. And use the encryption algorithm to generate the ciphertext C1=Keyber_Enc(sk enc ,M||S).

[0081] S4. Build a transmission link based on the switch and the communication security protection devices of the remaining security domains, and transmit the encrypted transmission data to the communication security protection devices of the remaining security domains through the transmission link, so that the communication security protection devices of the remaining security domains decrypt and verify the encrypted transmission data. If the signature verification is successful, the final SNMP protocol message data is obtained, and the final SNMP protocol message data is sent to the communication equipment of the remaining security domains; if the signature verification fails, the encrypted transmission data is discarded and the transmission link is disconnected.

[0082] Specifically, a transmission link is established with the communication security protection devices of other security domains, and the encrypted transmission data is transmitted to the communication security protection devices of other security domains through the transmission link for subsequent decryption and data consistency verification to obtain the final SNMP protocol message data.

[0083] Preferably, the communication security protection devices of the remaining security domains decrypt and verify the encrypted transmission data to obtain the final SNMP protocol message data, including:

[0084] Decrypting the encrypted transmission data according to the public key of the preset encryption key pair to obtain decrypted data; the decrypted data includes: a decrypted digital signature and second communication data; wherein the second communication data represents SNMP protocol message data with timestamp information after the encrypted transmission data is decrypted by the communication security protection device of the remaining security domains;

[0085] Performing a hash operation on the second communication data to generate a new information digest;

[0086] Decrypt the decrypted digital signature according to the public key of the preset signature key pair to obtain the original information summary;

[0087] Compare the new information digest with the original information digest; if they are consistent, it is confirmed that the encrypted transmission data meets the data integrity conditions; if they are inconsistent, it is confirmed that the encrypted transmission data does not meet the data integrity conditions;

[0088] Verify whether the timestamp information corresponding to the second communication data is within a preset valid time window; if so, confirm that the encrypted transmission data meets the timeliness condition; if not, confirm that the encrypted transmission data does not meet the timeliness condition;

[0089] When both the data integrity condition and the timeliness condition are met, the second communication data is used as the final SNMP protocol message data;

[0090] If at least one of the data integrity condition and the timeliness condition is not met, the transmission link is disconnected; and it is determined whether the number of times the transmission link is disconnected exceeds the preset number threshold; if so, an alarm message is generated to enable staff to check.

[0091] Specifically, data consistency verification is performed on the data received after decryption of the encrypted transmission data. This means that through a series of operations and comparisons, it is verified whether the received data remains complete, authentic, and has not been tampered with during the transmission process, and whether it is within the valid time range, including verification of data integrity and timeliness. When the new information digest generated by the hash operation is consistent with the original information digest obtained by decrypting the digital signature, the data is considered to meet the integrity condition, that is, the data has not been tampered with during the transmission process. When the timestamp information corresponding to the second communication data is within the preset valid time window, the data is considered to meet the timeliness condition, that is, the data was transmitted within the valid time and was not replayed.

[0092] In a preferred embodiment of the present invention, the communication security protection devices of the remaining security domains decrypt the received encrypted transmission data according to the public key of the preset encryption key pair to obtain the decrypted data, which includes the decrypted digital signature and the second communication data (SNMP protocol message data with timestamp information). A hash operation is performed on the second communication data to generate a new information digest. The decrypted digital signature is decrypted according to the public key of the preset signature key pair to obtain the original information digest. The new information digest is compared with the original information digest. If the two are consistent, it is confirmed that the encrypted transmission data meets the data integrity condition; if they are inconsistent, it is confirmed that the encrypted transmission data does not meet the data integrity condition. Verify whether the timestamp information corresponding to the second communication data is within the preset valid time window. If so, it is confirmed that the encrypted transmission data meets the timeliness condition; if not, it is confirmed that the encrypted transmission data does not meet the timeliness condition. When both the data integrity condition and the timeliness condition are met, the second communication data is used as the final SNMP protocol message data; when at least one of the data integrity condition and the timeliness condition is not met, that is, the data integrity condition is met but the timeliness condition is not met, the data integrity condition is not met but the timeliness condition is met, or both the data integrity condition and the timeliness condition are not met, the transmission link is disconnected; it is determined whether the number of times the transmission link is disconnected exceeds the preset number threshold. If so, an alarm message is generated for staff to check.

[0093] Through a rigorous data consistency verification process, we can accurately determine whether data transmission issues occur and effectively identify security threats such as data tampering and replay. We promptly disconnect problematic transmission links and take appropriate measures to ensure the reliability and security of received data, prevent erroneous or malicious data from entering the security domain, and ensure the quality and security of data transmission across security domains.

[0094] Preferably, the cross-security domain SNMP protocol message data transmission system further includes a gateway;

[0095] The communication device is used to transmit the SNMP protocol message data to be transmitted to the communication security protection device through the gateway;

[0096] It is also used to generate original SNMP protocol message data according to the SNMP protocol message data transmission request when receiving the SNMP protocol message data transmission request; and encrypt the original SNMP protocol message data to obtain the SNMP protocol message data to be transmitted.

[0097] In a preferred embodiment of the present invention, a gateway serves as a key hub for data transmission between a communication device and a communication security protection device. Upon receiving an SNMP protocol message data transmission request, the communication device transmits the SNMP protocol message data to be transmitted within the current security domain in accordance with the SNMP protocol message data transmission request. After obtaining the final SNMP protocol message data, an encrypted channel is established between the communication security protection device and the communication device. The encrypted channel then transmits the SNMP protocol message data to be transmitted via the gateway to the communication security protection device.

[0098] In a preferred embodiment of the present invention, the SNMP protocol message data to be transmitted includes message data encrypted by the SNMP protocol (Simple Network Management Protocol), and the decrypted SNMP protocol message data to be transmitted may contain data that conforms to the SNMP protocol format, which is used for the transmission of management information of network devices. In a large-scale power system, network devices (such as routers and switches) send device status information (SNMP protocol message data to be transmitted) to the management end via the SNMP protocol. These data are encrypted and transmitted to the communication security protection device. After decryption by the communication security protection device, the data containing the SNMP protocol is processed according to the method of the present invention, such as converting it into a suitable protocol format according to the security level, performing hash operations, signing and other operations. It can meet the data security transmission needs in more complex network environments.

[0099] In a preferred embodiment of the present invention, the other security domains act as the receiving end. After receiving the encrypted transmission data, they first use the SM4 algorithm to decrypt the data and restore the message data M′ and signature: (M′, S′) = SM4_Decrypt(C, K). Then, the decrypted message data M′ is hashed again with SM3 to generate a data summary: H(M′) = SM3(M′). Finally, the signature S′ is verified using the public key P. The verification formula is: Verification = SM2_verify(S′, H(M′), P). If the verification passes (i.e., Verification returns True), it means that the message data has not been tampered with and the system will continue to process the data; if it is inconsistent (i.e., Verification returns False), it means that the data may have been tampered with or an error occurred during transmission. The system will refuse to process the message and record the abnormal event. The data verification and decryption process of the post-quantum algorithm is as follows: First, the receiving end decrypts the ciphertext C1 according to the CRYSTALS-Kyber post-quantum algorithm and obtains (M′, S′) = Kyber_Dec(pk enc ,C1). Then, the signature is verified using the CRYSTALS-Dilithium post-quantum protocol, obtaining Verification = Dilithium_Verify CRH (M′, S′, pk), where Verification = True, it proves that the signature is valid and the system will continue to process the data; when Verification = False, it means that the data may have been tampered with or an error occurred during transmission, the system will refuse to process the message and record the abnormal event.

[0100] In a preferred embodiment of the present invention, the SNMP protocol message data transmission system across security domains also includes a key management module and a log recording module. The key management module is used to generate, distribute and manage the keys required for the SM2, SM3, and SM4 national cryptographic algorithms (which can be smoothly migrated to post-quantum cryptographic algorithms) to ensure that the keys are securely transmitted to the communication security protection device; the log recording module is used to record abnormal events and operation logs to facilitate security audits and problem tracking. The SM3 algorithm is used to generate the hash value of the data, the SM2 algorithm is used to digitally sign the hash value, and combined with the SM4 encryption algorithm to ensure the confidentiality and integrity of the data during transmission across security domains. By integrating the transmission architecture of the SNMP protocol, the protocol transmission is standardized and lightweight, and for the power monitoring system using the SNMP protocol, the communication security and transmission efficiency are both improved. Under the premise that the transmission architecture of this embodiment remains unchanged, the traditional cryptographic algorithm can be smoothly migrated to the post-quantum cryptographic algorithm to achieve secure transparent encryption and secure transparent authentication in the quantum era.

[0101] In a preferred embodiment of the present invention, Figure 2 As shown in (b), the downlink data interaction process (the interaction process from the current security domain to other security domains) includes: the application server in zone I issues an SNMP protocol message data transmission request instruction, the communication device in the current security domain generates a raw SNMP message, and the application server issues instructions to the data anti-tampering device for encryption and signing. The application server then sends the raw SNMP message to the data anti-tampering device for message encryption and signing. The application server then sends the encrypted and signed message to the switch. The switch connects to the switches in the other security domains to establish a connection with the communication security protection devices in the other security domains. The encrypted transmission data is then sent to the front-end communication device. The front-end communication device sends the encrypted and signed message to the appropriate protocol message conversion device for decryption and decryption based on the message workload. If verification is successful, it is converted into a raw SNMP message, the SNMP agent service is activated, an encrypted channel is established with the gateway, and the decrypted and decrypted raw SNMP message is sent to the distribution network terminal, that is, to the manager in the power monitoring system. If the signature verification fails, the message is discarded and the link is disconnected. After the message is sent, the connection is automatically terminated.

[0102] like Figure 2 As shown in (a), the uplink data interaction process (the interaction process from other security domains to the current security domain) includes: the communication equipment in the other security domains, namely the other distribution network terminals, generates an original SNMP message, which is encrypted and signed by the encryption gateway and then sent to the protocol message conversion device. The protocol message conversion device encrypts and converts the message into a signature, and then sends the signed message to the front-end communication device in the current security domain. After receiving the signed SNMP message, the front-end communication device in the current security domain calls the interface of the cross-security domain data tamper-proof transmission device to verify the signature. If the signature verification is successful, the decrypted SNMP message is sent to the application server in zone I. If the signature verification fails, the link is reset and the message is discarded. After the transmission is completed, the connection is automatically terminated.

[0103] SNMP (Simple Network Management Protocol) is a standard protocol for managing and monitoring network devices, systems, and applications. Through centralized management, SNMP enables network administrators to monitor the status of devices such as routers, switches, and servers, enabling troubleshooting, performance analysis, and configuration management. It uses a client-server model, where a management station (Manager) issues requests and an agent (Agent) responds and provides information. The two interact through a Management Information Base (MIB).

[0104] The following is a description of the basic format of SNMP messages:

[0105] Currently, SNMP supports GET, WALK, and SET operations. The parameters corresponding to different operation modes are slightly different. During transmission, these parameters will be encapsulated in JSON format and encrypted and signed to ensure the security and integrity of communication. The following is a table describing the message parameters for different operation modes:

[0106] Public parameters:

[0107]

[0108]

[0109] GET parameters

[0110]

[0111]

[0112] WALK parameters

[0113]

[0114] SET parameters

[0115]

[0116] The SNMP workflow is as follows:

[0117] 1) The manager sends a request to the managed device (Agent).

[0118] 2) After receiving the request, the Agent will collect and process the data through SNMP.

[0119] 3) The Agent stores the collected data in the MIB (Management Information Base).

[0120] 4) The manager obtains the required information from the Agent's MIB through the SNMP protocol.

[0121] 5) The manager analyzes and processes the acquired information and sends corresponding commands or configurations as needed.

[0122] 6) After receiving the command or configuration, the agent performs the corresponding operation and returns the execution result to the manager.

[0123] 7) After receiving the results, the manager processes and displays them.

[0124] The SNMP protocol is processed by the data tamper-proof device as follows:

[0125] 1) First, simplify the definition of the "parameters" to be encrypted as {switch IP, switch password, command content} (see the following content for details); the application server calls the cross-security domain data tamper-proof device to encrypt and then sign it, resulting in the message: "parameter [password] [signature]".

[0126] 2) The application server continues to assemble the data {"Request Number": "xxxxxx", "Protocol": "SNMP", "Ciphertext": "Parameter [Password] [Signature]" ...}, passing through the isolation device to the collection server. The request number is a unique code generated by the system, allowing the request and the result to be matched.

[0127] 3) The front-end communication device across security domains obtains {"request serial number": "xxxxxx", "protocol": "SNMP", "ciphertext": "parameter [password] [signature]" ...} and forwards it to the protocol message conversion device A adapted for cross-security domain secure communication.

[0128] 4) The "parameter [password] [signature]" initiates a SOCEKT short connection with the IP address of the protocol message conversion device A (which can be multiple and can be called in a round-robin manner) that adapts to cross-security domain secure communication, and sends the "parameter [password] [signature]";

[0129] 5) The protocol message conversion device A adapted for cross-security domain secure communication uses the SM4 national secret algorithm to decrypt the parameters and verify the signature. After the signature verification is passed, the next step is carried out. After the result of the interaction with the device, it is encrypted and signed using the SM4 algorithm, and the "result [key] [signature]" is returned to the front-end communication device across the security domain through the SOCEKT protocol.

[0130] 6) The front-end communication device across security domains assembles the "result [secret] [signature]" into the form of {"request serial number": "xxxxxx", "return value": "result [secret] [signature]"} and sends it to the application server through the isolation device. The application server extracts the "result [secret] [signature]" and verifies the signature with the cross-security domain data tamper-proof device and decrypts it to obtain the "result".

[0131] 7) At this point, the entire process is completed.

[0132] This paper innovatively uses the SM3 hash algorithm to digest SNMP protocol message data, digitally signs it using the SM2 signature algorithm, and encrypts it using the SM4 encryption algorithm. Furthermore, it designs an alternative post-quantum encryption algorithm to enhance the system's resilience against future quantum computing attacks.

[0133] In a preferred embodiment of the present invention, in an electric power system network, there are a production security domain and an office security domain. The sensors (communication equipment) in the production security domain collect the equipment operation data (SNMP protocol message data to be transmitted), which is encrypted and transmitted to the communication security protection device of the production security domain. The communication security protection device decrypts the data, determines that its security level is high, and converts the data into message data that supports high-intensity encryption. The converted message data is hashed and signed, and then a timestamp is added to the decrypted original data. The signed and timestamped data is encrypted again and transmitted to the communication security protection device of the office security domain via a dedicated encrypted link. The processing and security encryption before transmission, through the combination of hierarchical processing and multiple security means, reduces unnecessary complex calculations and reduces computing overhead while ensuring data security; protects the integrity, authenticity and timeliness of the data, effectively resists various security threats, and lays a safe and reliable foundation for cross-security domain data transmission.

[0134] By implementing this embodiment, a communication security protection device applicable to each security domain generates a digital signature for the information digest of the SNMP protocol message data to be transmitted by the communication device in the current security domain, thereby ensuring the integrity of the data and reducing the amount of hash calculation. At the same time, timestamp information is added to resist replay attacks and ensure the timeliness of the data. The digital signature and the first communication data are encrypted to generate encrypted transmission data, thereby achieving encryption and signature processing and improving the security of the encrypted transmission data. A transmission link is established based on the switch in the current security domain and the communication security protection devices in the remaining security domains. The encrypted transmission data is transmitted to the communication security protection devices in the remaining security domains through the transmission link, so that the communication security protection devices in the remaining security domains decrypt the encrypted transmission data, ensuring that the data has not been tampered with or replayed during the transmission process. The communication requirements of different security domains can be met, and the encryption and decryption of the SNMP protocol message data to be transmitted can be completed without adding a data encryption layer, thereby reducing communication overhead. At the same time, only one encryption and decryption is required, without using too many keys for encryption and decryption, and it can also ensure that the SNMP protocol message data to be transmitted can be correctly transmitted to the remaining security domains, thereby achieving cross-domain communication transmission, meeting the communication requirements of the power system, and reducing cross-domain communication threats. And after receiving the transmitted encrypted transmission data, the communication security protection devices in the other security domains can perform signature verification and decryption to obtain the final SNMP protocol message data. In the case of signature verification failure, that is, it means that the encrypted transmission data may have been tampered with or an error occurred during the transmission process, the encrypted transmission data will be discarded and the transmission link will be disconnected, and the encrypted transmission data will be refused to be accepted, thereby achieving a short connection while ensuring the communication security within the current security domain. The present invention is not limited to a specific encryption and decryption algorithm in the process of encryption and decryption. Therefore, in the case of resisting quantum attacks, a corresponding encryption and decryption algorithm can also be selected to realize the transmission of the SNMP protocol message data to be transmitted based on the data transmission framework of the present invention. Therefore, the present invention can reduce communication overhead while also coping with security threats in cross-security domain communications.

[0135] See also Figure 3 , is a schematic structural diagram of a cross-security domain SNMP protocol message data transmission system provided by one embodiment of the present invention, comprising: communication security protection devices, communication equipment, and switches within a plurality of security domains; a security domain includes a communication security protection device and a plurality of communication equipment;

[0136] The communication device is used to send the SNMP protocol message data to be transmitted to the communication security protection device;

[0137] The communication security protection device is used to obtain the SNMP protocol message data to be transmitted by the communication equipment in the current security domain;

[0138] Perform hash calculation on the SNMP protocol message data to be transmitted to generate a message digest; and perform signing on the message digest to generate a digital signature;

[0139] Adding timestamp information to the SNMP protocol message data to be transmitted to obtain first communication data; performing encryption processing based on the digital signature and the first communication data to generate encrypted transmission data;

[0140] The switch is used to establish a transmission link with the communication security protection devices of other security domains;

[0141] The communication security protection device is also used to transmit the encrypted transmission data to the communication security protection devices of the remaining security domains through the transmission link, so that the communication security protection devices of the remaining security domains decrypt and verify the encrypted transmission data. If the signature verification is successful, the final SNMP protocol message data is obtained and the final SNMP protocol message data is sent to the communication equipment of the remaining security domains; if the signature verification fails, the encrypted transmission data is discarded and the transmission link is disconnected.

[0142] Specifically, the communication security protection device includes: an instruction anti-tampering device, a front-end communication device and a protocol message conversion device;

[0143] The instruction anti-tampering device is used to obtain SNMP protocol message data to be transmitted from a communication device in the current security domain; perform a hash calculation based on the SNMP protocol message data to be transmitted to generate a message digest; and perform a signature based on the message digest to generate a digital signature; add timestamp information to the SNMP protocol message data to be transmitted to obtain first communication data; and perform encryption processing based on the digital signature and the first communication data to generate encrypted transmission data;

[0144] The front-end communication device is used to transmit the encrypted transmission data to the protocol message conversion device of the communication security protection device of the other security domains through the transmission link established with the communication security protection device of the other security domains;

[0145] The protocol message conversion device is used to send the final SNMP protocol message data to the communication devices of other security domains after obtaining the final SNMP protocol message data; in the case of signature verification failure, the encrypted transmission data is discarded and the transmission link is disconnected.

[0146] The present invention provides a cross-security domain SNMP protocol message data transmission system, which performs protocol message conversion on the SNMP protocol message data to be transmitted encrypted by the communication device according to the security level, and performs different protocol message conversions for different security levels, thereby avoiding high-complexity conversion of all data, reducing invalid calculation steps, and reducing unnecessary computing resource consumption; digital signature is performed before transmission, and there is no need to add an encryption layer. By generating a digital signature for the information digest, the integrity of the data can be guaranteed and the amount of hash calculation can be reduced. At the same time, timestamp information is added to resist replay attacks and ensure the timeliness of the data; finally, the digital signature and the first communication data are encrypted to generate encrypted transmission data, and the encrypted transmission data is transmitted through a communication security protection device in the security domain, so that the communication security protection device in the security domain decrypts the encrypted transmission data, ensuring that the data has not been tampered with or replayed during the transmission process. The communication needs of different security domains can be met and the communication needs of the power system can be met. Therefore, the present invention performs protocol message conversion on the decrypted SNMP protocol message data to be transmitted, generates information summary and digital signature through the communication security protection device, and then encrypts the first communication data with digital signature and additional timestamp information, and transmits the encrypted transmission data to the remaining security domains, ensuring that cross-security domain communication can effectively deal with security threats such as tampering and replay while reducing computing overhead, thereby realizing the secure transmission of SNMP protocol message data.

[0147] It should be noted that the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed across multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. In addition, in the drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art can understand and implement the present invention without inventive effort.

[0148] Those skilled in the art can clearly understand that, for the sake of convenience and brevity, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0149] Another embodiment of the present invention provides a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the SNMP protocol message data transmission method across security domains described in the above embodiment.

[0150] The storage medium is a computer-readable storage medium, and the computer program is stored in the computer-readable storage medium. When the computer program is executed by the processor, the steps of each of the above-mentioned method embodiments can be implemented. The computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunications signal, and a software distribution medium.

[0151] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A method for transmitting SNMP protocol message data across security domains, characterized in that: A communication security protection device applicable to each security domain in a cross-security domain SNMP protocol message data transmission system; the cross-security domain SNMP protocol message data transmission system also includes several communication devices and switches; a security domain includes a communication security protection device and several communication devices; The cross-security domain SNMP protocol message data transmission method includes: Obtain the SNMP protocol message data to be transmitted by the communication device in the current security zone; Perform hash calculation on the SNMP protocol message data to be transmitted to generate a message digest; and perform signing on the message digest to generate a digital signature; Adding timestamp information to the SNMP protocol message data to be transmitted to obtain first communication data; performing encryption processing based on the digital signature and the first communication data to generate encrypted transmission data; A transmission link is built based on the switch and the communication security protection devices of the remaining security domains, and the encrypted transmission data is transmitted to the communication security protection devices of the remaining security domains through the transmission link, so that the communication security protection devices of the remaining security domains decrypt and verify the encrypted transmission data to obtain the final SNMP protocol message data, and send the final SNMP protocol message data to the communication equipment of the remaining security domains; if the signature verification fails, the encrypted transmission data is discarded and the transmission link is disconnected.

2. A method for transmitting SNMP protocol message data across security domains as claimed in claim 1, characterized in that: Also includes: Determine the data format corresponding to the security level of the SNMP protocol message data to be transmitted, wherein the security level and the data format correspond to each other. According to the corresponding data format, the message format of the SNMP protocol message data to be transmitted is converted to obtain the final SNMP protocol message data to be transmitted.

3. A method for transmitting SNMP protocol message data across security domains as claimed in claim 1, characterized in that: Signing the information digest to generate a digital signature includes: Signing the information digest according to the private key of the preset signature key pair and the preset cryptographic hash function to generate a data signature; Among them, the communication security protection device in each security domain stores a preset signature key pair; the preset signature key pair is updated regularly.

4. A method for transmitting SNMP protocol message data across security domains as claimed in claim 3, characterized in that: Performing encryption processing based on the digital signature and the first communication data to generate encrypted transmission data includes: Encapsulating the digital signature and the first communication data to obtain target communication data representing that the first communication data has the digital signature; Encrypting the target communication data according to the private key of the preset encryption key pair to generate encrypted transmission data; Among them, the communication security protection device in each security domain stores a preset encryption key pair; the preset encryption key pair is updated regularly.

5. A method for transmitting SNMP protocol message data across security domains as claimed in claim 4, characterized in that: The communication security protection devices in other security domains decrypt and verify the encrypted transmission data to obtain the final SNMP protocol message data, including: Decrypting the encrypted transmission data according to the public key of the preset encryption key pair to obtain decrypted data; the decrypted data includes: a decrypted digital signature and second communication data; wherein the second communication data represents SNMP protocol message data with timestamp information after the encrypted transmission data is decrypted by the communication security protection device of the remaining security domains; Performing a hash operation on the second communication data to generate a new information digest; Decrypt the decrypted digital signature according to the public key of the preset signature key pair to obtain the original information summary; Compare the new information digest with the original information digest; if they are consistent, it is confirmed that the encrypted transmission data meets the data integrity conditions; if they are inconsistent, it is confirmed that the encrypted transmission data does not meet the data integrity conditions; Verify whether the timestamp information corresponding to the second communication data is within a preset valid time window; if so, confirm that the encrypted transmission data meets the timeliness condition; if not, confirm that the encrypted transmission data does not meet the timeliness condition; When both the data integrity condition and the timeliness condition are met, the second communication data is used as the final SNMP protocol message data; If at least one of the data integrity condition and the timeliness condition is not met, the transmission link is disconnected; and it is determined whether the number of times the transmission link is disconnected exceeds the preset number threshold; if so, an alarm message is generated to enable staff to check.

6. A method for transmitting SNMP protocol message data across security domains as claimed in claim 1, characterized in that: The cross-security domain SNMP protocol message data transmission system also includes a gateway; The gateway is used to build an encrypted channel between the communication security protection device and the communication equipment after obtaining the final SNMP protocol message data, and transmit the final SNMP protocol message data to the communication security protection device through the gateway through the encrypted channel; It is also used to transmit the SNMP protocol message data to be transmitted in the current security domain according to the SNMP protocol message data transmission request when an SNMP protocol message data transmission request is received.

7. A method for transmitting SNMP protocol message data across security domains as claimed in claim 1, characterized in that: The SNMP protocol message data to be transmitted includes SNMP protocol encrypted message data.

8. A cross-security domain SNMP protocol message data transmission system, characterized in that: include: Communication security protection devices, communication equipment and switches within several security domains; one security domain includes one communication security protection device and several communication equipment; The communication device is used to send the SNMP protocol message data to be transmitted to the communication security protection device; The communication security protection device is used to obtain the SNMP protocol message data to be transmitted by the communication equipment in the current security domain; Perform hash calculation based on the SNMP protocol message data to be transmitted to generate an information digest; and signing according to the information digest to generate a digital signature; Adding timestamp information to the SNMP protocol message data to be transmitted to obtain first communication data; Performing encryption processing based on the digital signature and the first communication data to generate encrypted transmission data; The switch is used to establish a transmission link with the communication security protection devices of other security domains; The communication security protection device is also used to transmit the encrypted transmission data to the communication security protection devices of the remaining security domains through the transmission link, so that the communication security protection devices of the remaining security domains decrypt and verify the encrypted transmission data to obtain the final SNMP protocol message data, and send the final SNMP protocol message data to the communication equipment of the remaining security domains; if the signature verification fails, the encrypted transmission data is discarded and the transmission link is disconnected.

9. A cross-security domain SNMP protocol message data transmission system as claimed in claim 8, characterized in that: The communication security protection device includes: an instruction anti-tampering device, a front-end communication device and a protocol message conversion device; The instruction anti-tampering device is used to obtain SNMP protocol message data to be transmitted from a communication device in the current security domain; perform a hash calculation based on the SNMP protocol message data to be transmitted to generate a message digest; and perform a signature based on the message digest to generate a digital signature; add timestamp information to the SNMP protocol message data to be transmitted to obtain first communication data; and perform encryption processing based on the digital signature and the first communication data to generate encrypted transmission data; The front-end communication device is used to transmit the encrypted transmission data to the protocol message conversion device of the communication security protection device of the other security domains through the transmission link established with the communication security protection device of the other security domains; The protocol message conversion device is used to send the final SNMP protocol message data to the communication devices of other security domains after obtaining the final SNMP protocol message data; in the case of signature verification failure, the encrypted transmission data is discarded and the transmission link is disconnected.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored computer program, wherein when the computer program is running, the device where the computer-readable storage medium is located is controlled to execute the cross-security domain SNMP protocol message data transmission method according to any one of claims 1 to 7.

Images