Database synchronization method and system for security isolation region of power system, database write-in service device and computer program product

Abstract

The invention provides a database synchronization method and system for a security isolation area of a power system, a database write-in service device and a computer program product. The method is applied to data synchronization of a database between a server of a source security area and a server of a target security area. According to the database synchronization method, the changed data does not need to be extracted, the performance loss of a traditional synchronization mode in the data extraction process is avoided, the load pressure of database write-in service is reduced, and the data synchronization efficiency is improved. The problems of large performance loss, poor database compatibility and insufficient security in a power system security isolation area scene in the prior art are solved. Data synchronization with high efficiency and high compatibility is realized.

Description

Technical Field

[0001] This application belongs to the field of power system technology, and in particular relates to a method, system, database writing service device and computer program product for database synchronization in a power system security isolation zone. Background Technology

[0002] Power systems are crucial to national energy security and social stability. To prevent external cyberattacks and ensure stable system operation, secure isolation zones are typically established. These zones divide the power system into different security-level areas, such as production control zones and management information zones. Data exchange between these zones requires strict control. In the field of data synchronization within power system secure isolation zones, existing database synchronization methods are mainly divided into two types: full synchronization and incremental synchronization.

[0003] Full synchronization: This is a relatively traditional data synchronization method. In this method, the system exports all data from the source database and transfers it to the target database. Full synchronization is typically performed at a specific time (such as early morning when system load is low) to ensure data consistency. The process generally involves using the database management system's built-in backup tool to save all data from the source database as a file, then copying that file to the server hosting the target database and performing data recovery. This method must be performed during periods of system idle time because database import / export operations increase the database service load and take a long time, which can severely impact system operation.

[0004] Incremental synchronization only synchronizes changed data in the source database. Common implementation methods include log-based synchronization and trigger-based synchronization. Log-based synchronization analyzes the database's transaction log (such as MySQL's binary log) to identify changed data records and then synchronizes these changes to the target database. Trigger-based synchronization creates triggers on the tables in the source database; when data in the tables changes, the triggers record the changes and send them to the target database. Log-based database synchronization suffers from database compatibility issues. Because power systems require domestically produced databases, each database vendor uses different transaction log formats, resulting in different acquisition methods. Trigger-based database synchronization requires creating a large number of triggers on the source data, which can impact database performance. Summary of the Invention

[0005] This application provides an architecture system and method for database synchronization between security isolation zones in a power system, which can solve the technical problem of low performance and compatibility of data synchronization between security isolation zones in a current power system.

[0006] In a first aspect, embodiments of this application provide a method for database synchronization in a power system security isolation zone, applied to a server including a source security zone and a target security zone, the method comprising: The database write service of the server in the source security zone performs the following steps: Step S1: Receive the database modification request sent by the client; Step S2: Extract the database modification statement from the database modification request and execute the database modification statement; Step S3: Write the successfully executed database modification statement into a target file according to a preset format, and store the target file in the verification directory of the source security zone; The synchronization control module of the source security zone performs the following steps: Step S4: Mark the target file in the verification directory as a file to be synchronized, perform preset security processing on the file to be synchronized, and then move the file to be synchronized to the sending directory of the source security zone; Step S5: Transfer the files to be synchronized in the sending directory from the source security zone to the receiving directory of the target security zone using a security isolation device; The database write service of the server in the target security zone performs the following steps: Step S6: Perform integrity verification on the files to be synchronized in the receiving directory of the source security zone. After the verification is successful, parse the content of the files to be synchronized to obtain and execute the database modification statement to complete the data synchronization between the source security zone and the target security zone.

[0007] This application addresses the issues of high performance degradation, poor database compatibility, and insufficient security in existing technologies within power system security isolation zones by constructing a novel architecture centered on "database writing" (S1 to S3) and "file synchronization" (S4 to S6). It achieves efficient and highly compatible data synchronization.

[0008] In one embodiment, step S1 includes: The database write service of the server in the source security zone receives database modification requests sent by the client and parses and verifies the validity of the database modification requests. The database modification request is validated for legality, including validating the legality and completeness of the database modification request message.

[0009] In one embodiment, step S2 includes: Extract database modification statements from the database modification requests that have passed the legality verification, and perform syntax checks and security filtering on the database modification statements; If the database modification statement passes syntax checking and security filtering, the database driver of the source security zone is invoked to execute the database modification statement.

[0010] In this embodiment of the application, steps S1 (legality verification) and S2 (security filtering) form the first line of defense. By intercepting the request at the entry point and before the SQL execution, security filtering of database modification statements can be achieved to prevent malicious attacks.

[0011] In one embodiment, the step S3 of storing the target file in the verification directory of the local source security zone includes: If the number of database modification statements in the target file reaches a set number, the target file will be stored in the verification directory of the local source security zone.

[0012] In this embodiment, the file is transferred only when the number of database modification statements accumulated in a single file reaches a preset number. This reduces frequent small file I / O operations, significantly improves the processing efficiency and synchronization throughput of the file system, and further enhances the efficiency of data synchronization.

[0013] In one embodiment, the preset security process in step S4 includes: The validity of the files to be synchronized in the verification directory is verified, and their signature information is generated. The method for generating the signature information includes: calculating the CRC32 check value of the file to be synchronized to generate a signature string, and concatenating the current timestamp and the signature string into the original filename of the file to be synchronized; Accordingly, the integrity verification of the files to be synchronized in the receiving directory in step S6 further includes: verifying whether the filenames of the files to be synchronized in the receiving directory conform to preset specifications; If the preset specifications are met, a first signature string is extracted from the filename of the file to be synchronized in the receiving directory, and a second signature string is generated based on the file content. The first signature string and the second signature string are compared to see if they are consistent. If the first signature string and the second signature string are inconsistent, the difference between the last modification time and the current time of the file to be synchronized in the receiving directory is checked. If the difference exceeds a preset threshold, the file to be synchronized in the receiving directory is determined to be abnormal and is deleted.

[0014] In this embodiment, steps S4 (signature processing) and S6 (integrity verification) constitute the second line of defense, ensuring the integrity and authenticity of the file during transmission and preventing tampering. By using specific signature and verification methods such as CRC32 and filename concatenation, a complete secure transmission chain is formed.

[0015] In one embodiment, in step S4, the files to be synchronized in the verification directory are validated according to a first set synchronization period. In step S6, the integrity of the files to be synchronized in the receiving directory is checked according to the second set synchronization period.

[0016] This application's embodiments address the system resource consumption problem caused by real-time monitoring. Through a periodic polling mechanism, while ensuring timely synchronization, the continuous occupation of system resources is reduced, making the synchronization process more controllable and efficient. In one embodiment, the database modification request in step S1 is encapsulated by the client into a message format defined by the service bus, the message format including request type, database table name, modification content and authentication information.

[0017] In this embodiment, the specific methods of interaction between the client and the server are clearly defined. By using standardized message formats and service bus routing, the reliability and manageability of request transmission are ensured, providing a stable and standardized data source for the entire synchronization process.

[0018] Secondly, this application also provides a database writing service apparatus, the database writing service apparatus comprising: The request receiving module is used to receive database modification requests sent by the client; The statement processing module is used to extract the database modification statement from the database modification request and execute the database modification statement; The file writing module is used to write the successfully executed database modification statement into a target file according to a preset format, and store the target file in the verification directory of the local source security zone; The synchronization control module is used to mark the target files in the verification directory as files to be synchronized, and after performing preset security processing on the files to be synchronized, to move the files to be synchronized to the sending directory of the local source security zone. The synchronization control module is also used to transfer the files to be synchronized in the sending directory from the local source security zone to the receiving directory of the target security zone through a security isolation device.

[0019] Thirdly, this application also provides a database synchronization system for a power system security isolation zone, applied to a server including a source security zone and a target security zone, wherein both the source security zone server and the target security zone server are deployed with the database write service device as described in the second aspect above, to cooperate in executing the steps of the database synchronization method for the power system security isolation zone as described in the first aspect above.

[0020] Fourthly, this application also provides a computer program product storing a computer program, which, when executed by a server, performs the database synchronization method for the power system security isolation zone as described in the first aspect above.

[0021] For the technical effects of the second to fourth aspects mentioned above, please refer to the description of the technical effects of the database synchronization method for the power system security isolation zone mentioned in the first aspect above, which will not be repeated here. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 A structural block diagram of an embodiment of a database writing service device provided in this application; Figure 2 This is a schematic flowchart illustrating an embodiment of a method for synchronizing a database in a power system security isolation zone, as provided in this application. Detailed Implementation

[0024] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the application; the terms “comprising” and “having”, and any variations thereof, in the specification, claims, and foregoing description of the drawings are intended to cover non-exclusive inclusion.

[0025] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0026] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0027] In the description of the embodiments of this application, the term "multiple" refers to two or more (including two), unless otherwise expressly and specifically defined.

[0028] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0029] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0030] It should be noted that the purpose of this invention is to provide a database synchronization method for a power system security isolation zone. This database synchronization method is applied to a power system. The security isolation zone divides the power system in this embodiment into two different security level areas, namely the source security zone and the target security zone, and a server is deployed in each security level area. For example, the source security zone can be the production control zone, and the target security zone can be the management information zone. Data interaction between different zones needs to be strictly controlled. In this embodiment, the database data between the source security zone and the target security zone needs to be synchronized. The production control area serves to house the power grid's core real-time control systems, such as dispatch automation systems and substation monitoring systems. It directly controls power generation, transmission, and distribution equipment. The production control area has the highest security requirements and must not be affected by external cyberattacks.

[0031] The Management Information Zone (Zone III / IV) serves to host non-real-time management applications such as office automation (OA), financial management systems, and customer service systems. These systems require data exchange with the internet. While the security requirements for the Management Information Zone are relatively low, it is still susceptible to attacks from the internet.

[0032] Understandably, to prevent internet attacks from infiltrating and spreading from the management information area to the core production control area, thereby causing catastrophic consequences such as large-scale power outages, it is mandatory that these two areas be physically isolated. They cannot communicate directly via network; a secure isolation device (such as a network gateway) must be used as a buffer. The above solution falls under the application scenario of this invention: securely synchronizing data between two physically isolated network areas.

[0033] In this invention application, for each security level zone of the server, a database write service device and a service bus can be constructed: The service bus is a software architecture concept, a virtual communication infrastructure, rather than a physical "wire"; in this embodiment, the service bus is a message middleware software (such as RabbitMQ, Apache Kafka, ActiveMQ, etc.). A service bus is used as a communication bridge between the client and the server's database write service. The client sends a database modification request to the service bus, which routes the request to the corresponding server's database write service according to preset rules (which may include, but are not limited to, queue-based routing rules, load-balancing-based routing rules, and data sharding-based routing rules). The service bus has message queuing and load balancing functions to ensure orderly processing of requests and high availability of services.

[0034] The database writing service device can be a virtual device, such as a software application or service process deployed on a server. Its function is to receive requests, process SQL statements, perform database operations, and generate synchronization files. It can be understood as a background program specifically written to complete the synchronization task of this invention. Configuring a database writing service device for each security level zone's server helps improve the efficiency, security, and compatibility of data synchronization, ensuring accurate and real-time data synchronization between power system security isolation zones.

[0035] In one embodiment, such as Figure 1 As shown, the database writing service device of this application can adopt a modular design, including a request receiving module 01, a statement processing module 02, a file writing module 03, and a synchronization control module 04.

[0036] Request receiving module 01 is used to receive database modification requests sent by the client; For example, a request receiving module is used to receive client requests, parse and verify the requests; Statement processing module 02 is used to extract database modification statements from the database modification request and execute the database modification statements; For example, the statement processing module can also perform syntax checks and security filtering on database modification statements to prevent malicious statements from damaging the database; The file writing module 03 is used to write the successfully executed database modification statement into a target file according to a preset format, and store the target file in the verification directory of the local source security zone; For example, the file writing module writes the extracted SQL statements into the target file according to a certain format. It can also generate a unique identifier and timestamp for each target file to facilitate subsequent synchronization and management. This file is saved to the verification directory of the source security zone and processed by the source security zone synchronization control module. Synchronization control module 04 is used to mark the target file in the verification directory as a file to be synchronized, and after performing preset security processing on the file to be synchronized, move the file to be synchronized to the sending directory of the local source security zone. The synchronization control module 04 is also used to transfer the files to be synchronized in the sending directory from the local source security zone to the receiving directory of the target security zone through a security isolation device.

[0037] Understandably, the synchronization control module is responsible for file synchronization between security zones (between the local source security zone and the target security zone). In the local source security zone, the synchronization control module can periodically check and verify files in the directory, marking newly generated target files as files to be synchronized. The preset security processing may involve the source security zone's synchronization control module verifying the legitimacy of the files to be synchronized and generating their signature information. The files to be synchronized and their signature files are then transmitted to the target security zone via a security isolation device (such as a network gateway).

[0038] In the target security zone, the synchronization control module of the database write service device in the target security zone receives the file to be synchronized and its signature file, performs integrity verification, and then applies the database modification statements in the file to be synchronized to the target database in the target security zone to complete the data synchronization between the source security zone and the target security zone.

[0039] Accordingly, this invention provides a database synchronization method for power system security isolation zones, applied to a server including a source security zone and a target security zone. In this embodiment, the above-mentioned... Figure 1 The database write service device shown is briefly referred to as "database write service". When the database write service is started and initialized, its request receiving module, statement processing module, file writing module and synchronization control module are loaded in sequence to ensure that each module runs normally. refer to Figure 2The database synchronization method in this embodiment mainly includes the following steps: The request receiving module, statement processing module, and file writing module of the database write service device of the source security zone server respectively execute the following steps: Step S1: The request receiving module receives the database modification request sent by the client; For example, when a client performs database operations, it encapsulates the database modification request into a message format defined by the service bus. The message includes the request type (such as insert, update, delete), the database table name, the specific modification content, and necessary authentication information. The client then sends the encapsulated message to the database write service. The database write service request receiving module of the source security zone server receives database modification requests sent by clients through the service bus, and parses and verifies the legality of the database modification requests; specifically, it can verify the legality and integrity of the database modification request message, including the validity of the authentication information.

[0040] Step S2: The statement processing module extracts the database modification statement from the database modification request and executes the database modification statement; In one embodiment, the statement processing module extracts the database modification statement from the database modification request that has passed the legality verification, and performs syntax checking and security filtering on the database modification statement; For example, the database modification statement is extracted from the database modification request. The statement processing module performs a syntax check on the extracted modification statement to ensure that the statement conforms to the database syntax rules. The modification statement is also subjected to security filtering to check for malicious SQL injection attacks, such as preventing the bypassing of authentication or the acquisition of sensitive information by constructing special SQL statements. If the database modification statement passes syntax checking and security filtering, the database driver of the source security zone is invoked to execute the database modification statement.

[0041] Step S3: The file writing module writes the successfully executed database modification statement into the target file according to a preset format, and stores the target file in the verification directory of the local source security zone; In one embodiment, if the database modification statement is successfully executed, the file writing module writes the database modification statement into a target file according to a preset format; If the number of database modification SQL statements in the target file reaches a set number, the target file will be stored in the verification directory of the local source security zone. In specific implementations, the preset format may include, but is not limited to, plain text line format (the simplest and easiest to read and write format, with each SQL statement occupying one line) or JSON line format (a popular format that combines structure and readability, with each complete JSON object representing a record containing SQL statements and other necessary information).

[0042] Furthermore, the synchronization control module of the database write service device in the source security zone performs the following steps: Step S4: Mark the target file in the verification directory as a file to be synchronized, perform preset security processing on the file to be synchronized, and then move the file to be synchronized to the sending directory of the source security zone; In some embodiments, the preset security processing may be that the synchronization control module of the source security zone performs a legality check on the file to be synchronized in the verification directory and generates its signature information; wherein, the specific method of generating its signature information may be: calculating the CRC32 check value of the file to be synchronized to generate a signature string, and concatenating the current timestamp and the signature string into the original file name of the file to be synchronized; For example, the source security zone synchronization control module can periodically check its verification directory according to a first-set synchronization cycle, identify newly generated files, and mark them as files to be synchronized; it performs a validity check on the files to be synchronized, checking whether the file format and content meet the requirements, and whether the file size is within a reasonable range; if the synchronization conditions are met, it performs a CRC32 checksum calculation on the files to be synchronized, generating an 8-character signature string. Then, it combines the current timestamp, separator, and signature string into a prefix, concatenates it with the original filename to obtain the filename of the file to be synchronized, and moves the renamed file to the sending directory of the source security zone.

[0043] Step S5: Transfer the files to be synchronized in the sending directory from the source security zone to the receiving directory of the target security zone using a secure isolation device; The synchronization control module of the database writing service device of the target security zone server performs the following steps: Step S6: Perform integrity verification on the files to be synchronized in the receiving directory. After the verification is successful, parse the file content of the files to be synchronized in the receiving directory to obtain the database modification statement and execute it to complete the data synchronization.

[0044] In one embodiment, the integrity verification of the files to be synchronized in the receiving directory may include: verifying whether the filenames of the files to be synchronized in the receiving directory conform to a preset specification; If the preset specifications are met, a first signature string is extracted from the filename of the file to be synchronized in the receiving directory, and a second signature string is generated based on the file content. The first signature string and the second signature string are compared to see if they are consistent. If the signatures are inconsistent, the difference between the last modification time and the current time of the file to be synchronized in the receiving directory is checked. If the difference exceeds a preset threshold, the file to be synchronized in the receiving directory is determined to be abnormal and is deleted.

[0045] For example, the synchronization control module of the target security zone periodically checks the receiving directory of the target security zone according to a second preset synchronization period (the second preset synchronization period can be the same as or different from the aforementioned first preset synchronization period), identifies newly generated transmission packets, and sorts them according to the ascending order of filenames. The sorted files then enter the verification process. (1) First, verify whether the file name of the file to be synchronized in the receiving directory meets the specification requirements. If the verification fails, record detailed logs and delete the file. (2) For files to be synchronized in the receiving directory that have passed file name verification, the synchronization control module of the target security zone can extract the signature string (corresponding to the first string mentioned above) from the file name, and at the same time use the CRC32 algorithm to regenerate an 8-bit signature string (corresponding to the second string mentioned above) for the file content; then compare the two signature strings, and if they are inconsistent, it indicates that the files to be synchronized in the receiving directory may not have completed the transfer. (3) For files that have not been transferred, the last modification time of the file will be checked. If the time difference is more than 5 minutes from the current time, it will be determined that the file may be truncated, damaged or tampered with. The system will delete the file and record detailed log information. (4) After all the above verifications are passed, the file content of the file to be synchronized in the receiving directory is parsed to obtain the database modification statement SQL, and the database driver of the target security zone is called to execute the database modification statement SQL to complete the data synchronization between the database of the target security zone and the database of the source security zone.

[0046] The technical advantages of the embodiments of this application are as follows: First, steps S1 to S6 of this application embodiment construct a new architecture centered on "database writing" (S1 to S3) and "file synchronization" (S4 to S6), solving the problems of high performance loss, poor database compatibility, and insufficient security of existing technologies (full / incremental synchronization) in the power system security isolation zone scenario. This achieves efficient and highly compatible data synchronization.

[0047] It should be noted that steps S1 to S3 of this application define a new architecture of "application layer directly recording SQL," changing the traditional method of "extracting changed data from database logs or triggers" to "the application layer directly generating and recording changes (SQL statements)." This eliminates the need for data extraction, avoiding the performance overhead of traditional synchronization methods during data extraction, reducing the load on the database write service, and improving data synchronization efficiency. It defines a "database write service" that receives modification requests from clients, processes and executes SQL statements, and then directly writes the statements to a file. This process completely bypasses the traditional data extraction stage, avoiding performance overhead at the source.

[0048] It should be noted that the solutions in the above embodiments of this application enhance system security by using a service bus and file transfer for data synchronization. This means that the service bus isolates the direct connection between the client and the database, reducing the security risks associated with direct database access. Furthermore, security filtering is applied to database modification statements to prevent malicious attacks. It is understood that this embodiment achieves security through multiple security mechanisms: Steps S1 (legitimacy verification) and S2 (security filtering) form the first line of defense, intercepting requests at the entry point and before SQL execution. This filters database modification statements to prevent malicious attacks. Steps S4 (signature processing) and S6 (integrity verification) form the second line of defense, ensuring the integrity and authenticity of files during transmission and preventing tampering. By using specific signature and verification methods such as CRC32 and filename concatenation, a complete secure transmission chain is formed.

[0049] Furthermore, the embodiments of this application improve database compatibility: they do not rely on database transaction logs or triggers, thus avoiding database compatibility issues and enabling them to adapt to domestically produced databases from different manufacturers.

[0050] As you can understand, this solution synchronizes standard SQL statement files, not transaction logs specific to a particular database (such as MySQL or Oracle) or triggers that depend on the database kernel. As long as the target database supports the same SQL standard, synchronization can be achieved, thus "not depending on the database's transaction logs or triggers," perfectly "solving the database compatibility issues that exist in log-based synchronization."

[0051] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0052] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for database synchronization of a secure zone of a power system, characterized in that, Applied to a server of a source security zone and a server of a target security zone, the method comprises: The following steps are performed by a database write service of the server of the source security zone: Step S1: receiving a database modification request sent by a client; Step S2: extracting a database modification statement from the database modification request and executing the database modification statement; Step S3: writing the database modification statement successfully executed into a target file in a preset format and storing the target file in a verification directory of the source security zone; The following steps are performed by a synchronization control module of the source security zone: Step S4: marking the target file in the verification directory as a file to be synchronized and, after performing a preset security processing on the file to be synchronized, moving the file to be synchronized to a sending directory of the source security zone; Step S5: transmitting the file to be synchronized in the sending directory from the source security zone to a receiving directory of the target security zone through a security isolation device; The following steps are performed by a database write service of the server of the target security zone: Step S6: performing an integrity verification on the file to be synchronized in the receiving directory of the source security zone, and, after the verification passes, parsing the content of the file to be synchronized to obtain and execute the database modification statement, so as to complete the data synchronization between the source security zone and the target security zone.

2. The method for database synchronization of power system security isolation areas of claim 1, wherein, The step S1 comprises: The database write service of the server of the source security zone receives a database modification request sent by a client and performs parsing and legality verification on the database modification request. The legality verification on the database modification request comprises verifying the legality and integrity of the message of the database modification request.

3. The method for database synchronization of power system security isolation areas of claim 2, wherein, The step S2 comprises: Extracting a database modification statement from the database modification request that passes the legality verification and performing syntax checking and security filtering on the database modification statement; In the case that the database modification statement passes the syntax checking and security filtering, invoking a database driver of the source security zone to execute the database modification statement.

4. The method of database synchronization for a safety zone of a power system of any one of claims 1 to 3, wherein, The step S3 comprises: In the case that the database modification statements in the target file reach a set number, storing the target file in a verification directory of a local source security zone.

5. The method of database synchronization for a safety zone of a power system of any one of claims 1 to 3, wherein, The preset security processing in the step S4 comprises: Performing legality verification on the file to be synchronized in the verification directory and generating signature information thereof; The method of generating the signature information comprises calculating a CRC32 check value of the file to be synchronized to generate a signature string and concatenating a current timestamp and the signature string into the original filename of the file to be synchronized. Correspondingly, the integrity verification on the file to be synchronized in the receiving directory in the step S6 further comprises verifying whether the filename of the file to be synchronized in the receiving directory conforms to a preset specification. In case of compliance with the preset criterion, a first signature string is extracted from the file name of the file to be synchronized in the receiving directory, and a second signature string is generated based on file content calculation, and the first signature string is compared with the second signature string to determine whether they are consistent; if the first signature string and the second signature string are inconsistent, the difference between the last modification time of the file to be synchronized in the receiving directory and the current time is checked, and if the difference exceeds a preset threshold, it is determined that the file to be synchronized in the receiving directory is abnormal and is deleted.

6. The method of database synchronization for a power system security isolation zone of claim 5, wherein, In the step S4, the files to be synchronized in the verification directory are verified for legitimacy according to a first set synchronization period. In the step S6, the files to be synchronized in the receiving directory are verified for integrity according to a second set synchronization period.

7. The method of database synchronization for a power system safety isolation zone of any one of claims 1 to 3, wherein, In the step S1, the database modification request is encapsulated by the client into a message format defined by a service bus, and the message format includes a request type, a database table name, modification content and authentication information.

8. A database write service apparatus characterized by comprising: The database write service device comprises: a request receiving module configured to receive a database modification request sent by a client; a statement processing module configured to extract a database modification statement from the database modification request and execute the database modification statement; a file writing module configured to write the successfully executed database modification statement into a target file in a preset format and store the target file in a verification directory of a local source security area; a synchronization control module configured to mark the target file in the verification directory as a file to be synchronized, perform a preset security processing on the file to be synchronized, and then move the file to be synchronized to a sending directory of the local source security area; the synchronization control module is further configured to transmit the file to be synchronized in the sending directory from the local source security area to a receiving directory of a target security area through a security isolation device.

9. A database synchronization system for a secure enclave of a power system, the system comprising: The computer program is executed by a server to run the method for synchronizing a database of a power system security isolation area according to any one of claims 1 to 7.

10. A computer program product storing a computer program, characterized in that, The computer program is executed by a server to run the method for synchronizing a database of a power system security isolation area according to any one of claims 1 to 7.

Images