High-reliability distributed information interaction method

Abstract

The invention belongs to the field of distributed equipment information interaction, discloses a high-reliability distributed information interaction method, and solves the problems of unreliable equipment access, data congestion, dispersed authority and lack of overall analysis in the prior art. The method comprises an identity authentication module, a data receiving and transmitting authority control module and a data monitoring module. The identity authentication module realizes the reliability of equipment access through certificate authentication and MAC address confirmation; the data transceiving authority management and control module limits the data access authority of the equipment through a control strategy, so as to avoid unauthorized sending or receiving of data; and the data monitoring module collects equipment state data through an interceptor, and displays the equipment state data on a display interface after screening, analysis and statistics, so that multi-scale comprehensive monitoring is realized. The method is suitable for a cross-regional collaborative operation scene, and the safety, controllability and visibility of distributed information interaction are guaranteed.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of distributed device information interaction, and particularly relates to a high-reliability distributed information interaction method. BACKGROUND

[0002] In a cross-regional collaborative work scenario, professional devices are usually divided according to deployment regions. When performing a task, the devices need to be connected to a special network in a specified region. After the devices are connected to the network, data is forwarded through a forwarding server. In order to reduce the dependence on a single server, multiple forwarding servers are arranged in the network to form a distributed forwarding network. The schematic diagram is shown in Figure 1 .

[0003] The existing distributed forwarding network has many technical defects: first, there is no identity authentication mechanism, and non-specific region devices may access the network, causing device management confusion; second, it cannot control node data transmission and reception flow, and unlimited data transmission and reception of devices can easily lead to network congestion; third, the authority control is scattered, and the existing MQTT, Apache Kafka and other publish / subscribe technologies judge the access legality through topics, but the data transmission and reception authority is located in the application program, and centralized control cannot be realized; fourth, there is no analysis of the overall network data, and the network state cannot be shown to the user in an intuitive way.

[0004] The existing related technologies cannot effectively solve the above problems: patent CN201210568939.9 constructs an interaction instruction based on user indication, only reduces the information interaction cost, and does not solve the reliability problem of distributed device information interaction; patent CN201210320077.8 performs a registration operation based on instructions from users to improve security, but its registration server and certificate center principles are different, and it is aimed at the reliability of user registration rather than the reliability of device access; patent CN202110968503.8 focuses on code maintenance cost and information interaction efficiency, and does not solve the identity authentication problem of distributed device information interaction; the multi-element hash locking mechanism of patent CN202211225667.2 is only suitable for small-scale data exchange, and the access efficiency is low when the device scale is large; the security verification module of patent CN201610224211.2 can cause illegal devices to receive messages, wasting network resources and device performance; none of the existing technologies realizes the cooperative optimization of device access reliable authentication, data flow control, authority centralized management and network overall monitoring. SUMMARY

[0005] (1) Technical problem to be solved The present application aims to solve the following technical problems existing in the prior art: 1. Lack of identity authentication mechanism, possibility of non-designated regional device accessing the distributed forwarding network, causing confusion in device management; 2. Unable to control node data transmission and reception traffic, unlimited data transmission and reception of devices may cause network congestion; 3. Data transmission and reception authority is scattered in application programs, making it difficult to realize centralized management and control by operation and maintenance personnel; 4. Lack of collection, analysis and intuitive display of overall data of the distributed network, and users cannot comprehensively monitor the network situation.

[0006] (2) Technical solutions The present application designs an identity authentication module 1, a data transmission and reception authority control module 2 and a data monitoring module 3 on the basis of a distributed forwarding network, and finally realizes high-reliability distributed information interaction. The core idea is to realize reliable identity verification through certificate authentication and MAC address confirmation, to centrally control data transmission and reception authority through control strategy, and to realize multi-scale monitoring through interceptor collection and analysis of device state data.

[0007] The identity authentication module 1 realizes the reliability of device access through certificate authentication and MAC address confirmation. Before accessing the network, the device needs to be registered in the certificate center to obtain the certificate issued by the certificate center and obtain the MAC address of the corresponding forwarding server through the operation and maintenance personnel. When accessing the network, the forwarding server will verify the certificate of the device and the MAC address in the access request message. After verification, it is allowed to access the network. In the network, the forwarding server will not establish a communication relationship with the device that does not hold a certificate, holds an illegal certificate, and the MAC address verification does not pass.

[0008] The flow of the identity authentication method is shown in Figure 2 Before accessing the network, the device needs to complete certificate registration and MAC address acquisition: assume that device A needs to access forwarding server B, and has already known the MAC address of forwarding server B in advance. Forwarding server B already exists in the network and already has its own public key and private key.

[0009] S1. Device A applies for its own public key A and private key A to the certificate center; S2. Device A applies for the public key B of the forwarding server B in the access area to the certificate center; S3. Device A uses the public key B to send an access request message to the forwarding server B, and the access request message contains the MAC address of the forwarding server B; S4. Forwarding server B uses the private key B to verify the access request message of device A, extracts the MAC address in the access request message and judges whether it is the same as the MAC address of itself, if the same, it is allowed to access, and the MAC address of the message source device A is extracted, if not the same, it is judged as illegal access, no reply is made, and the identity verification process is ended; S5 The forwarding server B applies for the public key A to the certificate center, and sends the access reply information to the device A using the public key A, wherein the access reply information contains the extracted MAC address of the device A; S6 The device A verifies the access reply information using the private key A, extracts the MAC address in the access reply information, and judges whether the MAC address is the same as the MAC address of the device A; if yes, the identity verification is passed; if no, the identity verification process is ended, and the device cannot access the network; S7 After the certificate information is verified, the device accesses the network and can perform information interaction.

[0010] The data transceiving permission control module 2 is deployed on the device, and the transmitted data is limited by the control policy, so that the access of the device to the data can be effectively limited, and the unauthorized sending or receiving of data is avoided. After the data transceiving permission control module is installed, the application data will be sent to other devices after passing through the module. The control of the data transceiving permission includes two processes, as shown in Figure 3 When the data transceiving permission control module is installed, the access control configuration in the module will be verified before the data is sent to determine whether the data is allowed to be sent; meanwhile, when the data is received, it will be verified whether the access control configuration item allows the data to be received. The operation personnel can set the access control item of each device separately to manage the data transceiving permission of each device. Meanwhile, the control item can be batched and issued to multiple devices to simplify the operation of the operation personnel.

[0011] The data monitoring module collects the data about the device state in the forwarding server through the interceptor, and finally displays on the display interface after screening, analysis and statistics. Unlike the traditional interceptor, the interceptor in the application is set as an independent program and is executed in parallel with the communication task. The interceptor can be regarded as a plug-in of the forwarding server. First, the local interceptor is defined, and then the interceptor is registered in the forwarding server. The interceptor of the forwarding server can be divided into an access interceptor and a data interceptor. The access interceptor intercepts the device access information in the forwarding server to obtain the related information of the device entity. The data interceptor intercepts the device communication data to obtain the communication data content. The device generates a default configuration when transmitting and receiving data, and the configuration encapsulates the data source, data destination, time and other state information. The interceptor of the forwarding server completes the monitoring of the device group by obtaining the state information of the device.

[0012] The functions of the data monitoring module include, but are not limited to: a system overview view, displaying process name, process (task) number, address, type and other information; a system physical view, which organizes the system structure view according to node summary information; a logical view, which organizes the system structure view according to domains and topics; an association description view, which displays the data type information associated with the specified entity (specified by the physical view or the logical view); data distribution delay and concurrency; device, traffic monitoring and health monitoring in the system; error analysis and log display.

[0013] (3) Beneficial effects The present application has the following beneficial effects compared with the prior art: 1. An identity authentication mechanism for device access in a distributed network is designed. This method realizes a low-overhead identity authentication mechanism through certificate authentication and MAC address confirmation, solves the reliability of device access, and ensures the secure interaction of the distributed network. The strength of identity authentication is improved through two-factor authentication (certificate and MAC address), and illegal device access is avoided.

[0014] 2. A device data transmission and reception permission control method is proposed, which realizes the function of centralized control of device data transmission and reception permission by operation and maintenance personnel. It solves the problem that the distributed forwarding network cannot control node data transmission and reception traffic, and makes the device unlimitedly transmit and receive data, causing network congestion. Through verification of access control configuration, the overstepping behavior is effectively limited, and the network resource allocation is optimized.

[0015] 3. By collecting the state data of the distributed nodes and gathering the required situation at the center node, multi-scale comprehensive monitoring is realized. It solves the problem of lack of overall network data analysis in the previous method. Through various view displays, intuitive network state monitoring is provided, which is convenient for operation and maintenance personnel to discover problems in time and take measures.

[0016] 4. The three modules work together to cover the whole process of device access, data transmission and network monitoring, forming a complete reliability guarantee system, which is suitable for various distributed application scenarios such as cross-regional collaborative work, and has strong practicality. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 is a schematic diagram of a distributed network; Figure 2 is a basic flow of identity authentication; Figure 3 is a data transmission and reception verification flow. DETAILED DESCRIPTION

[0018] The present application will be further described in detail below in conjunction with specific embodiments. The present embodiment is implemented on the premise of the technical solution of the present application, and detailed embodiments and processes are given, but the protection scope of the present application is not limited to the following embodiments.

[0019] In the target field, there are many devices such as computer terminals, radars, telemetry and other measurement and control devices distributed in different areas. When it is necessary to access the intranet and interact information, this method can be used for reliable information interaction. The main work flow is as follows: S1 Identity authentication: Before accessing the network, each device completes the planning of the area to be accessed in advance, and obtains the MAC address of the forwarding server in the corresponding area from the operation and maintenance personnel. After accessing the network, it is registered in the certificate center first to obtain the certificate issued by the certificate center, which contains the public key and the private key. According to the access to the network in different areas, the public key certificate of the corresponding forwarding server is obtained from the certificate center. After completing the identity authentication process and passing the verification, it is allowed to access the network. The forwarding server will not establish a communication relationship with the device that does not hold a certificate, holds an illegal certificate, and whose MAC address verification fails. The identity authentication process is shown in Figure 2 , which specifically includes the steps of device applying for public key and private key, applying for forwarding server public key, sending access request message, forwarding server verifying MAC address, forwarding server sending access reply message, and device verifying MAC address.

[0020] S2 Data transmission permission control: The device allowed to access the network installs the data transmission permission control module. The operation and maintenance personnel complete the data transmission permission control of multiple devices by batch issuing data transmission permissions. After installing the data transmission permission control module, the module will verify whether the access control configuration allows data transmission before data transmission; at the same time, when receiving data, it will verify whether the access control configuration item allows receiving data. The transmitted data will be limited by the control policy, which can effectively limit the access of the device to the data and avoid unauthorized sending or receiving of data. The data transmission verification process is shown in Figure 3 .

[0021] S3, data monitoring: The device generates a default configuration when publishing data, which encapsulates data source, data destination, time and other state information. The interceptor of the forwarding server completes the monitoring of the device group by obtaining the state information of the device. The interceptor is an independent program that executes in parallel with the communication task, including an access interceptor and a data interceptor. The data monitoring module displays system overview view, system physical view, logical view, association description view, data distribution delay and concurrency, device flow monitoring and health monitoring, error analysis and log display and other functions.

[0022] Through the above implementation mode, high-reliability information interaction of distributed measurement and control devices in the target field is realized, and the security, controllability and network stability of data transmission in the operation process are ensured.

[0023] The above merely describes preferred specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed by the present application, which should be covered within the protection scope of the present application.

Claims

1. A highly reliable distributed information interaction method, characterized in that, The information interaction method is built on a distributed forwarding network and includes an identity authentication module, a data transmission and reception permission control module, and a data monitoring module. The identity authentication module enables legitimate device access through dual verification of certificates and MAC addresses; the data transmission and reception permission control module allows maintenance personnel to centrally configure device data transmission and reception permissions; and the data monitoring module collects and analyzes device status data through an independent interceptor and provides a multi-dimensional monitoring view. The three modules work together to ensure the security, controllability, and visibility of distributed information interaction.

2. The highly reliable distributed information interaction method according to claim 1, characterized in that, The authentication steps of the identity authentication module include: before accessing the network, the device registers with the certificate center to obtain a certificate and obtains the MAC address of the forwarding server; when accessing the network, the forwarding server verifies the device's certificate and the MAC address in the access request message; after successful verification, access to the network is allowed.

3. The highly reliable distributed information interaction method according to claim 2, characterized in that, The identity authentication steps specifically include: The S1 device requests its own public and private keys from the certificate authority; The S2 device requests the public key of the forwarding server for the area to be accessed from the certificate authority; The S3 device uses a public key to send an access request message to the forwarding server, which contains the MAC address of the forwarding server. The S4 forwarding server uses its private key to verify the device's access request message, extracts the MAC address from the access request message and determines whether it is the same as its own MAC address. If they are the same, access is allowed. At the same time, the MAC address of the message source device is extracted. If they are different, it is determined to be an illegal access and no response is made. The authentication process ends. The S5 forwarding server requests a public key from the certificate authority and uses the public key to send access response information to the device. The access response message contains the extracted MAC address of the device. S6 device A uses its private key to verify the access reply message, and extracts the MAC address in the access reply message and determines whether it is the same as its own MAC address. If they are the same, the authentication is successful; otherwise, the authentication process ends and the device cannot access the network. After the S7 certificate information is verified, the device will connect to the network and can exchange information.

4. The highly reliable distributed information interaction method according to claim 1, characterized in that, The data transmission and reception permission control module is deployed on each device. Operation and maintenance personnel can configure access control items for a single device individually, or they can distribute control items to multiple devices in batches to achieve centralized management.

5. The highly reliable distributed information interaction method according to claim 4, characterized in that, Before the device sends or receives data, the access control module verifies the access control configuration. Data that is not allowed to be sent or received is discarded directly, while data that is allowed to be sent or received is further processed by the application.

6. The highly reliable distributed information interaction method according to claim 1, characterized in that, The interceptors in the data monitoring module are independent programs that run in parallel with the communication tasks. They are divided into access interceptors and data interceptors. The access interceptors obtain device access information, while the data interceptors obtain the device communication data content.

7. The highly reliable distributed information interaction method according to claim 6, characterized in that, The data monitoring module provides system overview view, system physical view, logical view, associated description view, data distribution latency and concurrency statistics, device traffic and health monitoring, error analysis and log display functions.

8. The highly reliable distributed information interaction method according to claim 1, characterized in that, The forwarding server only establishes communication relationships with devices that hold valid certificates and whose MAC addresses have been verified, and refuses access to devices that do not hold certificates, hold invalid certificates, or whose MAC addresses have failed verification.

9. The highly reliable distributed information interaction method according to claim 1, characterized in that, When a device sends or receives data, it generates a default configuration. The configuration encapsulates status information such as the data source, data destination, and time. The interceptor of the data monitoring module obtains this configuration to achieve device group monitoring.

Images