Cross-security domain data transmission method and device of SSH protocol, electronic equipment and storage medium

Abstract

The invention discloses a cross-security domain data transmission method and device of an SSH protocol, electronic equipment and a storage medium, and belongs to the technical field of power grid information security, and the method comprises the steps: carrying out the encryption processing of an SSH instruction according to a data encryption algorithm, and transmitting the SSH encryption instruction to a collection server through an SSH protocol encryption channel; the method comprises the following steps: sending an SSH encryption instruction to an instruction tamper-proofing device through an acquisition server to decrypt the SSH encryption instruction, sending the decrypted SSH instruction to a corresponding target device, and returning an instruction execution result of the SSH instruction; and the encrypted instruction execution result is returned to the application server through the SSH protocol encryption channel in the acquisition server, so that the problem of low security of a data transmission mode of performing data protection by the SSH only depending on a security mechanism of the SSH in the prior art can be solved.

Description

Technical Field

[0001] The present invention relates to the field of power grid information security technology, and in particular to a cross-security domain data transmission method, device, electronic device and storage medium of the SSH protocol. Background Art

[0002] Currently, the SSH (Secure Shell) protocol, as a security protocol built on the application layer, can provide a secure transmission environment for network services in insecure networks by encrypting and verifying passwords during transmission. This allows connections between SSH clients and SSH servers, ensuring the confidentiality and integrity of data transmission. While data can be encrypted and transmitted through SSH's inherent security mechanisms (encrypted channels) when transmitting data across security domains, relying solely on SSH's own security mechanisms for data protection is not very secure and poses security risks. Summary of the Invention

[0003] The present invention provides a cross-security domain data transmission method, device, electronic device and storage medium of the SSH protocol, which can solve the problem of low security of the data transmission mode of SSH in the prior art, in which SSH only relies on its own security mechanism for data protection.

[0004] To solve the above technical problems, an embodiment of the present invention provides a cross-security domain data transmission method using the SSH protocol, comprising:

[0005] Obtaining an SSH instruction to be transmitted generated by the application server, encrypting the SSH instruction according to a preset data encryption algorithm to obtain an encrypted SSH instruction, and transmitting the SSH encrypted instruction to the secure access area through a preset SSH protocol encryption channel;

[0006] Converting the protocol format of the SSH encryption instruction into a preset standard protocol format in the secure access area, and transmitting the SSH encryption instruction after the protocol format conversion to the collection server through the SSH protocol encryption channel;

[0007] The collection server sends the SSH encrypted instruction to a preset instruction tamper-proof device, so that the instruction tamper-proof device decrypts the SSH encrypted instruction according to a preset data decryption algorithm to obtain a decrypted SSH instruction, and then sends the decrypted SSH instruction to the corresponding target device, and returns the instruction execution result of the SSH instruction to the collection server;

[0008] The instruction execution result is encrypted in the acquisition server according to the data encryption algorithm, and the encrypted instruction execution result is returned to the application server through the SSH protocol encryption channel.

[0009] As a preferred solution, encrypting the SSH instruction according to a preset data encryption algorithm to obtain an encrypted SSH encrypted instruction includes:

[0010] Calculate the hash value corresponding to the SSH instruction according to a preset SM3 hash algorithm, and sign the hash value according to a preset signature algorithm to obtain a corresponding hash value signature; wherein the signature algorithm includes: SM2 signature algorithm and Falcon post-quantum signature algorithm;

[0011] The hash value signature is encrypted according to a preset data encryption algorithm to obtain an encrypted SSH encryption instruction; wherein the data encryption algorithm includes: SM4 encryption algorithm and HQC post-quantum encryption algorithm.

[0012] As a preferred solution, the acquisition server sends the SSH encrypted instruction to a preset instruction anti-tampering device, including:

[0013] After receiving the SSH encrypted instruction, the acquisition server establishes a SOCKET long connection with the preset instruction anti-tampering device, so that the instruction anti-tampering device allocates a corresponding instruction anti-tampering device instance to the acquisition server. After the SOCKET long connection is established, the acquisition server sends the SSH encrypted instruction to the instruction anti-tampering device instance through the SOCKET long connection.

[0014] As a preferred solution, decrypting the SSH encrypted instruction according to a preset data decryption algorithm to obtain the decrypted SSH instruction includes:

[0015] Decrypt the SSH encrypted instruction according to a preset data decryption algorithm to obtain a decrypted hash value signature; wherein the data decryption algorithm includes: SM4 decryption algorithm and HQC post-quantum decryption algorithm;

[0016] The decrypted hash value signature is verified according to a preset signature verification algorithm, and the decrypted SSH instruction is obtained after the signature verification passes; wherein the signature verification algorithm includes: SM2 signature verification algorithm and Falcon post-quantum signature verification algorithm.

[0017] Based on the above embodiment, another embodiment of the present invention provides an SSH protocol cross-security domain data transmission device, including: an SSH instruction encryption transmission module, an SSH instruction protocol format conversion module, a target device interaction module, and an instruction execution result return module;

[0018] The SSH instruction encryption transmission module is used to obtain the SSH instruction to be transmitted generated by the application server, encrypt the SSH instruction according to a preset data encryption algorithm to obtain an encrypted SSH instruction, and transmit the SSH encrypted instruction to the secure access zone through a preset SSH protocol encryption channel;

[0019] The SSH instruction protocol format conversion module is used to convert the protocol format of the SSH encryption instruction into a preset standard protocol format in the secure access area, and transmit the SSH encryption instruction after the protocol format conversion to the collection server through the SSH protocol encryption channel;

[0020] The target device interaction module is configured to send the SSH encrypted instruction to a preset instruction tamper-proof device through the acquisition server, so that the instruction tamper-proof device decrypts the SSH encrypted instruction according to a preset data decryption algorithm to obtain a decrypted SSH instruction, and then sends the decrypted SSH instruction to the corresponding target device, and returns the instruction execution result of the SSH instruction to the acquisition server;

[0021] The instruction execution result returning module is used to encrypt the instruction execution result in the acquisition server according to the data encryption algorithm, and return the encrypted instruction execution result to the application server through the SSH protocol encryption channel.

[0022] As a preferred solution, encrypting the SSH instruction according to a preset data encryption algorithm to obtain an encrypted SSH encrypted instruction includes:

[0023] Calculate the hash value corresponding to the SSH instruction according to a preset SM3 hash algorithm, and sign the hash value according to a preset signature algorithm to obtain a corresponding hash value signature; wherein the signature algorithm includes: SM2 signature algorithm and Falcon post-quantum signature algorithm;

[0024] The hash value signature is encrypted according to a preset data encryption algorithm to obtain an encrypted SSH encryption instruction; wherein the data encryption algorithm includes: SM4 encryption algorithm and HQC post-quantum encryption algorithm.

[0025] As a preferred solution, the acquisition server sends the SSH encrypted instruction to a preset instruction anti-tampering device, including:

[0026] After receiving the SSH encrypted instruction, the acquisition server establishes a SOCKET long connection with the preset instruction anti-tampering device, so that the instruction anti-tampering device allocates a corresponding instruction anti-tampering device instance to the acquisition server. After the SOCKET long connection is established, the acquisition server sends the SSH encrypted instruction to the instruction anti-tampering device instance through the SOCKET long connection.

[0027] As a preferred solution, decrypting the SSH encrypted instruction according to a preset data decryption algorithm to obtain the decrypted SSH instruction includes:

[0028] Decrypt the SSH encrypted instruction according to a preset data decryption algorithm to obtain a decrypted hash value signature; wherein the data decryption algorithm includes: SM4 decryption algorithm and HQC post-quantum decryption algorithm;

[0029] The decrypted hash value signature is verified according to a preset signature verification algorithm, and the decrypted SSH instruction is obtained after the signature verification passes; wherein the signature verification algorithm includes: SM2 signature verification algorithm and Falcon post-quantum signature verification algorithm.

[0030] Based on the above embodiments, another embodiment of the present invention provides an electronic device, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements the cross-security domain data transmission method of the SSH protocol described in the above invention embodiment.

[0031] Based on the above embodiments, another embodiment of the present invention provides a storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the cross-security domain data transmission method of the SSH protocol described in the above invention embodiment.

[0032] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0033] The present invention provides a cross-security domain data transmission method of the SSH protocol. The method comprises the following steps: obtaining an SSH instruction to be transmitted generated by an application server, encrypting the SSH instruction according to a preset data encryption algorithm to obtain an encrypted SSH encrypted instruction, and transmitting the SSH encrypted instruction to a secure access zone through a preset SSH protocol encryption channel; converting a protocol format of the SSH encrypted instruction into a preset standard protocol format in the secure access zone, and transmitting the SSH encrypted instruction after the protocol format conversion to a collection server through the SSH protocol encryption channel; sending the SSH encrypted instruction to a preset instruction tamper-proof device through the collection server, so that the instruction tamper-proof device decrypts the SSH encrypted instruction according to a preset data decryption algorithm to obtain a decrypted SSH instruction, and then sending the decrypted SSH instruction to a corresponding target device, and returning an instruction execution result of the SSH instruction to the collection server; encrypting the instruction execution result according to the data encryption algorithm in the collection server, and returning the encrypted instruction execution result to the application server through the SSH protocol encryption channel. Compared with the existing data transmission method that only relies on SSH's own security mechanism for data protection, the present invention adds an outer encryption step on the basis of the original SSH protocol, encrypting the SSH instructions according to a preset data encryption algorithm. This encryption step and SSH's own security mechanism (SSH protocol encryption channel) form a double-layer security protection, improving the security of data during cross-security domain transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 This is a flow chart of a cross-security domain data transmission method using the SSH protocol provided by one embodiment of the present invention;

[0035] Figure 2 This is the flow chart of SSH protocol data tamper-proof transmission across security domains;

[0036] Figure 3 The present invention provides a schematic structural diagram of a cross-security domain data transmission device using the SSH protocol according to an embodiment of the present invention. DETAILED DESCRIPTION

[0037] To make the objectives, technical solutions, and advantages of this application more clear, the technical solutions in this application will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this application.

[0038] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which this application belongs; the terms used herein are only for the purpose of describing specific embodiments and are not intended to limit this application; the terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned figure descriptions are intended to cover non-exclusive inclusions.

[0039] In the description of the embodiments of this application, the technical terms "first" and "second" are used only to distinguish different objects and should not be understood to indicate or imply relative importance or implicitly specify the quantity, specific order, or primary and secondary relationship of the indicated technical features. In the description of the embodiments of this application, the meaning of "plurality" is more than two, unless otherwise clearly and specifically defined.

[0040] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0041] In the description of the embodiments of this application, the term "and / or" is simply a description of the association relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent the following three situations: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character " / " in this document generally indicates that the associated objects are in an "or" relationship.

[0042] In the description of the embodiments of the present application, the terms "multiple" and "several" refer to more than two (including two). Similarly, "multiple groups" refer to more than two groups (including two groups), and "multiple pieces" refer to more than two pieces (including two pieces).

[0043] In the description of the embodiments of the present application, unless otherwise expressly specified or limited, technical terms such as "installed," "connected," "connected," and "fixed" should be understood in a broad sense. For example, they can refer to fixed connections, detachable connections, or integration; mechanical connections or electrical connections; direct connections or indirect connections through an intermediate medium; internal connections between two components or interactions between two components. Those skilled in the art can understand the specific meanings of the above terms in the embodiments of the present application based on specific circumstances.

[0044] Example 1

[0045] Please refer to Figure 1To address the problem in the prior art that SSH data transmission methods that rely solely on their own security mechanisms for data protection are not highly secure, an embodiment of the present invention provides a flow chart of a cross-security domain data transmission method using the SSH protocol, including the following specific steps:

[0046] S1. Obtain an SSH instruction to be transmitted generated by an application server, encrypt the SSH instruction according to a preset data encryption algorithm to obtain an encrypted SSH instruction, and transmit the SSH encrypted instruction to a secure access zone through a preset SSH protocol encryption channel;

[0047] Preferably, the encrypting the SSH instruction according to a preset data encryption algorithm to obtain an encrypted SSH encryption instruction includes: calculating a hash value corresponding to the SSH instruction according to a preset SM3 hash algorithm, and signing the hash value according to a preset signature algorithm to obtain a corresponding hash value signature; wherein the signature algorithm includes: SM2 signature algorithm and Falcon post-quantum signature algorithm; encrypting the hash value signature according to a preset data encryption algorithm to obtain an encrypted SSH encryption instruction; wherein the data encryption algorithm includes: SM4 encryption algorithm and HQC post-quantum encryption algorithm.

[0048] Specifically, the present invention provides a cross-security domain data tamper-proof transmission technology based on the SSH protocol with national secret encryption, which solves the security risk problem in cross-security domain data transmission in the distribution network communication operation control system. It can add national secret encryption and signature verification on the basis of the original SSH encryption, enhance the security of the data transmission process, and ensure the integrity, confidentiality and authenticity of the data. The SM2 public key algorithm and SM3 hash algorithm are used for signing and verification to ensure that the data has not been tampered with and the source is trustworthy; at the same time, the SM4 symmetric encryption algorithm is used to strongly encrypt the data, effectively preventing the data from being stolen or tampered with during transmission.

[0049] In order to cope with the potential threats brought by future quantum computing, this invention further introduces post-quantum cryptographic algorithms. By replacing the traditional SM2 with the Falcon post-quantum signature algorithm and SM4 with the HQC post-quantum encryption algorithm, it provides a forward-looking solution for resisting quantum computing attacks. This enables the system to maintain a high degree of security and reliability even after quantum computing technology matures.

[0050] In addition, the application reduces the number of handshakes through the long connection mechanism of the SSH protocol, improves the efficiency of data transmission, and is particularly suitable for power monitoring systems that require high frequency and real-time performance. Combined with the multi-level isolation protection structure, the system can effectively prevent potential attacks between different security domains and ensure the security of data transmission across domains. In summary, the application provides a technical solution that comprehensively enhances security and meets the security requirements of critical information infrastructure. At the same time, the long connection mechanism improves system efficiency, and the multi-level isolation protection structure enhances system security. The specific implementation of the solution is as follows:

[0051] I. System architecture:

[0052] The distribution network communication operation management and control system cross-domain data tamper-proof transmission system of the application includes two main parts: a secure I area and a secure access area.

[0053] The secure I area includes:

[0054] (1) Application server: responsible for initiating instructions and processing return results. The application server initiates instruction requests to target devices and receives response data from devices through interaction with the secure access area. It is also responsible for publishing and processing the business logic of the system.

[0055] (2) Instruction tamper-proof device: responsible for encrypting instructions with national encryption algorithms (such as SM2, SM3, SM4) and signing them to ensure the confidentiality, integrity, and source authentication of the instructions. The device uses SM2 for digital signature, SM3 for hash operation, and SM4 for symmetric encryption to ensure that the instructions are not tampered with during transmission and to ensure security. The device also encapsulates the encrypted data in SSH protocol message format to protect the data from tampering during cross-domain transmission, ensuring data security from external threats. With the development of technology, considering the threat of quantum computing, SM2 can be replaced by Falcon post-quantum signature algorithm, and SM4 can be replaced by HQC post-quantum encryption algorithm to enhance the system's resistance to attacks in the quantum era.

[0056] The secure access area includes:

[0057] (1) Cross-security-domain pre-communication device: responsible for direct communication with devices to ensure smooth network connection between different security domains. The device communicates with target devices through application protocols (such as SSH, HTTPS, etc.) and ensures the security of data during transmission. It acts as a "gateway" to control and manage the communication path from the secure I area to the device.

[0058] (2) Protocol message conversion devices for secure communication across security domains (A-1, A-2, A-3, and A-4): These devices are responsible for message format conversion and protocol proxy. Based on different security domains and communication protocols, protocol message conversion devices can convert different protocols and data formats, thereby enabling secure communication across security domains. Through protocol adaptation and conversion, they ensure compatibility and security when data is transmitted between different systems.

[0059] (3) Master-slave mode gateway device: Responsible for communication with the control equipment. The gateway device exchanges data with the control equipment through the master-slave mode configuration. This device provides redundancy and high availability, ensuring efficient and reliable communication between the control system devices.

[0060] The Secure I zone and the Secure Access zone are connected via forward and reverse isolation devices, enabling unidirectional data flow control. These isolation devices ensure the security and unidirectional nature of data flow, preventing potentially malicious data from entering or exiting the network, thereby enhancing the overall system's defense capabilities. This unidirectional isolation mechanism effectively prevents security vulnerabilities in cross-domain communications.

[0061] 2. Overview of SSH Protocol:

[0062] SSH (Secure Shell) is an encrypted network protocol used to securely execute network services over insecure networks. SSH is primarily used for remote login, remote command execution, and secure file transfer. It utilizes multiple encryption algorithms to ensure confidentiality, integrity, and authentication of data during transmission. It is widely used in server management, system configuration, remote debugging, and other scenarios, and is particularly well-suited for performing sensitive operations over insecure networks such as the Internet.

[0063] How the SSH protocol works: The SSH protocol operates through a client-server architecture. The server typically listens on port 22, awaiting connection requests from clients. The connection process includes multiple steps, including key exchange, encryption algorithm negotiation, and identity verification. All communication data is encrypted to prevent eavesdropping and tampering during transmission.

[0064] SSH message format: SSH protocol messages follow a unified encapsulation format and mainly include the following fields:

[0065] Message length: occupies 4 bytes, indicating the total message length minus the MAC length and the length of the message length field itself;

[0066] Padding length: 1 byte, indicating the length of the padding byte;

[0067] Payload: variable length field containing the actual data transmitted;

[0068] Padding byte: a variable-length field that makes the encrypted data length an integer multiple of the encryption algorithm block size; Message Authentication Code (MAC): a message authentication code used to verify data integrity;

[0069] The SSH protocol follows a unified encapsulation format, including fields such as message length, padding length, payload, padding bytes, and a message authentication code (MAC). The MAC field in SSH messages is used to verify data integrity. Any tampering with the message will result in a MAC verification failure, effectively preventing the risk of data tampering during transmission. The standardization and regularization of the SSH message format makes the encryption, signing, and verification processes more efficient and reliable.

[0070] 3. SSH protocol encrypted channel:

[0071] Key exchange and host authentication: The application server and the collection server negotiate a session key (Session Key) using the Diffie-Hellman key exchange protocol. During this process, the application server and the collection server negotiate DH parameters (such as prime numbers and generators), and each party generates a temporary public-private key pair. The application server sends the temporary public key to the collection server. The collection server uses its own private key to sign the DH calculation result and returns the signed public key and the collection server's temporary public key to the application server. The application server verifies the signature using the collection server's host public key (pre-stored or obtained through a trusted channel), confirming the legitimacy of the collection server's identity and preventing man-in-the-middle attacks. Based on the exchanged temporary public key and their own private keys, both parties independently calculate the same shared key (Session Key), but the key itself is not directly transmitted.

[0072] Session key derivation: Based on parameters such as the shared key and random number (nonce), the session key (used for symmetric encryption) and initialization vector (IV, used to initialize the encryption algorithm) are derived to form the basis of the encryption channel.

[0073] Encrypted channel activation: After the key exchange is completed, both parties open one or more session channels on the established encrypted channel to execute commands and transmit data. All subsequent communications are encrypted and transmitted through this channel.

[0074] 4. Double-layer encryption architecture of SSH protocol:

[0075] Outer layer protection: After the SSH encrypted channel is established, the tamper-proof device is instructed to sign and encrypt the application data. First, a data digest is generated using the SM3 algorithm, then signed using the SM2 algorithm to ensure data integrity and source authenticity. Finally, the signed digest is symmetrically encrypted using the SM4 algorithm, forming the outer layer of protection. To mitigate the threat of quantum computing, the SM2 algorithm can be replaced with the Falcon post-quantum signature algorithm, and the SM4 algorithm can be replaced with the HQC post-quantum encryption algorithm.

[0076] Inner layer protection: Data processed by the national encryption algorithm is then encrypted and transmitted through the encrypted channel of the SSH protocol, forming an inner layer of protection. This creates a double encryption nested structure during data transmission, greatly improving data security.

[0077] 5. SSH long connection mechanism:

[0078] The SSH persistent connection mechanism is deeply integrated with the encryption and authentication mechanisms of the SSH protocol to form a highly secure and efficient communication architecture. Its specific implementation is as follows:

[0079] Secure connection establishment:

[0080] Encrypted channel: Before establishing a persistent connection, the SSH protocol establishes an encrypted channel through Diffie-Hellman key exchange and host authentication. The persistent connection directly reuses this encrypted channel, eliminating the need for additional security negotiation.

[0081] Identity binding: The establishment of a persistent connection is tied to the user authentication result on the application server. For example, in an SSH session, a persistent connection can only be established after the user successfully authenticates with a password or public key, ensuring that only authorized users can maintain a persistent connection.

[0082] Data streaming:

[0083] Streaming encryption: Data is continuously transmitted in a stream over a persistent connection. Each piece of data is encrypted in real time using the symmetric encryption algorithm and session key negotiated by the SSH protocol, eliminating the need for repeated handshakes and key negotiation.

[0084] Integrity check: Each piece of data is accompanied by a MAC (Message Authentication Code). The receiver verifies the integrity of the data through the MAC to prevent tampering during transmission.

[0085] Connection maintenance:

[0086] Heartbeat mechanism: To maintain active persistent connections, SSH introduces a heartbeat mechanism. The client periodically sends encrypted heartbeat packets (containing random numbers), and the server verifies and sends an encrypted response to prevent the connection from being interrupted due to network inactivity.

[0087] Encrypted heartbeat packet: The heartbeat packet itself is transmitted through the SSH encrypted channel, and its content is protected by the session key to prevent middlemen from forging heartbeat packets to maintain illegal connections.

[0088] Dynamic reconnection: If the heartbeat detects a connection interruption, the SSH client can quickly re-establish the encrypted channel and restore the persistent connection based on the saved session key and encryption parameters, without having to repeat the authentication process.

[0089] 6. Data processing flow:

[0090] Please refer to Figure 2 , which is the flow chart of data tamper-proof transmission across security domains in SSH protocol, such as Figure 2 As shown, in the power grid environment, the data processing process of the SSH protocol involves the specific application of SM2, SM3, SM4 and post-quantum algorithms. The data processing process of the present invention is as follows:

[0091] Data encryption and signature: The system uses the application server to call the instruction anti-tampering device to handle data encryption and signature. First, the SM3 hash algorithm is used to calculate the signature of the encrypted data M: H(M) = SM3(M), where H(M) is the calculated hash value. Then, the SM2 public key algorithm is used to sign H(M) to generate σ = SM2_Sign sk (H(M)), sk is the SM2 private key. σ is then encrypted using the SM4 symmetric encryption algorithm to obtain the ciphertext: C = SM4(K,σ), where K is the SM4 key. After the device encapsulates and verifies the message, it is forwarded to the forward isolation device via the switch. To address the threat of quantum computing, SM2 can be replaced with the Falcon post-quantum signature algorithm, whose key generation is (pk1, sk1) = Falcon_KeyGen(Falcon-1024), where pk1 is the Falcon public key and sk1 is the Falcon private key. The signature is: M is the message to be signed, σ is the signature generated by the Falcon post-quantum algorithm; SM4 can be replaced by the HQC post-quantum encryption algorithm, and its key generation is (pk2, sk2) = HQC_KeyGen(HQC-256), pk2 is the HQC public key, sk2 is the HQC private key, encryption: σ is the signature generated by the Falcon post-quantum algorithm, and C is the ciphertext encrypted by the HQC post-quantum algorithm, thereby improving quantum security.

[0092] Zone Isolation and Communication Control: The forward isolation device implements one-way transmission, allowing data only from the secure zone I to the secure access zone. This hardware-level one-way channel ensures physical isolation. The cross-security domain pre-communication device acts as a gateway, controlling and managing communication paths. It communicates with target devices using protocols such as SSH and HTTPS to ensure transmission security.

[0093] S2. Converting the protocol format of the SSH encryption instruction into a preset standard protocol format in the secure access area, and transmitting the SSH encryption instruction after the protocol format conversion to the collection server through the SSH protocol encryption channel;

[0094] Protocol message conversion: The protocol message conversion device for cross-security domain secure communication parses the data from the pre-communication device, extracting the original data and signature. Based on the requirements of the target security domain device, it converts the data into a protocol format recognizable by the target device, maintains the data's encryption and signature, and sends it to the master-slave gateway device for distribution.

[0095] Data transmission: The encrypted data (including SM4 encryption and SM2 signature) is transmitted to the collection server through the SSH protocol encrypted channel to ensure data integrity and confidentiality.

[0096] S3. Sending the SSH encrypted instruction to a preset instruction tamper-proof device through the collection server, so that the instruction tamper-proof device decrypts the SSH encrypted instruction according to a preset data decryption algorithm to obtain a decrypted SSH instruction, and then sends the decrypted SSH instruction to the corresponding target device, and returns the instruction execution result of the SSH instruction to the collection server;

[0097] Preferably, the acquisition server sends the SSH encrypted instruction to a preset instruction anti-tampering device, including: after receiving the SSH encrypted instruction, the acquisition server establishes a SOCKET long connection with the preset instruction anti-tampering device, so that the instruction anti-tampering device allocates a corresponding instruction anti-tampering device instance to the acquisition server; after the SOCKET long connection is established, the acquisition server sends the SSH encrypted instruction to the instruction anti-tampering device instance through the SOCKET long connection.

[0098] Preferably, the decrypting the SSH encrypted instruction according to a preset data decryption algorithm to obtain the decrypted SSH instruction includes: decrypting the SSH encrypted instruction according to a preset data decryption algorithm to obtain a decrypted hash value signature; wherein the data decryption algorithm includes: SM4 decryption algorithm and HQC post-quantum decryption algorithm; performing signature verification on the decrypted hash value signature according to a preset signature verification algorithm, and obtaining the decrypted SSH instruction after the signature verification passes; wherein the signature verification algorithm includes: SM2 signature verification algorithm and Falcon post-quantum signature verification algorithm.

[0099] Collection server processing: After the collection server receives the encrypted request data, a long connection is established with the tamper-proof instruction device. The master-slave gateway device distributes data to idle tamper-proof instruction device instances according to the load condition and sends encrypted data through the SOCKET connection. The long connection ensures a continuous communication channel, reducing communication delay and handshake times.

[0100] Decryption and verification: After the tamper-proof instruction device receives the encrypted data, it first decrypts it using SM4: σ = SM4Decrypt(C, K), where C is the ciphertext, K is the SM4 key, and σ is the decrypted signature. Then, signature verification is performed using the SM2 public key algorithm: SM2_Verify pk (H(M), σ) = True or False, where H(M) is the hash value of the data M, σ is the decrypted signature, and pk is the SM2 public key, ensuring that the data has not been tampered with during transmission. Using post-quantum decryption and signature verification, the collection server receives the encrypted return result and decrypts it using the post-quantum public key HQC: C is the result of encryption using the HQC post-quantum algorithm, pk2 is the HQC public key, and σ is the decrypted signature. Then, signature verification is performed using the Falcon post-quantum signature algorithm: M is the original data, σ is the decrypted signature of the Falcon post-quantum algorithm, pk1 is the Falcon public key, and verification is passed to continue processing the data.

[0101] S4, in the collection server, the instruction execution result is encrypted according to the data encryption algorithm, and the encrypted instruction execution result is returned to the application server through the SSH protocol encryption channel.

[0102] Return result encryption and data transmission: After interacting with the collection server, the tamper-proof instruction device returns the result through SM2 signature and SM4 encryption to ensure confidentiality and integrity. To address quantum computing threats, SM2 can be replaced with the Falcon post-quantum signature algorithm, and SM4 can be replaced with the HQC post-quantum encryption algorithm to improve quantum security. The result signature and encrypted data are returned to the collection server through the SOCKET protocol, and then transmitted to the application server through the encrypted channel.

[0103] Application server decryption and verification: The application server extracts the returned data and decrypts and verifies it through the tamper-proof instruction device. First, SM4 is used for decryption to obtain the response data of the target device, and then SM2 is used for signature verification to ensure data integrity and authenticity. If post-quantum signature encryption is used, HQC post-quantum algorithm decryption and Falcon post-quantum algorithm signature verification are used to ensure data integrity and authenticity.

[0104] It can be seen that the present invention provides a cross-security domain data transmission method of the SSH protocol. The present invention realizes double-layer security protection by adding national secret encryption and signature verification on the basis of the original SSH protocol. The present invention adopts the SM2 algorithm for public key encryption and digital signature, combines the SM3 hash algorithm to ensure data integrity, and encrypts sensitive data through the SM4 symmetric encryption algorithm. In order to cope with the potential threat of quantum computing, the present invention also introduces a post-quantum encryption algorithm, wherein SM2 can be replaced by the Falcon post-quantum signature algorithm, and SM4 can be replaced by the HQC post-quantum encryption algorithm, thereby ensuring that data still has strong security in the era of quantum computing.

[0105] The present invention combines long-connection communication and a complete signature verification mechanism to achieve data transmission across security domains. The SSH protocol provides a secure communication channel, ensuring the confidentiality, integrity, and non-tamperability of data during transmission. On this basis, the long connection mode ensures that once the connection is established, it will persist until the client or device actively disconnects, avoiding the process of repeated authentication and re-establishing the connection during each transmission, greatly improving communication efficiency and stability. The entire system uses a complete signature verification mechanism to perform encryption verification during each data transmission process to ensure that the data has not been tampered with during transmission.

[0106] Example 2

[0107] Please refer to Figure 3 , is a schematic diagram of the structure of a cross-security domain data transmission device of the SSH protocol provided by one embodiment of the present invention, the device comprising: an SSH instruction encryption transmission module, an SSH instruction protocol format conversion module, a target device interaction module, and an instruction execution result return module;

[0108] The SSH instruction encryption transmission module is used to obtain the SSH instruction to be transmitted generated by the application server, encrypt the SSH instruction according to a preset data encryption algorithm to obtain an encrypted SSH instruction, and transmit the SSH encrypted instruction to the secure access zone through a preset SSH protocol encryption channel;

[0109] The SSH instruction protocol format conversion module is used to convert the protocol format of the SSH encryption instruction into a preset standard protocol format in the secure access area, and transmit the SSH encryption instruction after the protocol format conversion to the collection server through the SSH protocol encryption channel;

[0110] The target device interaction module is configured to send the SSH encrypted instruction to a preset instruction tamper-proof device through the acquisition server, so that the instruction tamper-proof device decrypts the SSH encrypted instruction according to a preset data decryption algorithm to obtain a decrypted SSH instruction, and then sends the decrypted SSH instruction to the corresponding target device, and returns the instruction execution result of the SSH instruction to the acquisition server;

[0111] The instruction execution result returning module is used to encrypt the instruction execution result in the acquisition server according to the data encryption algorithm, and return the encrypted instruction execution result to the application server through the SSH protocol encryption channel.

[0112] Preferably, encrypting the SSH instruction according to a preset data encryption algorithm to obtain an encrypted SSH encrypted instruction includes:

[0113] Calculate the hash value corresponding to the SSH instruction according to a preset SM3 hash algorithm, and sign the hash value according to a preset signature algorithm to obtain a corresponding hash value signature; wherein the signature algorithm includes: SM2 signature algorithm and Falcon post-quantum signature algorithm;

[0114] The hash value signature is encrypted according to a preset data encryption algorithm to obtain an encrypted SSH encryption instruction; wherein the data encryption algorithm includes: SM4 encryption algorithm and HQC post-quantum encryption algorithm.

[0115] Preferably, the acquisition server sends the SSH encrypted instruction to a preset instruction anti-tampering device, including:

[0116] After receiving the SSH encrypted instruction, the acquisition server establishes a SOCKET long connection with the preset instruction anti-tampering device, so that the instruction anti-tampering device allocates a corresponding instruction anti-tampering device instance to the acquisition server. After the SOCKET long connection is established, the acquisition server sends the SSH encrypted instruction to the instruction anti-tampering device instance through the SOCKET long connection.

[0117] Preferably, decrypting the SSH encrypted instruction according to a preset data decryption algorithm to obtain the decrypted SSH instruction includes:

[0118] Decrypt the SSH encrypted instruction according to a preset data decryption algorithm to obtain a decrypted hash value signature; wherein the data decryption algorithm includes: SM4 decryption algorithm and HQC post-quantum decryption algorithm;

[0119] The decrypted hash value signature is verified according to a preset signature verification algorithm, and the decrypted SSH instruction is obtained after the signature verification passes; wherein the signature verification algorithm includes: SM2 signature verification algorithm and Falcon post-quantum signature verification algorithm.

[0120] It should be noted that the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed across multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment. In addition, in the drawings of the device embodiments provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines. A person of ordinary skill in the art can understand and implement the present invention without inventive effort.

[0121] Those skilled in the art will clearly understand that for the sake of convenience and brevity, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0122] Example 3

[0123] Accordingly, an embodiment of the present invention provides an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, the cross-security domain data transmission method of the SSH protocol described in the above-mentioned embodiment of the invention is implemented.

[0124] The electronic device may be a computing device such as a desktop computer, a notebook computer, a PDA, a cloud server, etc. The device may include, but is not limited to, a processor and a memory.

[0125] The processor may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the device and connects various parts of the entire device using various interfaces and lines.

[0126] Example 4

[0127] Accordingly, an embodiment of the present invention provides a storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the cross-security domain data transmission method of the SSH protocol described in the above-mentioned embodiment of the invention.

[0128] The memory can be used to store the computer program, and the processor realizes various functions of the device by running or executing the computer program stored in the memory and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application required for a function, etc.; the data storage area can store data created according to the use of the mobile phone, etc. In addition, the memory can include a high-speed random access memory and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (FlashCard), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0129] The storage medium is a computer-readable storage medium, and the computer program is stored in the computer-readable storage medium. When the computer program is executed by the processor, it can implement the steps of the above-mentioned various method embodiments. The computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device that can carry the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium. It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0130] The above is a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications are also considered to be within the scope of protection of the present invention.

Claims

1. A cross-security domain data transmission method of the SSH protocol, characterized in that: include: Obtaining an SSH instruction to be transmitted generated by the application server, encrypting the SSH instruction according to a preset data encryption algorithm to obtain an encrypted SSH instruction, and transmitting the SSH encrypted instruction to the secure access area through a preset SSH protocol encryption channel; Converting the protocol format of the SSH encryption instruction into a preset standard protocol format in the secure access area, and transmitting the SSH encryption instruction after the protocol format conversion to the collection server through the SSH protocol encryption channel; The collection server sends the SSH encrypted instruction to a preset instruction tamper-proof device, so that the instruction tamper-proof device decrypts the SSH encrypted instruction according to a preset data decryption algorithm to obtain a decrypted SSH instruction, and then sends the decrypted SSH instruction to the corresponding target device, and returns the instruction execution result of the SSH instruction to the collection server; The instruction execution result is encrypted in the acquisition server according to the data encryption algorithm, and the encrypted instruction execution result is returned to the application server through the SSH protocol encryption channel.

2. The cross-security domain data transmission method of the SSH protocol according to claim 1, characterized in that: The step of encrypting the SSH instruction according to a preset data encryption algorithm to obtain an encrypted SSH encrypted instruction includes: Calculate the hash value corresponding to the SSH instruction according to a preset SM3 hash algorithm, and sign the hash value according to a preset signature algorithm to obtain a corresponding hash value signature; wherein the signature algorithm includes: SM2 signature algorithm and Falcon post-quantum signature algorithm; The hash value signature is encrypted according to a preset data encryption algorithm to obtain an encrypted SSH encryption instruction; wherein the data encryption algorithm includes: SM4 encryption algorithm and HQC post-quantum encryption algorithm.

3. The cross-security domain data transmission method of the SSH protocol according to claim 2, characterized in that: The acquisition server sends the SSH encrypted instruction to a preset instruction anti-tampering device, including: After receiving the SSH encrypted instruction, the acquisition server establishes a SOCKET long connection with the preset instruction anti-tampering device, so that the instruction anti-tampering device allocates a corresponding instruction anti-tampering device instance to the acquisition server. After the SOCKET long connection is established, the acquisition server sends the SSH encrypted instruction to the instruction anti-tampering device instance through the SOCKET long connection.

4. The cross-security domain data transmission method of the SSH protocol according to claim 3, characterized in that: Decrypting the SSH encrypted instruction according to a preset data decryption algorithm to obtain a decrypted SSH instruction includes: Decrypt the SSH encrypted instruction according to a preset data decryption algorithm to obtain a decrypted hash value signature; wherein the data decryption algorithm includes: SM4 decryption algorithm and HQC post-quantum decryption algorithm; The decrypted hash value signature is verified according to a preset signature verification algorithm, and the decrypted SSH instruction is obtained after the signature verification passes; wherein the signature verification algorithm includes: SM2 signature verification algorithm and Falcon post-quantum signature verification algorithm.

5. A cross-security domain data transmission device of the SSH protocol, characterized in that: include: SSH command encryption transmission module, SSH command protocol format conversion module, target device interaction module, and command execution result return module; The SSH instruction encryption transmission module is used to obtain the SSH instruction to be transmitted generated by the application server, encrypt the SSH instruction according to a preset data encryption algorithm to obtain an encrypted SSH instruction, and transmit the SSH encrypted instruction to the secure access zone through a preset SSH protocol encryption channel; The SSH instruction protocol format conversion module is used to convert the protocol format of the SSH encryption instruction into a preset standard protocol format in the secure access area, and transmit the SSH encryption instruction after the protocol format conversion to the collection server through the SSH protocol encryption channel; The target device interaction module is configured to send the SSH encrypted instruction to a preset instruction tamper-proof device through the acquisition server, so that the instruction tamper-proof device decrypts the SSH encrypted instruction according to a preset data decryption algorithm to obtain a decrypted SSH instruction, and then sends the decrypted SSH instruction to the corresponding target device, and returns the instruction execution result of the SSH instruction to the acquisition server; The instruction execution result returning module is used to encrypt the instruction execution result in the acquisition server according to the data encryption algorithm, and return the encrypted instruction execution result to the application server through the SSH protocol encryption channel.

6. The cross-security domain data transmission device of the SSH protocol according to claim 5, characterized in that: The step of encrypting the SSH instruction according to a preset data encryption algorithm to obtain an encrypted SSH encrypted instruction includes: Calculate the hash value corresponding to the SSH instruction according to a preset SM3 hash algorithm, and sign the hash value according to a preset signature algorithm to obtain a corresponding hash value signature; wherein the signature algorithm includes: SM2 signature algorithm and Falcon post-quantum signature algorithm; The hash value signature is encrypted according to a preset data encryption algorithm to obtain an encrypted SSH encryption instruction; wherein the data encryption algorithm includes: SM4 encryption algorithm and HQC post-quantum encryption algorithm.

7. The cross-security domain data transmission device of the SSH protocol according to claim 6, characterized in that: The acquisition server sends the SSH encrypted instruction to a preset instruction anti-tampering device, including: After receiving the SSH encrypted instruction, the acquisition server establishes a SOCKET long connection with the preset instruction anti-tampering device, so that the instruction anti-tampering device allocates a corresponding instruction anti-tampering device instance to the acquisition server. After the SOCKET long connection is established, the acquisition server sends the SSH encrypted instruction to the instruction anti-tampering device instance through the SOCKET long connection.

8. The cross-security domain data transmission device of the SSH protocol according to claim 7, characterized in that: Decrypting the SSH encrypted instruction according to a preset data decryption algorithm to obtain a decrypted SSH instruction includes: Decrypt the SSH encrypted instruction according to a preset data decryption algorithm to obtain a decrypted hash value signature; wherein the data decryption algorithm includes: SM4 decryption algorithm and HQC post-quantum decryption algorithm; The decrypted hash value signature is verified according to a preset signature verification algorithm, and the decrypted SSH instruction is obtained after the signature verification passes; wherein the signature verification algorithm includes: SM2 signature verification algorithm and Falcon post-quantum signature verification algorithm.

9. An electronic device, characterized in that: The invention comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, the cross-security domain data transmission method of the SSH protocol according to any one of claims 1 to 4 is implemented.

10. A storage medium, characterized in that: The storage medium includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute the cross-security domain data transmission method of the SSH protocol according to any one of claims 1 to 4.

Images