An interactive application method and system based on E-file across power system security zones

Abstract

The application relates to the field of cross-power system data interaction, in particular to an interactive application method and system based on E files across the security zones of a power system, which comprises the following steps: a first synchronization agent module located in a four-zone information management system is used to encrypt user request parameters, generate a request E file containing the encrypted request parameters and a globally unique identifier, and send the request E file to a one-zone production control system through a horizontal isolation device; a second synchronization agent module located in the one-zone production control system is used to decrypt the request E file to generate response data, encrypt the response data, generate a response E file containing the encrypted response data and the globally unique identifier, and send the response E file to the four-zone information management system through the horizontal isolation device; and the first synchronization agent module of the four-zone information management system is used to decrypt the response E file to obtain the request data; the application can realize bidirectional safe interaction between the four-zone information management system and the one-zone production control system.

Description

Technical Field

[0001] This invention relates to the field of cross-power system data interaction, specifically to an interactive application method and system based on E-files across power system security zones. Background Technology

[0002] Power dispatch automation systems are typically divided into multiple security zones, with Zone I being the production control zone (highest security level) and Zone IV being the information management zone. According to the "Regulations on Security Protection of Power Monitoring Systems," horizontal isolation devices are deployed between the production control zone and the management information zone to prohibit direct network data exchange. To meet the data sharing needs across security zones, the power system widely adopts the Data Model Description Language E (CIM / E) as its data description standard for data interaction. Developed by the National Power Dispatch and Communication Center, CIM / E uses a text file-based storage and exchange method, is independent of databases and operating systems, and has been widely used in power system mode calculations, grid operation data exchange, and other fields, forming industry standards such as Q / GDW 215-2008 "Power System Data Markup Language E Language Specification". However, existing technologies have the following shortcomings: (1) Existing cross-regional data interaction methods are mainly based on one-way data push, lacking a request-response interaction mode. Existing technologies mostly adopt a one-way data collection method of "one region periodically generating E files and pushing them to four regions". The four regions passively receive data and cannot actively initiate data requests or command requests to the one region. They do not support interactive operations such as on-demand querying and real-time control of the four region's pages. For example, existing patents mainly focus on building a collection module to transmit information generation files through security isolation to the other side. The business applications in the four regions periodically scan folders to obtain collection information. The information collection method is fixed and lacks scalability.

[0003] (2) The use of E-files is limited to batch data migration and no request-response mechanism has been established. Existing E-language related technologies mainly use E-files for offline or quasi-offline scenarios such as model exchange and batch data import and export, lacking an online request-response interaction framework based on E-files. The fourth-zone page cannot send a request for "query parameter X" to the first-zone page, nor can it obtain targeted response data.

[0004] (3) Lack of a mechanism for associating requests and responses. Even if some solutions achieve bidirectional file exchange, there is a lack of technical means to associate and match requests sent from the fourth zone with responses returned from the first zone, which makes it impossible for the fourth zone page to correspond the response results with the original request, making it difficult to achieve page-level interactive feedback.

[0005] (4) The data format for cross-regional interaction lacks a unified security encapsulation standard. In existing solutions, data and instructions transmitted across regions often use different formats and encryption methods, lacking a unified encapsulation standard, which is not conducive to system expansion and maintenance. Summary of the Invention

[0006] To address the aforementioned problems in existing technologies, this invention proposes an interactive application method based on E-files across power system security zones, comprising: The first synchronous agent module located in the fourth zone information management system is used to encrypt the acquired user request parameters, generate a request E file containing the encrypted request parameters and a globally unique identifier, and send it to the first zone production control system through the horizontal isolation device. The second synchronous agent module located in the production control system of Zone 1 decrypts the request E file to generate response data and encrypts the response data, generating a response E file containing the encrypted response data and the globally unique identifier, and sends it to the information management system of Zone 4 through the horizontal isolation device. The first synchronization agent module of the four-zone information management system is used to decrypt the response E file and obtain the request data.

[0007] Optionally, the encryption of user request parameters and the encryption of response data both employ Chinese national cryptographic algorithms, including the SM4 block cipher algorithm.

[0008] Optionally, the step of using the first synchronization agent module located in the four-zone information management system to encrypt the acquired user request parameters and generate a request E file containing the encrypted request parameters and a globally unique identifier includes: The first synchronous agent module located in the four-zone information management system encrypts the user request parameters using the SM4 block encryption algorithm to obtain the encrypted request parameter string; The request parameter string is encapsulated in CIM / E format to form the request E file, wherein the request E file is named using a timestamp, a globally unique identifier, and a request identifier.

[0009] Optionally, before encrypting the user request parameters using the SM4 block cipher algorithm, the following steps are also included: The binary byte stream of the user request parameters is converted into a common ASCII string using BASE64. The encryption of user request parameters using the SM4 block encryption algorithm specifically involves encrypting the user request parameters, which have been converted into a common ASCII string, using the SM4 block encryption algorithm.

[0010] Optionally, the response data is encrypted using a second synchronization agent module located in the production control system of Zone 1, generating a response E file containing the encrypted response data and the globally unique identifier. The steps include: The second synchronous agent module located in the production control system of Zone 1 is used to encrypt the response data using the SM4 block encryption algorithm to obtain the encrypted response data string; The response data string is encapsulated in CIM / E format to form a response E file, wherein the response E file is named using a timestamp, a globally unique identifier, and a response identifier.

[0011] Optionally, the following steps are included before encrypting the response data using the SM4 block cipher algorithm: The binary byte stream of the response data is converted into a generic ASCII string using BASE64. The encryption of the response data using the SM4 block cipher algorithm specifically involves encrypting the response data, which has been converted into a common ASCII string, using the SM4 block cipher algorithm.

[0012] Optionally, the national cryptographic algorithm also includes the SM2 asymmetric algorithm and the SM3 hash algorithm, and further includes the following before encryption using the national cryptographic algorithm: The SM2 asymmetric algorithm is used to achieve identity authentication and dynamic session key negotiation between the Zone 1 production control system and the Zone 4 information management system. The encryption process also includes using the SM3 hash algorithm to generate a corresponding digital digest based on the user request parameters and response data, and transmitting the digital digest synchronously with the encrypted request E-file or response E-file for the receiving end to perform integrity verification.

[0013] Optionally, the step of using the first synchronization agent module of the four-zone information management system to decrypt the response E file and obtain the request data includes: The first synchronization agent module of the four-zone information management system is used to decrypt the response E file, obtain the response data and globally unique identifier, associate the original request based on the globally unique identifier, and update the page using the decrypted response data.

[0014] Optionally, the user request parameters include a request type, which may include data query, control command, or batch data request.

[0015] A second aspect of the present invention provides an interactive application system based on E-files across power system security zones, comprising: The first synchronization agent module, deployed in the four-zone information management system, is used to encrypt the acquired user request parameters and generate a request E file containing the encrypted request parameters and a globally unique identifier. The second synchronization agent module is deployed in the production control system of Zone 1. It is used to decrypt the request E file to generate response data and encrypt the response data to generate a response E file containing the encrypted response data and the globally unique identifier. A lateral isolation device is used to transmit the request E-file and the response E-file.

[0016] Compared with existing technologies, this invention provides an interactive application method and system based on E-files across power system security zones. The method includes: encrypting acquired user request parameters using a first synchronization agent module located in the four-zone information management system to generate a request E-file containing the encrypted request parameters and a globally unique identifier, and sending it to the zone one production control system via a lateral isolation device; decrypting the request E-file using a second synchronization agent module located in the zone one production control system to generate response data and encrypting the response data to generate a response E-file containing the encrypted response data and the globally unique identifier, and sending it to the four-zone information management system via the lateral isolation device; and decrypting the response E-file using the first synchronization agent module of the four-zone information management system to obtain the request data. The beneficial effects of this invention are: (1) A complete request-response bidirectional interactive closed loop is constructed: Unlike the existing technology where one zone pushes data unidirectionally and four zones passively receive it, this invention supports four zones to actively initiate requests to one zone and obtain responses, realizing true cross-security zone bidirectional interaction, enabling the four zone pages to have on-demand query and real-time control capabilities.

[0017] (2) Full-process encryption protection for cross-regional interaction is achieved: User request parameters and response data are encrypted throughout the entire process of generation, transmission and parsing. Even if they are intercepted during the transfer of the horizontal isolation device, attackers cannot obtain the plaintext content, which effectively ensures the confidentiality of cross-regional data transmission.

[0018] (3) The precise association between requests and responses is achieved through a globally unique identifier: the response E file reuses the same globally unique identifier in the request E file, so that the four zones can correctly associate the response results with the corresponding original requests, avoiding response misalignment and page update errors in high-concurrency scenarios.

[0019] (4) The technical positioning of BASE64 is clarified—as a heterogeneous transmission adaptation encoding tool, it is only responsible for converting binary byte streams into universal ASCII strings, solving the problem of cross-system encoding compatibility. This invention abandons the misconception in traditional technology that BASE64 is used as an encryption or verification method, accurately defines the boundaries of technical functions, and provides a standardized input format for subsequent nested national cryptographic algorithms.

[0020] (5) A differentiated composite architecture of "BASE64 adapted transmission + national cryptographic full-dimensional security protection" was constructed: SM2 is responsible for identity authentication and key negotiation, blocking unauthorized device access from the source; SM4 is responsible for high-strength data encryption, ensuring encrypted transmission throughout the process; SM3 is responsible for integrity verification, accurately identifying data tampering. The three types of algorithms each perform their respective functions, forming a closed-loop security protection system.

[0021] (6) It completely overcomes the major security vulnerabilities of a single BASE64 encoding having no encryption capability and no anti-tampering capability, and at the same time solves the problem of poor heterogeneous adaptability of a single national cryptographic algorithm, achieving a double leap in transmission compatibility and security level.

[0022] (7) It can effectively resist various security risks such as link sniffing, data eavesdropping, man-in-the-middle attacks, file tampering and replacement, and illegal access and theft in heterogeneous and complex networks. There is no plaintext data exposure throughout the process, which fully meets the requirements of commercial cryptography compliance and information security level protection. Attached Figure Description

[0023] Figure 1 This is a flowchart of the interactive application method across power system security zones based on E-files proposed in this invention; Figure 2 This is a schematic diagram of the structure of the interactive application system based on E-files across power system security zones proposed in this invention; Figure 3 This is a schematic diagram of the workflow of the interactive application system based on E-files across power system security zones proposed in this invention. Detailed Implementation

[0024] This invention proposes an interactive application method and system based on E-files across power system security zones. The overall scheme is based on an interactive mode of "four zones initiating requests → one zone processing responses," which differs from the existing technology of "one zone unidirectional data push." ​​It achieves the following objectives: (1) To solve the problem that existing cross-regional interaction is mainly based on one-way push and lacks the ability to actively request, a request-response interaction method is provided in which a four-region page can actively initiate data requests and command requests to a one-region page.

[0025] (2) To solve the problem that the existing E-file technology is limited to batch data migration and lacks a request-response mechanism, a cross-regional request-response interaction framework based on E-file is constructed to realize a complete interactive closed loop of "four-region request generation → E-file encapsulation → one-region parsing response → response E-file return → four-region page update".

[0026] (3) To solve the problem of lack of association identifier between requests and responses, a unique request identifier mechanism based on UUID and timestamp is used to achieve accurate matching of requests and responses, ensuring that the four-zone pages can correctly associate the response results with the corresponding original requests.

[0027] (4) To solve the problems of inconsistent data formats and lack of secure encapsulation when interacting across regions, a standardized E file format is adopted, combined with SM2 / SM3 / SM4 encryption mechanisms, to achieve unified encapsulation and secure transmission of request parameters and response data.

[0028] Example 1: An interactive application method based on E-files across power system security zones, such as Figure 1 As shown, it includes the following steps S1 to S3.

[0029] This embodiment, based on the SG-CIM information model, achieves cross-regional data synchronization across multiple business systems and data types. These business systems involve heterogeneous data sources distributed across different security zones, including Dispatch Automation D5000, Distribution Automation D5200, the next-generation equipment asset lean management system PMS3.0, the Energy Internet Marketing Service System (Marketing 2.0), and the power grid resource business platform. Requested data types include: ① Time-series dispatch-side telemetry, tele-signaling, and SOE data; ② Time-series distribution network-side minute-level frozen measurements, hourly-level frozen measurements, daily frozen measurements, and event-related data; ③ Dispatch main grid ledger data; ④ Distribution grid-side ledger data; ⑤ Statistical analysis data: upper and lower limits of user adjustable potential, renewable energy output forecasts, and multi-energy load user load forecasts.

[0030] S1 uses the first synchronous agent module located in the fourth zone information management system to encrypt the acquired user request parameters, generate a request E file containing the encrypted request parameters and a globally unique identifier, and send it to the first zone production control system through the horizontal isolation device.

[0031] The information management system for Zone 4 and the production control system for Zone 1 are heterogeneous systems. Faced with this heterogeneous transmission scenario, this embodiment constructs a full-process encrypted transmission system for E-files based on the BASE64 algorithm. This invention abandons the misconception in traditional technologies that use BASE64 as an encryption and verification method, precisely defining the boundaries of technical functions: BASE64 is only used as a heterogeneous transmission adaptation encoding tool, responsible only for converting the binary byte stream of user request parameters or response data into a common ASCII string, solving cross-system encoding compatibility issues; it does not possess data encryption, integrity verification, or anti-tampering capabilities. Therefore, this invention, based on BASE64 encoding adaptation, nests a complete set of national cryptographic algorithms to construct an independent, closed-loop, high-strength security protection system, completely compensating for the technical deficiency of BASE64's lack of security protection capabilities. In a further preferred embodiment, the national cryptographic algorithm includes the SM4 block encryption algorithm.

[0032] In a further preferred embodiment, the first synchronization agent module located in the four-zone information management system encrypts the acquired user request parameters to generate a request E file containing the encrypted request parameters and a globally unique identifier. The steps include: The first synchronous agent module located in the four-zone information management system encrypts the user request parameters using the SM4 block encryption algorithm to obtain the encrypted request parameter string; The request parameter string is encapsulated in CIM / E format to form the request E file, wherein the request E file is named using a timestamp, a globally unique identifier, and a request identifier.

[0033] In a further preferred embodiment, the national cryptographic algorithm also includes the SM2 asymmetric algorithm and the SM3 hash algorithm, and before encryption using the national cryptographic algorithm, it also includes: The SM2 asymmetric algorithm is used to achieve identity authentication and dynamic session key negotiation between the Zone 1 production control system and the Zone 4 information management system. The encryption process also includes using the SM3 hash algorithm to generate a corresponding digital digest based on the user request parameters and response data, and transmitting the digital digest synchronously with the encrypted request E-file or response E-file for the receiving end to perform integrity verification.

[0034] In this embodiment, the four-zone information management system performs the following operations: Step 1: Obtain the user request parameters (such as device ID, query type, instruction content, etc.) corresponding to the user operation.

[0035] Step 2: Calculate the corresponding digital digest using the SM3 hash algorithm on the user request parameters, and encrypt the user request parameters using the SM4 block cipher algorithm to ensure the security of data transmission. Step 3: Generate the request E file according to the preset E file format specifications. The file naming rule is as follows: The timestamp is in the file _uuid_request.txt, where: Timestamp: Request time accurate to milliseconds, such as 20250129173155; uuid: A globally unique identifier used to uniquely identify this request; _request: File type identifier, indicating that the file is a request file initiated by the fourth zone.

[0036] Step 4: Encapsulate the content of the request E file with the CIM / E format, as follows: <!CIM / EFormatVersion=1.0Encoding=UTF-8!> <request> @MethodParam #SM2 / SM3 / SM4 encrypted input parameters (This is the encrypted request parameter string for SM2 / SM3 / SM4) The first synchronization agent module mentioned above will send the generated request file E to the file receiving directory specified in Zone 1 through the transfer mechanism of the lateral isolation device.

[0037] In this embodiment, in order to meet the requirements of bidirectional data exchange, a forward isolation device and a reverse isolation device are deployed in actual deployment to build a bidirectional isolated secure data exchange platform.

[0038] S2, the second synchronous agent module located in the production control system of Zone 1 decrypts the request E file to generate response data and encrypts the response data, generating a response E file containing the encrypted response data and the globally unique identifier, and sends it to the information management system of Zone 4 through the horizontal isolation device.

[0039] The specific steps of step S2 include: Step 1: The second synchronization agent module located in Zone 1 periodically scans the receiving directory. Upon detecting a new request file E, it parses the request file E and extracts... <request>SM2 / SM3 / SM4 encrypted strings within the tag.

[0040] Step 2: Decrypt the SM2 / SM3 / SM4 encrypted string to obtain the original request parameters, and compare the newly calculated digital digest with the digital digest in the message. If they are completely consistent, it is determined that the data has not been tampered with during transmission, the integrity check passes, and the receiving end submits the decrypted request E file to the business system or page system for further processing; if they are inconsistent, it is determined that the data has been tampered with or corrupted, the receiving end discards the file, and can choose to trigger an abnormal alarm or request a retransmission mechanism.

[0041] Step 3: Forward the parsed request parameters to the Zone 1 business system for processing and execution of business logic (such as querying device parameters, executing control commands, etc.).

[0042] Step 4: After the Zone 1 business system completes the request processing, it returns the processing result (i.e., the response data, such as the queried data, the command execution result, etc.) to the second synchronization agent module; Step 5: The second synchronization proxy module performs SM2, SM3, and SM4 encryption on the response data as described above. Specifically, it uses BASE64 to convert the binary byte stream of the response data into a common ASCII string; and then encrypts the converted ASCII string response data using the SM4 block cipher algorithm. Step 6: Generate a response E-file according to the preset E-file format specification; and use the SM3 hash algorithm to generate a corresponding digital digest based on the response data, and transmit the digital digest and the encrypted response E-file synchronously for integrity verification by the receiving end. The file naming rule is: timestamp_uuid_response.txt, where: Timestamp: The time the response was generated; uuid: Uses the same UUID as the corresponding request E file to achieve the association and matching of requests and responses; _response: File type identifier, indicating that the file is a response file returned by Zone 1.

[0043] Step 7: The response E file content is encapsulated in CIM / E format, as follows: <!CIM / EFormatVersion=1.0Encoding=UTF-8!> <response> @data # Response results encrypted with SM2 / SM3 / SM4 (this is the response data string encrypted with SM2 / SM3 / SM4) < / response> Step 8: The second synchronization agent module sends the generated response E file to the file receiving directory specified in Zone 4 through the lateral isolation device.

[0044] S3, the first synchronization agent module of the four-zone information management system is used to decrypt the response E file and obtain the request data.

[0045] The response E file is transmitted to the four-zone information management system using the SM2 asymmetric algorithm. The first synchronization agent module periodically scans the receiving directory. Upon detecting a new response E file, it reads the file content, parses the file, and extracts... <response>The tag contains an SM2 / SM3 / SM4 encrypted string, and the digital digest is recalculated using the SM3 hash algorithm. The newly calculated digital digest is compared with the digital digest in the message. If they match completely, it is determined that the data has not been tampered with during transmission and the integrity check passes. Then, based on the UUID field in the decrypted response E file name, the corresponding original request context is found, and the response data is associated and matched with the request. If they do not match, it is determined that the data has been tampered with or corrupted. The receiving end discards the file and can choose to trigger an abnormal alarm or request a retransmission mechanism.

[0046] The four-zone information management system updates the page display based on the response data (such as displaying query results, indicating the execution status of instructions, etc.), completing a complete cross-zone request-response interaction loop.

[0047] This invention achieves precise association between requests and responses through the UUID field in the filename. The specific mechanism is as follows: When the fourth region initiates a request, it generates a globally unique UUID and embeds the UUID into the filename of the request E file. When generating a response in Zone 1, the same UUID from the request E file is reused and embedded in the filename of the response E file. After receiving the response file E, Zone 4 can find the original request corresponding to the response by extracting the UUID from the file name, thus correctly associating the response data with the request context (such as which page component to update, which processing function to call back, etc.).

[0048] This mechanism ensures that in high-concurrency request scenarios, the four-zone pages can accurately match each response to the corresponding request, avoiding response misalignment and page update errors.

[0049] [Request Type Extension] This invention supports through <request>The MethodParam section within the tag defines different request types, including but not limited to Table 1 below: Table 1

[0050] Therefore, in the transmission link establishment phase, this invention uses the SM2 asymmetric algorithm to complete the identity authentication and dynamic session key negotiation between heterogeneous nodes at both ends, preventing unauthorized devices and forged terminals from accessing the transmission link and blocking the attack path for illegal theft and forgery of E-file data at the source. In the data encryption phase, the SM4 block cipher algorithm is used to perform high-strength symmetric encryption on the plaintext data of the BASE64-encoded E-file, ensuring that the file is transmitted in ciphertext form throughout the entire process. This completely solves the shortcoming of BASE64 encoding, which can be directly decoded and read as plaintext and lacks confidentiality. Simultaneously, relying on the high throughput and low latency characteristics of SM4, it balances encryption security and file transmission efficiency, adapting to remote transmission scenarios for E-files of various sizes. In the integrity verification phase, the SM3 hash algorithm generates a unique irreversible digital digest of the original E-file data, and the digest is synchronously bound to the SM4 ciphertext for transmission. The receiving end decrypts the digest and verifies the information a second time, accurately identifying anomalies such as data tampering, message loss, and malicious file replacement during transmission, perfectly compensating for the core deficiency of BASE64 in being unable to perform data integrity verification.

[0051] This invention constructs a differentiated composite architecture of "BASE64 adapted transmission + national cryptographic full-dimensional security protection," strictly distinguishing the technical positioning of the two types of algorithms and specifically addressing the core pain points of existing technologies: BASE64 is dedicated to solving engineering adaptation problems such as encoding incompatibility of heterogeneous systems and garbled text distortion during file transmission, while the complete set of national cryptographic algorithms SM2 / SM3 / SM4 are dedicated to undertaking the security functions of identity authentication, encryption and confidentiality, and integrity verification. This completely overcomes the major security vulnerabilities of a single BASE64 algorithm, which can only be used for encoding adaptation but lacks encryption capabilities, anti-tampering verification capabilities, and plaintext can be directly parsed. At the same time, it solves the problems of poor heterogeneous adaptability and insufficient transmission compatibility of a single national cryptographic algorithm. Compared to traditional plaintext transmission, weak protection with only BASE64 encoding, and simple encrypted transmission, this invention achieves a dual leap in transmission compatibility and security level. It can effectively resist various security risks in heterogeneous and complex networks, such as link sniffing, data eavesdropping, man-in-the-middle attacks, file tampering and replacement, and unauthorized access and theft. There is no plaintext data exposure throughout the entire process, which comprehensively protects the authenticity, confidentiality, and integrity of E-class confidential documents transmitted across systems and networks. It fully meets the requirements of commercial cryptography compliance and information security level protection. The technical logic is rigorous, the implementation is strong, and it has extremely high technical barriers and industrial practical value.

[0052] Example 2: Based on the same inventive concept, this invention also provides an interactive application system based on E-files across power system security zones, such as... Figure 2 As shown, it includes: The first synchronization agent module, deployed in the four-zone information management system, is used to encrypt the acquired user request parameters and generate a request E file containing the encrypted request parameters and a globally unique identifier. The second synchronization agent module is deployed in the production control system of Zone 1. It is used to decrypt the request E file to generate response data and encrypt the response data to generate a response E file containing the encrypted response data and the globally unique identifier. A lateral isolation device is used to transmit the request E-file and the response E-file.

[0053] The fourth-zone information management system interacts with the first synchronous agent module through an internal interface, and the first-zone production control system calls the second synchronous agent module through an internal interface.

[0054] Figure 3 The diagram details the complete timeline from user interaction to page update. Vertically arranged, it shows four participating entities: Zone 4 user / page, Zone 4 synchronization proxy module (also known as the first synchronization proxy module), horizontal isolation device, Zone 1 synchronization proxy module (also known as the second synchronization proxy module), and Zone 1 business system (also known as the Zone 1 production control system). Horizontal arrows represent message passing, and the top-to-bottom arrangement represents time progression. The main steps include: ① User triggers operation and captures request parameters; ② Generates request E-file (containing UUID and SM2 / SM3 / SM4 encryption); ③ Transfers the request to Zone 1 via the isolation device; ④ Parses the request and invokes the business system; ⑤ Business processing; ⑥ Generates response E-file (reusing the same UUID); ⑦ Transfers the request back to Zone 4 via the isolation device; ⑧ Parses the response and matches the request context; ⑨ Updates the page display.

[0055] The production control area (Zone 1) has deployed a power grid operation monitoring and operating system, providing a complete visual interface, including power grid wiring diagrams, equipment parameter query panels, real-time data tables, and setting management interfaces. This system was originally only accessible within the Zone 1 internal network.

[0056] The Information Management Zone (Zone 4) needs to reuse some pages from the Zone 1 system within the Zone 4 office environment, including page layout, interactive controls, and operation logic. When users perform active operations on the Zone 4 pages (such as clicking a query button, selecting a device, modifying parameters and submitting), the page can request data from the Zone 1 source server and display the results in real time, without the user being aware of the cross-zone communication.

[0057] In a further preferred embodiment, the encryption of user request parameters by the first synchronous proxy module and the encryption of response data by the second synchronous proxy module both employ Chinese national cryptographic algorithms, including the SM4 block encryption algorithm.

[0058] In a further preferred embodiment, the first synchronization proxy module encrypts the acquired user request parameters and generates a request E file containing the encrypted request parameters and a globally unique identifier. The steps include: The first synchronization proxy module encrypts the user request parameters using the SM4 block encryption algorithm to obtain the encrypted request parameter string; The request parameter string is encapsulated in CIM / E format to form the request E file, wherein the request E file is named using a timestamp, a globally unique identifier, and a request identifier.

[0059] In a further preferred embodiment, before the first synchronization proxy module encrypts the user request parameters using the SM4 block encryption algorithm, it further includes: The binary byte stream of the user request parameters is converted into a common ASCII string using BASE64. The encryption of user request parameters using the SM4 block encryption algorithm specifically involves encrypting the user request parameters, which have been converted into a common ASCII string, using the SM4 block encryption algorithm.

[0060] In a further preferred embodiment, the second synchronization proxy module encrypts the response data and generates a response E file containing the encrypted response data and the globally unique identifier. The steps include: The second synchronous agent module located in the production control system of Zone 1 is used to encrypt the response data using the SM4 block encryption algorithm to obtain the encrypted response data string; The response data string is encapsulated in CIM / E format to form a response E file, wherein the response E file is named using a timestamp, a globally unique identifier, and a response identifier.

[0061] In a further preferred embodiment, before the second synchronization proxy module encrypts the response data using the SM4 block cipher algorithm, it also includes: The binary byte stream of the response data is converted into a generic ASCII string using BASE64. The encryption of the response data using the SM4 block cipher algorithm specifically involves encrypting the response data, which has been converted into a common ASCII string, using the SM4 block cipher algorithm.

[0062] In a further preferred embodiment, the Chinese cryptographic algorithm in the first and second synchronization proxy modules also includes the SM2 asymmetric algorithm and the SM3 hash algorithm, and further includes the following before encryption using the Chinese cryptographic algorithm: The SM2 asymmetric algorithm is used to achieve identity authentication and dynamic session key negotiation between the Zone 1 production control system and the Zone 4 information management system. The encryption process also includes using the SM3 hash algorithm to generate a corresponding digital digest based on the user request parameters and response data, and transmitting the digital digest synchronously with the encrypted request E-file or response E-file for the receiving end to perform integrity verification.

[0063] In a further preferred embodiment, the first synchronization proxy module decrypts the response E file to obtain the request data, the steps of which include: The first synchronous proxy module is used to decrypt the response E file to obtain the response data and a globally unique identifier. The original request is associated with the globally unique identifier, and the page is updated using the decrypted response data.

[0064] In a further preferred embodiment, the user request parameters in the first synchronization agent module include request types, which include data queries, control commands, and batch data requests.

[0065] The above are merely embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention are included within the scope of the claims of the present invention pending approval.< / request> < / response> < / request> < / request>

Claims

1. An interactive application method based on E-files across power system security zones, characterized in that, include: The first synchronous agent module located in the fourth zone information management system is used to encrypt the acquired user request parameters, generate a request E file containing the encrypted request parameters and a globally unique identifier, and send it to the first zone production control system through the horizontal isolation device. The second synchronous agent module located in the production control system of Zone 1 decrypts the request E file to generate response data and encrypts the response data, generating a response E file containing the encrypted response data and the globally unique identifier, and sends it to the information management system of Zone 4 through the horizontal isolation device. The first synchronization agent module of the four-zone information management system is used to decrypt the response E file and obtain the request data.

2. The interactive application method based on E-files across power system security zones according to claim 1, characterized in that, The encryption of user request parameters and response data both employ Chinese national cryptographic algorithms, including the SM4 block cipher algorithm.

3. The interactive application method based on E-files across power system security zones according to claim 2, characterized in that, The step of encrypting the acquired user request parameters using the first synchronization agent module located in the four-zone information management system to generate a request E file containing the encrypted request parameters and a globally unique identifier includes: The first synchronous agent module located in the four-zone information management system encrypts the user request parameters using the SM4 block encryption algorithm to obtain the encrypted request parameter string; The request parameter string is encapsulated in CIM / E format to form the request E file, wherein the request E file is named using a timestamp, a globally unique identifier, and a request identifier.

4. The interactive application method based on E-files across power system security zones according to claim 3, characterized in that, Before encrypting the user request parameters using the SM4 block cipher algorithm, the following steps are also included: The binary byte stream of the user request parameters is converted into a common ASCII string using BASE64. The encryption of user request parameters using the SM4 block encryption algorithm specifically involves encrypting the user request parameters, which have been converted into a common ASCII string, using the SM4 block encryption algorithm.

5. The interactive application method based on E-files across power system security zones according to claim 2, characterized in that, The response data is encrypted using the second synchronization agent module located in the production control system of Zone 1, generating a response E file containing the encrypted response data and the globally unique identifier. The steps include: The second synchronous agent module located in the production control system of Zone 1 is used to encrypt the response data using the SM4 block encryption algorithm to obtain the encrypted response data string; The response data string is encapsulated in CIM / E format to form a response E file, wherein the response E file is named using a timestamp, a globally unique identifier, and a response identifier.

6. The interactive application method across power system security zones based on E-files according to claim 5, characterized in that, Before encrypting the response data using the SM4 block cipher algorithm, the following steps are also included: The binary byte stream of the response data is converted into a generic ASCII string using BASE64. The encryption of the response data using the SM4 block cipher algorithm specifically involves encrypting the response data, which has been converted into a common ASCII string, using the SM4 block cipher algorithm.

7. The interactive application method based on E-files across power system security zones according to claim 2, characterized in that, The national cryptographic algorithm also includes the SM2 asymmetric algorithm and the SM3 hash algorithm. Prior to encryption using the national cryptographic algorithm, it also includes: The SM2 asymmetric algorithm is used to achieve identity authentication and dynamic session key negotiation between the Zone 1 production control system and the Zone 4 information management system. The encryption process also includes using the SM3 hash algorithm to generate a corresponding digital digest based on the user request parameters and response data, and transmitting the digital digest synchronously with the encrypted request E-file or response E-file for the receiving end to perform integrity verification.

8. The interactive application method based on E-files across power system security zones according to claim 1, characterized in that, The first synchronization agent module of the four-zone information management system decrypts the response E file to obtain the request data. The steps include: The first synchronization agent module of the four-zone information management system is used to decrypt the response E file, obtain the response data and globally unique identifier, associate the original request based on the globally unique identifier, and update the page using the decrypted response data.

9. The interactive application method based on E-files across power system security zones according to claim 1, characterized in that, The user request parameters include the request type, which includes data query, control command, and batch data request.

10. An interactive application system based on E-files across power system security zones, characterized in that, include: The first synchronization agent module, deployed in the four-zone information management system, is used to encrypt the acquired user request parameters and generate a request E file containing the encrypted request parameters and a globally unique identifier. The second synchronization agent module is deployed in the production control system of Zone 1. It is used to decrypt the request E file to generate response data and encrypt the response data to generate a response E file containing the encrypted response data and the globally unique identifier. A lateral isolation device is used to transmit the request E-file and the response E-file.

Images