Data interaction system based on cloud platform

Abstract

The utility model relates to a data interaction system based on a cloud platform, and the system comprises a server which is used for providing computing resources for the processing of energy management platform data; the in-cloud core route is used for providing a route capable of managing platform data interaction for the server; the out-of-cloud convergence switch is used for providing a route capable of managing platform data interaction for the server; the first encryption device is parallelly connected and laterally hung with the out-of-cloud convergence switch, the out-of-cloud convergence switch directs the energy management platform data to the first encryption device, and the first encryption device is used for executing first security policy processing on the energy management platform data; the second encryption device is used for executing second security policy processing on the energy management platform data and sending the energy management platform data processed by the second security policy; and the interface equipment is used for forwarding the energy management platform data to the second encryption device or forwarding the energy management platform data to the energy subsystem. According to the scheme of the invention, the confidentiality of data interaction between the energy management platform and the energy subsystem is ensured.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a data interaction system based on a cloud platform. Background Art

[0002] At present, under the general trend of everything going to the cloud, the energy management platform (hereinafter referred to as the energy management platform) is deployed on the cloud platform. Since the cloud platform, especially the private cloud, has set up a unified data interface, for conventional energy subsystems such as metering and energy consumption, the energy management platform can complete the corresponding data interaction through the unified data interface set up by the cloud platform.

[0003] The inventors found that for power and control energy subsystems, in order to meet the power security requirements and ensure the correct issuance of control commands / strategies, special encryption operations need to be performed on the data interaction routes to increase the confidentiality and exclusivity of the transmission channel, which requires improvements to the unified data interface of the cloud platform. However, there is currently no solution to ensure the confidentiality of data interaction between the energy management platform and the energy subsystem. Utility Model Content

[0004] In response to the shortcomings of the prior art, the present application provides a data interaction system based on a cloud platform. Without changing the data acquisition network architecture of the cloud platform, the first encryption device is "parallel-mounted" on the aggregation switch outside the cloud, and the second encryption device is connected in series on the energy subsystem side, so that the first encryption device and the second encryption device form a one-to-many vertical encryption channel, and a vertical encryption strategy is formulated to ensure the confidentiality of data interaction between the energy management platform and the energy subsystem.

[0005] According to one aspect of the present application, a data interaction system based on a cloud platform is provided, characterized in that it includes:

[0006] Servers, deployed on the cloud platform, are used to provide computing resources for processing data on the energy management platform;

[0007] The cloud core router is connected to the server in the cloud platform and is used to provide the server with a route for data interaction with the energy management platform;

[0008] An off-cloud aggregation switch, connected to the on-cloud core router outside the cloud platform, for providing the server with a route for data interaction with the energy management platform;

[0009] A first encryption device is connected in parallel with the off-cloud aggregation switch, the off-cloud aggregation switch directs the energy management platform data to the first encryption device, and the first encryption device is used to perform a first security policy processing on the energy management platform data;

[0010] A second encryption device is connected in series between the business network and the interface device of the energy management platform on the energy subsystem side, and is used to execute a second security policy processing on the energy management platform data, and send the energy management platform data processed by the second security policy;

[0011] The interface device is arranged on the energy subsystem side, and is used to complete data interaction with the energy subsystem, and forward the data sent by the energy subsystem to the second encryption device or forward the data sent by the energy management platform to the energy subsystem.

[0012] The cloud core router is used to route the data sent from the energy management platform of the server to the cloud aggregation switch;

[0013] The off-cloud convergence switch is used to direct the data sent by the energy management platform to the first encryption device;

[0014] The first encryption device is used to perform a first security policy encryption process on the data sent by the energy management platform, and forward the data sent by the energy management platform after the first security policy encryption process to the second encryption device via the business network;

[0015] The second encryption device is used to perform a second security policy decryption process on the data sent by the energy management platform, and send the data sent by the energy management platform after the second security policy decryption process to the interface device;

[0016] The interface device is used to forward the data sent by the energy management platform to the energy subsystem.

[0017] Wherein, the interface device is used to forward the data sent by the energy subsystem to the second encryption device;

[0018] The second encryption device is used to perform a second security policy encryption process on the data sent by the energy subsystem, and forward the data sent by the energy subsystem after the second security policy encryption process to the off-cloud aggregation switch via the service network;

[0019] The off-cloud aggregation switch is used to direct the data sent by the energy subsystem after encryption processing by the second security policy to the first encryption device;

[0020] The first encryption device is used to perform first security policy decryption processing on the energy subsystem sent data after the second security policy encryption processing, and route the energy subsystem sent data after the first security policy decryption processing to the cloud core router via the cloud-outside aggregation switch;

[0021] The core routing within the cloud is used to route the data sent by the energy subsystem to the server.

[0022] Among them, the off-cloud aggregation switch is used for VLAN configuration, and the two network ports of the off-cloud aggregation switch and the two Ethernet ports of the first encryption device form two independent VLAN channels, so that the relevant data is sequentially transmitted through the off-cloud aggregation switch, a VLAN channel, the first encryption device and its first security policy encryption / decryption processing, and another VLAN, and then output again from another network port of the off-cloud aggregation switch.

[0023] Wherein, the first encryption device includes a gigabit encryption device, and the second encryption device includes a 100M encryption device.

[0024] It is characterized in that the first security policy and the second security policy include encryption, decryption and data tunnel configuration.

[0025] The data sent by the energy management platform include control instructions and strategy data for the energy subsystem.

[0026] The data sent by the energy subsystem include monitoring data of the energy subsystem on objects in the power and industrial control industries.

[0027] Wherein, the energy subsystem includes one or more energy subsystems.

[0028] Wherein, the server includes an energy management platform virtual server.

[0029] According to a data interaction system based on a cloud platform provided by the present application, on the basis of keeping the network architecture of the cloud platform unchanged, by "parallel hanging" the first encryption device on the cloud-outside aggregation switch, and connecting the second encryption device in series on the energy subsystem side, configuring the vertical security policy on the first encryption device and the second encryption device, the cloud-outside aggregation switch configures VLAN (Virtual Local Area Network) so that the data entering and leaving the cloud-outside aggregation switch will be directed through the first encryption device for security policy processing, and form a vertical encryption channel with the second encryption device on the energy subsystem side. In this way, through VLAN division, data flow orientation, vertical security policy formulation and other operations, the problem of vertical encryption of the one-to-many data transmission channel between the energy management platform deployed on the cloud platform and the energy subsystem is solved, so that the energy management platform control and its strategy can be accurately sent to the energy subsystem, and the energy management platform deployed on the cloud platform can realize the centralized control and intelligent operation and maintenance of the energy subsystem, providing guidance for the planning and implementation of the comprehensive energy management platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without exceeding the scope of protection required by the present application.

[0031] Figure 1 It is a schematic diagram of a data interaction system based on a cloud platform in the prior art.

[0032] Figure 2 It is a schematic diagram of a data interaction system based on a cloud platform according to an embodiment of the present application. DETAILED DESCRIPTION

[0033] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0034] Figure 1 Schematic diagram of a data interaction system based on a cloud platform in the prior art. Figure 1 As shown, the data interaction system based on the cloud platform in the prior art includes: a server deployed on the cloud platform, a core router within the cloud, an aggregation switch outside the cloud, a business network, and an interface device on the energy subsystem side.

[0035] exist Figure 1 In the illustrated embodiment, the server deployed on the cloud platform may be an energy management platform virtual server, which is responsible for energy management platform data processing and various advanced application computing functions, and provides computing resources for energy management platform data processing. The virtual server is set with an IP address (EIP, and MAC address binding) that complies with the cloud platform plan. The virtual server directly completes data interaction with the energy subsystem side interface device through cloud routing and network routing (i.e., network routing).

[0036] exist Figure 1 In the illustrated embodiment, the core router in the cloud is connected to the server in the cloud platform, and is the portal for data interaction between the cloud and outside the cloud. The corresponding network port (for example, RJ45 network port) of the core router in the cloud is set with an IP address (EIP', IP1', and MAC address binding) that complies with the cloud platform plan, providing a network route for data interaction between the virtual server of the energy management platform and the energy subsystem outside the cloud.

[0037] exist Figure 1In the illustrated embodiment, the off-cloud aggregation switch is a bridge connecting the core routing within the cloud and the business network. It is an aggregation switch deployed in the business network close to the core routing within the cloud. The off-cloud aggregation switch is connected to the core routing within the cloud to provide a network route for data interaction between the virtual server of the energy management platform and the energy subsystem outside the cloud.

[0038] The business network can be the airport general network. Figure 1 In the illustrated embodiment, the business network is spread throughout the entire airport, providing network routing for data interaction between the off-cloud aggregation switch and the energy subsystem.

[0039] The energy subsystem is spread throughout the airport, and exchanges data with the energy management platform interface devices outside the system through its interface devices.

[0040] The interface device of the energy management platform is a communication device set up by the energy management platform on the energy subsystem side to complete data interaction with the energy subsystem, and forward the data of the energy subsystem to the virtual server of the energy management platform through the business network, the aggregation switch outside the cloud, and the core switch within the cloud.

[0041] according to Figure 1 In the embodiment shown, the interface device on the energy subsystem side sequentially exchanges data with the virtual server of the energy management platform in the cloud through the business network, the aggregation switch outside the cloud, the core router in the cloud and other network routes and devices.

[0042] However, since the power energy subsystem and the energy management platform issue control instructions and control strategies to the energy subsystem and have special requirements for network security, it is necessary to add longitudinal encryption devices on both sides of the network routes with special requirements to ensure the confidentiality and exclusivity of the transmission channel.

[0043] To this end, the present application provides a new data interaction system based on a cloud platform. Figure 2 Schematic diagram of a data interaction system based on a cloud platform according to an embodiment of the present application. Figure 1 In comparison, in addition to the servers deployed on the cloud platform, the core routers within the cloud, the aggregation switches outside the cloud, the business network, and the interface devices on the energy subsystem side, the cloud platform-based data interaction system provided in the present application also includes: a first encryption device and a second encryption device on the energy subsystem side.

[0044] exist Figure 2 In the embodiment shown, the functions of the server deployed on the cloud platform, the core routing in the cloud, the business network, and the interface devices on the energy subsystem side are similar to those of the Figure 1 The functions of the servers deployed on the cloud platform, the core routers in the cloud, the aggregation switches outside the cloud, the business network, and the interface devices on the energy subsystem side are the same or similar and will not be repeated here.

[0045] According to some embodiments, the data exchanged between the energy management platform virtual server and the energy subsystem outside the cloud is energy management platform data, and the energy management platform data includes data sent by the energy management platform and data sent by the energy subsystem. Among them, the data sent by the energy management platform includes energy management platform data sent by the energy management platform virtual server to the energy subsystem, including control instructions and control strategies, etc., and the data sent by the energy subsystem includes energy management platform data sent by the energy subsystem to the energy management platform virtual server, including data generated by the energy subsystem, such as data on the airport's monitoring and control of electricity and industrial control equipment.

[0046] exist Figure 2 In the illustrated embodiment, the data sent down by the energy management platform is processed by the computing resources provided by the virtual server of the energy management platform, and then directed to the first encryption device through the core routing in the cloud and the routing of the aggregation switch outside the cloud. The first encryption device is connected in parallel with the aggregation switch outside the cloud, and performs a first security policy encryption process on the data sent down by the energy management platform. The data sent down by the energy management platform after the first security policy encryption process is sent to the second encryption device via the business network. The second encryption device performs a second security policy decryption process on the data passing through the energy management platform, and then sends it to one or more energy subsystems through the interface device. Figure 2 In the illustrated embodiment, after the energy subsystem uploads data generated by one or more energy subsystems, the energy subsystem sends the generated upload data to the second encryption device through the interface device. After the second encryption device performs second security policy encryption processing on the passed data, the energy subsystem upload data after the second security policy encryption processing is sent to the off-cloud aggregation switch through the business network. The off-cloud aggregation switch directs the energy subsystem upload data to the first encryption device. After the first encryption device performs first security policy decryption processing on the energy subsystem upload data, the energy subsystem upload data after the first security policy decryption processing is routed to the cloud core router via the off-cloud aggregation switch. The cloud core router routes the energy subsystem upload data to the energy management platform virtual server.

[0047] exist Figure 2 In the illustrated embodiment, the business network forms a network route with the cloud-external aggregation switch IP4 and the second encryption device IP4'; the energy subsystem is spread throughout the airport and exchanges data with systems or platforms outside the system through interface devices.

[0048] exist Figure 2In the illustrated embodiment, the first encryption device is connected in parallel with the off-cloud aggregation switch. According to some embodiments, the off-cloud aggregation switch is used to perform VLAN configuration, and the two network ports of the off-cloud aggregation switch and the two Ethernet ports of the first encryption device form two independent VLAN channels, so that the relevant data is sequentially transmitted through the off-cloud aggregation switch, a VLAN channel, the first encryption device and its first security policy encryption / decryption processing, and another VLAN, and then output from another network port of the off-cloud aggregation switch. In this way, through the VLAN configuration of the off-cloud aggregation switch, the data that was originally transmitted directly through the off-cloud aggregation switch must first be processed by the security policy of the first encryption device before being transmitted to the target device through the off-cloud aggregation switch.

[0049] The VLAN configuration adopted by the off-cloud aggregation switch may adopt a common switch VLAN configuration method in the prior art.

[0050] exist Figure 2 In the illustrated embodiment, the first encryption device is deployed on the cloud platform side to encrypt / decrypt passing data packets. Its upstream and downstream network ports (e.g., RJ45 network ports) are set with IP addresses (IP2', IP3', and MAC address binding) that comply with the cloud platform plan, and are respectively "connected in parallel" to two network ports (e.g., RJ45 network ports, IP2, IP3) of the aggregation switch outside the cloud. Through VLAN configuration, two independent VLAN1 routes (IP1-IP2-IP2') and VLAN2 routes (IP4-IP3-IP3') are formed.

[0051] exist Figure 2 In the illustrated embodiment, the second encryption device is deployed on the energy subsystem side as a vertical decryption / encryption device. Its upstream and downstream network ports (for example, RJ45 network ports) are set with IP addresses (IP4', IP5') that comply with the cloud platform plan and are bound to MAC addresses. They are "stringed" between the energy subsystem data and the business network, respectively, to vertically decrypt / encrypt the data passing through.

[0052] According to some embodiments, the first encryption device and the second encryption device are encryption devices with different bandwidths or the same bandwidth. For example, the first encryption device is a gigabit encryption device, and the second encryption device is a 100 megabit encryption device. The bandwidth of the encryption device only needs to meet the communication rate requirement, and this application does not impose any limitation on this.

[0053] exist Figure 2 In the illustrated embodiment, the number of energy subsystems may be one or more.

[0054] Among them, the first security policy and the second security policy formulated are existing security policies in the prior art, for example, they may include operations such as encryption, decryption and data tunnel configuration, and the first security policy and the second security policy are corresponding security policies. For example, for the energy management platform data sent by the energy management platform virtual server, the first security policy adopts encryption operation, and the second security policy adopts decryption operation; for the energy management platform data generated and sent by the energy subsystem, the second security policy adopts encryption operation, and the first security policy adopts decryption operation. Both the first encryption device and the second encryption device can use existing encryption and decryption algorithms and methods to execute security policies, and can also use unique encryption and decryption algorithms and methods to execute security policies according to special requirements of the energy management platform.

[0055] exist Figure 2 In the illustrated embodiment, the interface device is a corresponding device used for data interaction between the energy management platform and the energy subsystem.

[0056] According to some embodiments, the focus of this application is to explain the encryption and decryption network routing and policy construction on the cloud platform side and the corresponding energy subsystem side. In order not to blur the focus, the corresponding construction of the cloud platform (such as a private cloud), the core routing within the cloud, the aggregation switch outside the cloud, and the business network will not be repeated.

[0057] 1. Construction of encryption / decryption network routing on the cloud platform side

[0058] According to some embodiments, the cloud-outside aggregation switch can be a three-layer switch, which is a bridge connecting the cloud-inside core routing and the business network, and the network routing is a conventional network architecture for data interaction between the cloud platform and the business network. In order to perform corresponding encryption and decryption operations on the cloud platform's sent and received data, the first encryption device is "parallel-connected" to the cloud-outside aggregation switch without changing the cloud platform's network architecture.

[0059] like Figure 2 As shown, the corresponding network ports (for example, RJ45 network ports) of the off-cloud aggregation switch and the first encryption device are set with IP addresses that comply with the cloud platform plan (for example, IP1, IP2, IP3, IP4, IP2', IP3'), and the corresponding MAC addresses are bound. The off-cloud aggregation switch performs VLAN division and forms two independent VLAN1 routes (IP1-IP2-IP2') and VLAN2 routes (IP4-IP3-IP3') together with the network port of the connected first encryption device. In the data flow direction, the conventional IP1-IP4 route through the off-cloud aggregation switch is forcibly directed to the VLAN1 route (IP1-IP2-IP2') and VLAN2 (IP4-IP3-IP3') route, so that the data flow passes through the first encryption device "serially", providing basic conditions for data encryption and decryption operations.

[0060] 2. Construction of encryption / decryption network routing on the energy subsystem side

[0061] like Figure 2 As shown, the interface device on the energy subsystem side is a device for data exchange between the energy subsystem and the outside of the system. On the network route connecting the interface device and the business network, a second encryption device is "serialized", and a planned IP address (IP4', IP5', IP5) is set for the corresponding network port (for example, RJ45 network port), and MAC address binding is performed. In this way, the data flow between the energy subsystem and the virtual server of the energy management platform must pass through the second encryption device, providing basic conditions for data decryption and encryption operations.

[0062] 3. Vertical encryption and decryption operation strategy

[0063] like Figure 2 As shown, through VLAN division and data pointing, cloud core routing, cloud routing, cloud aggregation switch, VLAN1 routing, first encryption device, VLAN2 routing, cloud aggregation switch, network routing, business network, second encryption device, data interaction routing from the energy management platform virtual server of the interface device to the energy subsystem is constructed. Figure 2 The middle refers to the route between the core route in the cloud and the aggregation switch outside the cloud, and the network route refers to the route between the aggregation switch outside the cloud and the business network. One first encryption device and N (N>=1) second encryption devices can build N data interaction routes. On the basis of the above N data interaction network routes, the network routes also need to be configured with vertical security policies, including data tunnel configuration and security policy configuration. The N network routes are respectively implemented with their own vertical tunnel policies, and the data packets passing through the tunnel are bidirectionally encrypted and decrypted with source address / destination address, port, and protocol comprehensive access control, so that the management platform control and its policies can be accurately sent to the energy subsystem, providing guidance for the planning and implementation of the comprehensive energy management platform.

[0064] According to a data interaction system based on a cloud platform provided by the present application, on the basis of keeping the network architecture of the cloud platform unchanged, by "parallel hanging" the first encryption device on the cloud-outside aggregation switch, and connecting the second encryption device in series on the energy subsystem side, vertical security policies are configured in the first encryption device and the second encryption device, and VLAN is configured through the cloud-outside aggregation switch, so that the data entering and leaving the cloud-outside aggregation switch will be directed to pass through the security policy processing of the first encryption device, so that the first encryption device and the second encryption device form a vertical encryption channel. In this way, through VLAN division, data flow orientation, vertical security policy formulation and other operations, a one-to-many vertical encryption routing channel between the virtual server of the energy management platform and the energy subsystem interface device is realized, which solves the problem of vertical encryption of the one-to-many data transmission channel between the energy management platform and the energy subsystem deployed on the cloud platform, so that the control of the energy management platform and its policies are accurately sent to the energy subsystem, providing guidance for the planning and implementation of the comprehensive energy management platform.

[0065] The embodiments of the present application are described in detail above. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and its core idea of ​​the present application. At the same time, changes or deformations made by those skilled in the art based on the ideas of the present application, the specific implementation methods and the scope of application of the present application, all belong to the scope of protection of the present application. In summary, the content of this specification should not be construed as a limitation on the present application.

Claims

1. A data interaction system based on a cloud platform, characterized in that: include: Servers, deployed on the cloud platform, are used to provide computing resources for processing data on the energy management platform; The cloud core router is connected to the server in the cloud platform and is used to provide the server with a route for data interaction with the energy management platform; An off-cloud aggregation switch, connected to the on-cloud core router outside the cloud platform, for providing the server with a route for data interaction with the energy management platform; A gigabit encryption device is connected in parallel with the off-cloud aggregation switch, the off-cloud aggregation switch directs the energy management platform data to the gigabit encryption device, and the gigabit encryption device is used to perform a first security policy processing on the energy management platform data; A 100M encryption device, connected in series between the business network and the interface device of the energy management platform on the energy subsystem side, is used to execute the second security policy processing on the energy management platform data and send the energy management platform data processed by the second security policy; An interface device, arranged at the energy subsystem side, is used to complete data interaction with the energy subsystem, and forward the data sent by the energy subsystem to the 100M encryption device or forward the data sent by the energy management platform to the energy subsystem; Among them, the off-cloud aggregation switch is used for VLAN configuration, and the two network ports of the off-cloud aggregation switch and the two Ethernet ports of the gigabit encryption device form two independent VLAN channels, so that the relevant data is sequentially passed through the off-cloud aggregation switch, a VLAN channel, the gigabit encryption device and its first security policy encryption / decryption processing, and another VLAN, and then output again from another network port of the off-cloud aggregation switch.

2. The system according to claim 1, characterized in that The cloud core router is used to route the data sent from the energy management platform of the server to the cloud aggregation switch; The off-cloud aggregation switch is used to direct the data sent by the energy management platform to the gigabit encryption device; The Gigabit encryption device is used to perform a first security policy encryption process on the data sent by the energy management platform, and forward the data sent by the energy management platform after the first security policy encryption process to the 100M encryption device via the business network; The 100M encryption device is used to perform a second security policy decryption process on the data sent by the energy management platform, and send the data sent by the energy management platform after the second security policy decryption process to the interface device; The interface device is used to forward the data sent by the energy management platform to the energy subsystem.

3. The system according to claim 1, characterized in that The interface device is used to forward the data sent by the energy subsystem to the 100M encryption device; The 100M encryption device is used to perform a second security policy encryption process on the data sent by the energy subsystem, and forward the data sent by the energy subsystem after the second security policy encryption process to the cloud-external aggregation switch via the service network; The off-cloud aggregation switch is used to direct the data sent by the energy subsystem after encryption processing by the second security policy to the gigabit encryption device; The gigabit encryption device is used to perform a first security policy decryption process on the energy subsystem sent data after the second security policy encryption process, and route the energy subsystem sent data after the first security policy decryption process to the cloud core router via the cloud-external aggregation switch; The core routing within the cloud is used to route the data sent by the energy subsystem to the server.

4. The system according to any one of claims 1 to 3, characterized in that: The first security policy and the second security policy include encryption, decryption and data tunnel configuration.

5. The system according to any one of claims 1 to 3, characterized in that: The data sent down by the energy management platform includes control instructions and strategy data for the energy subsystem.

6. The system according to any one of claims 1 to 3, characterized in that: The data sent by the energy subsystem includes monitoring data of the energy subsystem on objects in the power and industrial control industries.

7. The system according to any one of claims 1 to 3, characterized in that: The energy subsystem includes one or more energy subsystems.

8. The system according to any one of claims 1 to 3, characterized in that: The server includes an energy management platform virtual server.

Images