Cross-region data full-link traceability reorganization method and system for power isolation environment

Abstract

This invention relates to a method and system for cross-regional data end-to-end traceability and reassembly in a power physical isolation environment. The method involves intercepting service data at the source end in Security Zone 1, constructing a collision-resistant composite content fingerprint using hash digests and payload length, and building an independent traceability packet containing both the fingerprint and TraceID. The service data and traceability packet are then unidirectionally transferred to Security Zone 3 via isolation devices. At the destination end, a double-buffered queue is established, and a time-sliding window algorithm is used, indexed by the content fingerprint, to re-associate and match the received out-of-order service data with the traceability packet, thereby restoring the entire data lineage. This invention effectively achieves end-to-end data auditing and fault determination across security zones without modifying the physical isolation devices or core business systems, and features non-intrusiveness, high robustness, and high security.

Description

Technical Field

[0001] This invention relates to the fields of power system automation and network security technology, specifically a method and system for cross-regional data full-link traceability and reassembly in power isolation environments. Background Technology

[0002] In the dispatch and control systems of national critical infrastructure (such as power grids), physical isolation devices are forcibly deployed between the production control zone (security zone 1 / 2) and the management information zone (security zone 3 / 4) to defend against external network attacks.

[0003] Existing distributed tracing technologies generally rely on passing the TraceID through the TCP / IP header, HTTP header, or RPCContext. However, dedicated physical isolation devices for power systems employ proprietary protocol bypassing technology. When data penetrates the isolation device, it terminates the source TCP connection and strips all network and application layer header information, retaining only the pure data payload, and then re-establishes a new TCP connection at the destination.

[0004] This process resets the original TCP sequence number, rendering traditional TCP sequence number-based network flow reassembly techniques completely ineffective in cross-network gateway scenarios. Simultaneously, TraceID cannot penetrate the isolation device, causing data received by the management area to lose its source information, making end-to-end data quality governance and fault attribution impossible. Currently, there is no effective solution in the industry to resolve this issue without modifying the isolation device hardware. Summary of the Invention

[0005] This invention provides a method and system for cross-regional data full-link traceability and reconstruction in power isolation environments. By complying with the "Regulations on Security Protection of Power Monitoring Systems", and in the case of crossing forward or reverse physical isolation devices, the method utilizes bypass fingerprint accompaniment and time-series sliding window technology to reconstruct data lineage in a physically isolated environment, thereby realizing full lifecycle traceability and lineage reconstruction of data and solving the problems in the background technology.

[0006] To achieve the above objectives, the technical solution of the present invention is as follows: A method for full-link traceability and reassembly of cross-regional data in power isolation environments includes the following steps: S1: Source fingerprint construction: At the data sending end in security zone 1, intercept the business data packets to be transmitted across zones; extract the payload of the business data packets, calculate the digest value of the payload using a hash algorithm, and generate a composite content fingerprint by combining the byte length of the payload; construct an independent source traceability metadata data packet containing the composite content fingerprint, the end-to-end tracking identifier, and the source timestamp; S2: Heterogeneous parallel transmission: Treat the business data packets and the independent source traceability metadata data packets as independent data streams, and perform unidirectional transfer through a physical isolation device; S3: Dual queue buffer at the destination end. At the data receiving end of the three security zones, a business data cache queue and a source metadata cache queue are established respectively to temporarily store out-of-order data that arrives through the physical isolation device. S4: Time-series sliding window matching, based on a preset time window threshold. Using composite content fingerprints as index keys, bidirectional retrieval and matching are performed between the business data cache queue and the source metadata cache queue; S5: Bloodline recombination, when fingerprints with the same arrival time difference are found. satisfy When data is retrieved, the end-to-end tracking identifier is re-associated with the corresponding business data message to restore the data lineage.

[0007] Preferably, the formula for generating composite content fingerprints is:

[0008] in, This represents the payload, Hash is the hash algorithm, and Length represents the byte length. This is a string concatenation operation. This means performing a digest algorithm on the payload. The effective payload byte length is used to reduce the probability of hash collisions between different business data.

[0009] Preferably, in the independent traceability metadata: The end-to-end tracing identifier is a globally unique code pre-assigned in Security Zone 1 or an associated code generated based on the core characteristics of business data; The source timestamp is the local clock time or trusted time source time collected by the data sending end in Security Zone 1 when constructing the traceability metadata.

[0010] Preferably, the physical isolation device strips the network protocol header of the service data packet during transmission; Preferably, the bidirectional retrieval matching in S4 specifically includes: Forward matching: When a new traceability metadata data packet is received, search for data with the same fingerprint in the business data cache queue; if found and the time meets the window threshold, reassembly is triggered; if not found, the traceability metadata data packet is stored in the traceability metadata cache queue. Reverse matching: When a new business data message is received, search for data with a matching fingerprint in the source metadata cache queue; if found and the time meets the window threshold, reassembly is triggered; if not found, the business data message is stored in the business data cache queue.

[0011] Preferably, a preset time window threshold It can adaptively and dynamically adjust. The steps for adaptive window adjustment are as follows: First, the system calculates the current transmission delay jitter value of the physical isolation device in real time; Dynamically adjust the time window threshold:

[0012] in As the baseline delay time, The safety factor ranges from 1.2 to 1.5, and Jitter is the average latency fluctuation value of the most recent N data packets during transmission through the physical isolation device.

[0013] Preferably, step S5 further includes a business type consistency verification step before triggering the reorganization: The business topic field extracted from the independent source tracing metadata is compared with the type field after parsing the business data message; The lineage recombination operation is performed only when the composite content fingerprints are the same and the business topic fields are consistent; otherwise, it is considered a hash collision and an anomaly is recorded in the audit log.

[0014] A cross-regional data full-link tracing and reconstructing system for a power-isolated environment, applicable to the aforementioned cross-regional data full-link tracing and reconstructing method, includes a security zone 1 server, a security zone 3 server, a source-end accompanying agent module, a destination-end reconstructing engine module, and an anomaly auditing module. The source-side accompanying proxy module is deployed on the security zone 1 server and is used to perform composite content fingerprint construction and parallel sending operations; The host-end recombination engine module is deployed on a secure zone 3 server. It includes a double-buffered queue unit, a fingerprint index unit, and a window matching logic unit, which are used to perform S4 time-series sliding window matching and S5 lineage recombination operations. The anomaly auditing module is used to record anomalies within a time window threshold. For isolated business data or isolated source data that failed to be matched, generate an abnormal audit log.

[0015] As can be seen from the above technical solution compared with the prior art, the present invention has the following beneficial effects: 1. This invention achieves accurate association and end-to-end traceability of out-of-order transmitted data in a power isolation environment through composite content fingerprint identification, dual-queue buffering, and adaptive timing window bidirectional matching mechanism, while significantly reducing the probability of hash collisions.

[0016] 2. This invention achieves zero-intrusion deployment of the solution by bypassing traffic monitoring at the server network card layer without modifying the underlying firmware of the core power business system and isolation device, significantly reducing implementation costs and compatibility risks.

[0017] 3. This invention achieves accurate identification and risk control of abnormal data by combining composite fingerprint matching and business type consistency verification with log recording of the anomaly audit module, ensuring the reliability and compliance of cross-regional data reorganization. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the overall system architecture according to an embodiment of the present invention; Figure 2 This is a flowchart of the composite content fingerprint construction and parallel transmission of the data sending end in the secure zone of this invention; Figure 3 This is a logic diagram of the matching and recombination algorithm based on a sliding window for the data receiving end of the secure three-zone system of this invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.

[0020] The embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and examples. The following examples are used to illustrate the present invention, but should not be used to limit the scope of the present invention.

[0021] Example: In this embodiment, during the daily operation and maintenance of a provincial power grid control cloud platform, the front-end acquisition server of the first security zone needs to transmit massive amounts of telemetry and teleindication real-time business data across zones to the data platform of the third security zone. However, due to the transmission characteristics of the physical isolation device, it faces the practical problem of data disorder and lack of traceability. Therefore, a cross-zone data full-link traceability and reorganization method and system for power isolation environment is used in this invention. A method for full-link traceability and reassembly of cross-regional data in power isolation environments includes the following steps: S1: Source fingerprint construction, such asFigure 2 As shown, at the data sending end of security zone 1, business data packets to be transmitted across zones are intercepted through bypass mirroring or proxy methods; the effective payload of the business data packets is extracted, and a unique composite content fingerprint is generated by using a hash algorithm combined with the payload length; at the same time, an independent source traceability metadata data packet containing the content fingerprint, the full-link tracing identifier (TraceID), and the source timestamp is constructed.

[0022] The formula for generating composite content fingerprints is:

[0023] in, This represents the payload, Hash is the hash algorithm, and Length represents the byte length. This is a string concatenation operation. This means performing a digest algorithm on the payload. The effective payload byte length is used to reduce the probability of hash collisions between different business data.

[0024] S2: Heterogeneous parallel transmission treats the service data packets and independent traceability metadata packets as two independent data streams, and performs unidirectional transfer through a physical isolation device. During this process, the physical isolation device strips the network protocol header of the service data packets, but retains the contents of the payload unchanged.

[0025] S3: Dual-queue buffer at the destination end. At the data receiving end of the three security zones, a business data buffer queue and a traceability data buffer queue are established to temporarily store data packets that may be out of order and arrive through the physical isolation device.

[0026] S4: Time-series sliding window matching, based on a preset time window threshold. Using content fingerprints as the key index, bidirectional retrieval and matching are performed between the business data cache queue and the traceability metadata cache queue. The matching process includes forward matching, where new traceability packages are used to find old business data, and reverse matching, where new business data is used to find old traceability packages.

[0027] S5: Lineage Reconstruction. When data pairs with the same fingerprint and arrival time difference that meet the window threshold are retrieved, the full-link tracing identifier (TraceID) is reassociated with the corresponding business data packet, thereby restoring the full-link lineage relationship of cross-region data.

[0028] Furthermore, this invention also provides a cross-regional data end-to-end traceability and reassembly system for power physical isolation environments, comprising: a source-end accompanying agent module: deployed in security zone 1, used to intercept business data, calculate fingerprints, and construct and send traceability packets; a destination-end reassembly engine module: deployed in security zone 3, internally containing a double-buffered queue unit, a fingerprint index unit, and a window matching logic unit, used to perform data caching, fingerprint matching, and lineage reassembly; and an anomaly audit module: used to record isolated data that failed to match successfully within a time window threshold, generating anomaly audit logs for operation and maintenance analysis.

[0029] System deployment architecture, such as Figure 1 As shown, this system is applied to a provincial power grid control cloud platform.

[0030] Source environment: Security Zone 1, with a front-end data collection server deployed in the real-time control zone. A lightweight probe (Agent) is installed on this server.

[0031] Isolation Channels: Positive isolation devices from NARI or Kedong are used. Two virtual channels are configured: Channel 1 is used to transmit business segment data (binary stream), and Channel 2 is used to transmit source traceability metadata (JSON text).

[0032] Host environment: three security zones, management information zone, deployment of data middleware server, running the reorganization engine of this invention.

[0033] like Figure 3 As shown, the workflow of the host-side reorganization engine is as follows: Fingerprint calculation: The MD5 algorithm is combined with a length factor.

[0034] For example, the business data Payload is 0x1A2B3C..., with a length of 1024 bytes. The fingerprint is calculated as F = MD5(Payload) + "_1024". The length factor is introduced to leverage the discreteness of the business data length distribution, reducing the probability of collisions in a large number of short messages using only MD5 digests, thus ensuring fingerprint uniqueness in high-reliability power scenarios.

[0035] Caching mechanism: Allocate a memory area Queue_Biz to store unmatched business data; allocate a memory area Queue_Trace to store unmatched trace packages.

[0036] Sliding window matching (Python pseudocode logic description): Set the initial window .

[0037] When the traceability package is received At that time, his fingerprints were extracted. .

[0038] Iterate through Queue_Biz to check if the fingerprint exists. data packets .

[0039] If it exists, further calculate the arrival time difference. .

[0040] like If the match is successful, then the match will be determined to be successful. TraceID writing in The metadata fields are removed from the queue.

[0041] like If the data is expired or there is a hash collision, an exception will be recorded in the log.

[0042] Finally, to prevent the extremely rare scenario of "different data generating the same MD5 hash," this embodiment introduces a "topic verification" mechanism. This mechanism corresponds to the step in claim 4: after successful fingerprint matching, an additional verification step is added: determining whether the Topic field (such as "telemetry" or "telecommunications") in the traceability packet is consistent with the parsing type of the business data. If they are inconsistent, even if the fingerprints are the same, they will not be reassembled, thereby ensuring the absolute accuracy of data association and meeting the requirements for safe power grid production.

[0043] It is understood that the systems, devices, and storage media provided in the embodiments of the present invention correspond to the methods provided in the embodiments of the present invention, and the explanations, examples, and beneficial effects of the relevant content can be referred to the corresponding parts of the above methods.

[0044] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another.

[0045] For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access, or a data storage device such as a server or data center that integrates one or more available media.

[0046] The available media may be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid state disks (SSDs)).

[0047] It should be noted that in this paper, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0048] Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0049] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0050] The embodiments of the present invention are given for the purposes of illustration and description. Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention.

Claims

1. A method for full-link traceability and reassembly of cross-regional data in a power isolation environment, characterized in that, Includes the following steps: S1: Source fingerprint construction: At the data sending end in security zone 1, intercept the business data packets to be transmitted across zones; extract the payload of the business data packets, calculate the digest value of the payload using a hash algorithm, and generate a composite content fingerprint by combining the byte length of the payload; construct an independent source traceability metadata data packet containing the composite content fingerprint, the end-to-end tracking identifier, and the source timestamp; S2: Heterogeneous parallel transmission: Treat the business data packets and the independent source traceability metadata data packets as independent data streams, and perform unidirectional transfer through a physical isolation device; S3: Dual queue buffer at the destination end. At the data receiving end of the three security zones, a business data cache queue and a source metadata cache queue are established respectively to temporarily store out-of-order data that arrives through the physical isolation device. S4: Time-series sliding window matching, based on a preset time window threshold. Using composite content fingerprints as index keys, bidirectional retrieval and matching are performed between the business data cache queue and the source metadata cache queue; S5: Bloodline recombination, when fingerprints with the same arrival time difference are found. satisfy When data is retrieved, the end-to-end tracking identifier is re-associated with the corresponding business data message to restore the data lineage.

2. The method for cross-regional data end-to-end tracing and reassembly in a power isolation environment as described in claim 1, characterized in that: The formula for generating the composite content fingerprint is: in, This represents the payload, Hash is the hash algorithm, and Length represents the byte length. This is a string concatenation operation. This means performing a digest algorithm on the payload. The effective payload byte length is used to reduce the probability of hash collisions between different business data.

3. The method for cross-regional data end-to-end tracing and reassembly in a power isolation environment as described in claim 1, characterized in that: In the independent source tracing metadata: The end-to-end tracing identifier is a globally unique code pre-assigned in Security Zone 1 or an associated code generated based on the core characteristics of business data; The source timestamp is the local clock time or trusted time source time collected by the data sending end in Security Zone 1 when constructing the traceability metadata.

4. The method for cross-regional data end-to-end tracing and reassembly in a power isolation environment as described in claim 1, characterized in that: The physical isolation device strips the network protocol header of the service data packet during transmission.

5. The method for cross-regional data end-to-end tracing and reassembly in a power isolation environment as described in claim 1, characterized in that: The bidirectional retrieval matching in S4 specifically includes: Forward matching: When a new traceability metadata data packet is received, search for data with the same fingerprint in the business data cache queue; if found and the time meets the window threshold, reassembly is triggered; if not found, the traceability metadata data packet is stored in the traceability metadata cache queue. Reverse matching: When a new business data message is received, search for data with a matching fingerprint in the source metadata cache queue; if found and the time meets the window threshold, reassembly is triggered; if not found, the business data message is stored in the business data cache queue.

6. The method for cross-regional data end-to-end tracing and reassembly in a power isolation environment as described in claim 1, characterized in that: The preset time window threshold It can adaptively and dynamically adjust. The steps for adaptive window adjustment are as follows: First, the system calculates the current transmission delay jitter value of the physical isolation device in real time; Dynamically adjust the time window threshold: in As the baseline delay time, The safety factor ranges from 1.2 to 1.5, and Jitter is the average latency fluctuation value of the most recent N data packets during transmission through the physical isolation device.

7. The method for cross-regional data end-to-end tracing and reassembly in a power isolation environment as described in claim 1, characterized in that: Step S5, before triggering the reorganization, also includes a business type consistency verification step: The business topic field extracted from the independent source tracing metadata is compared with the type field after parsing the business data message; The lineage recombination operation is performed only when the composite content fingerprints are the same and the business topic fields are consistent; otherwise, it is considered a hash collision and an anomaly is recorded in the audit log.

8. A system for cross-regional data full-link tracing and reassembly in a power-isolated environment, applicable to the cross-regional data full-link tracing and reassembly method for power-isolated environments as described in any one of claims 1 to 7, characterized in that, This includes a security zone 1 server, a security zone 3 server, a source-end accompanying proxy module, a destination-end reorganization engine module, and an anomaly audit module; The source-end accompanying proxy module is deployed on the security zone 1 server and is used to perform composite content fingerprint construction and parallel sending operations; The host-end recombination engine module is deployed on a secure zone 3 server and includes a double-buffered queue unit, a fingerprint index unit, and a window matching logic unit, which are used to perform the time-series sliding window matching of S4 and the lineage recombination operation of S5. The anomaly auditing module is used to record within a time window threshold. For isolated business data or isolated source data that failed to be matched, generate an abnormal audit log.

Images