Wide area network data bypass encrypted transmission method, device, and medium

Abstract

The present invention relates to a wide area network data bypass encrypted transmission method, a device, and a medium. The method comprises the following steps: deploying in parallel encryption gateways at bypasses of communication endpoints; in a normal transmission process, establishing an interconnection encryption tunnel between the encryption gateways, and preferentially selecting the encryption tunnel of the encryption gateways to perform encrypted communication between the communication endpoints; when an encryption gateway on a certain side fails or a link fails, communication endpoints communicating with the failed encryption gateway being switched to plaintext transmission on the basis of an automatic bypass mechanism, and preferentially selecting a corresponding router to perform end-to-end data non-encrypted communication; and still preferentially selecting the encryption tunnel of the encryption gateways to perform encrypted communication between other communication endpoints which do not directly communicate with the failed encryption gateway. Compared with the prior art, the present invention has the advantages that an application range is wide, use is convenient, automatic switching / recovering of encrypted / non-encrypted links can be implemented, and the like.

Description

Wide area network data bypass encryption transmission method, device and medium Technical Field

[0001] The present invention relates to the field of data transmission in rail transit signal service systems, and in particular to a wide area network data bypass encryption transmission method, device and medium. Background Art

[0002] Figure 1 shows a common business scenario for the rail transit industry's information system, where business terminals at different sites are interconnected with central-side servers / terminals via switches / routers. In scenarios where no encryption gateway is set up, data transmission between site terminals and central servers is in plain text, without encryption measures. Business system servers and terminals are identified by IP addresses and port numbers, without identity authentication. Transmission platforms generally do not have transmission encryption services, and the security risks faced by data transmission processes in important business systems are becoming increasingly prominent. The basic requirements for graded protection and the Cryptography Law clearly require that the integrity and confidentiality of data be ensured during transmission. How to effectively protect the network data transmission security of the rail transit industry's signal system, prevent data leakage, interception, and tampering from having a significant impact on the system, and strengthen the protection of signal system data has become an urgent issue to be addressed.

[0003] To address information system transmission security, data transmission encryption can be implemented at the physical, data link, network, transport, and application layers. The physical layer can utilize non-common-band optical modules, preventing data acquisition via common optical instruments. The data link layer can utilize fixed-key encryption on both sides or encryption via the transmission platform board, ensuring encrypted communication at both ends. Data transmission encryption can be implemented at the network and transport layers using VPN technology, while the application layer can implement data transmission encryption by invoking encryption middleware or encryption boards.

[0004] Each of the above solutions has its own unique characteristics, which are briefly described below. Using non-common-band optical modules at the physical layer significantly increases costs and violates the concept of universal device replacement. This requires the complete modification of the underlying communication links on both sides of the data communication, resulting in high costs. Data link layer encryption using fixed keys via data communication equipment or transmission cards meets certain security requirements, but does not meet the requirements for confidentiality assessments. Using VPN technology at the network / transport layer requires devices to be deployed in series within the business system. This in-line deployment within the network increases network communication risks and can cause business systems to malfunction in the event of a device or link failure. Data transmission encryption can be implemented at the application layer using encryption middleware or encryption cards. However, failure of the encryption middleware or encryption card requires renegotiation of encryption between both ends. This involves significant modifications to business system programs, communication negotiation latency, communication keys, and identity authentication, requiring significant programmer expertise. In summary, none of the above solutions, while implementing data transmission encryption at different layers, effectively address scenarios where encryption equipment or links fail.

[0005] CN114465848A discloses a ciphertext-based data transmission method and system. The method comprises: a terminal determines whether to conduct ciphertext communication between the terminal and the server based on relevant information from a VPN client and a VPN gateway; and ciphertext communication is conducted between the terminal and the server via the VPN client and VPN gateway. This method can simultaneously meet the reliability and data transmission security requirements of railway industry information systems, enabling multiple terminals in different locations and VLANs in the network to achieve encrypted communication with the server, making it suitable for common business scenarios in railway information systems. Although this method includes an identity authentication mechanism on the VPN terminal side, it requires manual disconnection of the VPN client software before normal plaintext communication can be achieved. Furthermore, if ciphertext communication needs to be re-enabled, the terminal side must manually click the connect button to enable ciphertext communication, preventing automatic switching.

[0006] Summary of the Invention

[0007] The purpose of the present invention is to overcome the defects of the above-mentioned existing technologies and provide a wide area network data bypass encryption transmission method, equipment and medium. Without affecting the original business system, the business system bypass encryption transmission mechanism is realized by hanging an encryption gateway beside the business system, effectively enhancing the data transmission encryption security, and automatically selecting whether to use the encryption mechanism for data transmission when the equipment or link at each site fails, without affecting the data transmission of the original business system, thereby improving the confidentiality, integrity and security of the data during the transmission process without affecting the availability of the business system.

[0008] The purpose of the present invention can be achieved by the following technical solutions:

[0009] According to a first aspect of the present invention, a method for bypassing and encrypting wide area network data transmission applicable to a rail transit signal service system is provided, the method comprising the following steps:

[0010] S1. Deploy encryption gateways in parallel and bypass communication endpoints;

[0011] S2. During normal transmission, an interconnected encrypted tunnel is established between the encryption gateways, and each communication endpoint gives priority to using the encryption tunnel of the encryption gateway for encrypted communication;

[0012] S3. When an encryption gateway or link on one side fails, the communication endpoints communicating with the failed encryption gateway switch to plain text transmission based on the automatic bypass mechanism, and give priority to the corresponding router for end-to-end non-encrypted data communication; other communication endpoints that do not communicate with the failed encryption gateway still give priority to encrypted communication through the encryption gateway's encrypted tunnel.

[0013] As an optimal technical solution, the wide area network data bypass encryption transmission method is suitable for data communication encryption in Hub-Spoke / Full-Mesh model scenarios.

[0014] As a preferred technical solution, the step S2 includes the following steps:

[0015] S21. Establishment of the first-stage encrypted tunnel: The encryption gateways at both communication endpoints perform identity authentication, generate the first-stage encryption key, and establish a secure channel for the second-stage encrypted data transmission.

[0016] S22. Two-stage encrypted data transmission: The communication endpoints at both ends exchange encryption suites and key materials through a secure channel to generate two-stage encryption keys, form an encrypted tunnel, and achieve encrypted communication at both ends.

[0017] As an optimal technical solution, the step S21 is specifically as follows: the encryption gateways of the communication endpoints at both ends perform identity authentication by negotiating the encryption algorithm, authentication algorithm, encapsulation mode, DH group identifier, and exchanging digital certificates. After exchanging key materials using the DH algorithm, both parties each generate a first-stage encryption key and establish a secure channel based on the first-stage encryption key.

[0018] As an optimal technical solution, the step S22 is specifically as follows: the encryption gateways of the communication endpoints at both ends exchange IPSec security parameters and key materials through the secure channel established in the first stage, and both parties each generate a second-stage IPSec encryption key based on the national secret SM4 to form a dynamic multi-point encryption tunnel model to achieve encrypted communication at both ends.

[0019] As a preferred technical solution, the first-stage encryption key and the second-stage encryption key are automatically generated periodically.

[0020] As a preferred technical solution, the communication endpoints include a Hub site and multiple Spoke sites. There is a data communication demand between the Hub site and the Spoke sites, and there is a data communication demand between the Spoke sites.

[0021] As a preferred technical solution, in step S3, in the scenario of a Hub-side encryption gateway failure or link failure, the data traffic between the Hub-Spoke site and the Spoke-Spoke site is switched to plaintext transmission based on an automatic bypass mechanism, and the corresponding router is selected for end-to-end data non-encrypted communication, thereby realizing data communication between the hosts at both ends.

[0022] As a preferred technical solution, in step S3, in the scenario of a Spoke-side encryption gateway failure or link failure, the Hub-Spoke site and Spoke-Spoke site that directly communicate with the failed Spoke site switch to plaintext transmission based on an automatic bypass mechanism and select the corresponding router for end-to-end non-encrypted data communication; the Hub-Spoke site and Spoke-Spoke site that do not directly communicate with the failed encryption gateway give priority to encrypted communication through the encryption tunnel of the encryption gateway.

[0023] As a preferred technical solution, in step S3, when the failed encryption gateway or link is restored, the interconnected encryption tunnel between the communication encryption gateways is automatically restored, and the communication endpoints at both ends resume using the encryption tunnel for data encryption communication.

[0024] This technical solution implements a business system bypass encryption transmission mechanism by hanging an encryption gateway next to the business system without affecting the original business system. Digital certificates are used to achieve identity authentication, reducing possible identity authentication issues between the communicating parties. The encryption key uses a national secret algorithm to enhance confidentiality during data transmission. The automatic key negotiation and update mechanism solves the key timeliness problem, effectively enhancing the encryption security of data transmission and preventing data leakage and tampering during transmission. When equipment or links at each site fail, the system can automatically select whether to use an encryption mechanism for data transmission without affecting the data transmission of the original business system. This improves the confidentiality, integrity, and security of data during transmission without affecting the availability of the business system.

[0025] According to a second aspect of the present invention, an electronic device is provided, comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the method when executing the program.

[0026] According to a third aspect of the present invention, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method described above is implemented.

[0027] Compared with the prior art, the present invention has the following beneficial effects:

[0028] (1) High flexibility. By attaching an encryption gateway to the business system, bypass encrypted transmission is achieved. This is applicable to encrypted transmission in private networks and can adapt to scenarios where encrypted and unencrypted transmission coexist.

[0029] (2) Good robustness. When the encryption gateway or link of each site fails, it can automatically choose whether to use the encryption mechanism for data transmission without affecting the data transmission of the original business system. This not only improves the confidentiality, integrity and security of data during transmission, but also does not affect the availability of the business system. When the encryption gateway fails or the link fails, it can automatically recover from the non-encrypted communication state to the encrypted communication state without human intervention.

[0030] (3) Excellent security: digital certificates are used for identity authentication between encryption gateways. The encryption gateway uses SM3 for data hashing in the first phase of negotiation, and the second phase key uses SM4 symmetric key, which improves the reliability of the encryption tunnel;

[0031] (4) Good timeliness. The dynamic key update mechanism based on the national secret solves the key timeliness problem, increases the difficulty of malicious decryption by the outside world, and effectively strengthens the security of data transmission encryption;

[0032] (5) Strong compatibility: if an existing system needs to implement encryption during transmission, this method can be used to set up encryption gateways at each station and smoothly evolve to the final target solution. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 is a schematic diagram of common business scenarios in rail transit industry information systems;

[0034] FIG2 is a flow chart of the method of the present invention;

[0035] FIG3 is a schematic diagram of a business scenario targeted by the wide area network data bypass encryption transmission method of the present invention;

[0036] FIG4 is a schematic diagram of a process for establishing an encrypted tunnel according to the present invention;

[0037] Figure 5 is a schematic diagram of a Hub-side encryption gateway failure or link failure scenario;

[0038] Figure 6 shows a scenario in which the Spoke-side encryption gateway fails or the link fails. DETAILED DESCRIPTION

[0039] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0040] This embodiment provides a wide area network data bypass encryption transmission method applicable to rail transit signal service systems. It encrypts end-to-end data by setting up a bypass encryption gateway. It can be used for the Hub-Spoke / Full-Mesh model scenario of the signal service system. Regardless of whether the Hub / Spoke end device or the encryption gateway link fails, it can automatically switch to a non-encrypted link for communication. This method does not require modifications to the physical layer, data link layer, or application layer. Without affecting the original service system, it implements the service system bypass encryption transmission function by hanging an encryption gateway on the service system. As shown in Figure 2, the method includes the following steps:

[0041] S1. Deploy an encryption gateway in parallel with the communication endpoint.

[0042] As shown in Figure 3, the communication endpoints in a business system include a hub and multiple spokes. Data communication is required between the hub and spokes, and between spokes. Encryption gateways are deployed off-site at the communication endpoints, connected in parallel with the business system rather than directly in series. Encryption gateways import digital certificates for bidirectional authentication between them. Encryption gateways establish communication tunnels, negotiate encryption suites, and exchange key material to generate encryption keys for encrypted business data communication. Encryption keys are automatically rotated periodically.

[0043] S2. During normal transmission, an interconnected encrypted tunnel is established between the encryption gateways, and each communication endpoint gives priority to using the encryption tunnel of the encryption gateway for encrypted communication.

[0044] That is, under normal circumstances, an encryption gateway on one side encrypts data traffic according to security policies and sends it through an encrypted tunnel to the encryption gateway on the other side. The encryption gateway on the other side decrypts the data and sends it to the original destination service host (PC terminal). The service host and the service host are unaware of the encryption process, and the data sent and received by both service hosts is plaintext.

[0045] In one embodiment, if a business system contains both sites with and without encryption gateways, sites with encryption gateways can communicate in plain text with sites without encryption gateways, while communicating encrypted with sites with encryption gateways. Encryption gateway installation and commissioning can be gradually implemented within existing systems without impacting the normal operation of existing business systems.

[0046] In a preferred embodiment, step S2 includes the following steps:

[0047] S21. Establishment of a one-stage encrypted tunnel: The encryption gateways of the communication endpoints at both ends perform identity authentication by negotiating the encryption algorithm, authentication algorithm, encapsulation mode, DH group identifier, and exchanging digital certificates. After exchanging key materials using the DH algorithm, data is hashed based on the national encryption SM3. Both parties generate a one-stage encryption key and establish a secure channel based on the one-stage encryption key.

[0048] S22. Two-stage encrypted data transmission: The encryption gateways at both communication endpoints exchange IPSec security parameters and key materials through the secure channel established in the first stage. Both parties generate two-stage IPSec encryption keys based on the national encryption SM4, forming a dynamic multi-point encrypted tunnel model to achieve encrypted communication at both ends.

[0049] Both the first-stage encryption key and the second-stage encryption key can be automatically generated periodically, overcoming the key timeliness problem.

[0050] As shown in Figure 4, the encrypted tunnel construction process is as follows:

[0051] 1) The underlying routing interconnection of the Hub / Spoke model is completed, and the network terminals / servers at each site can access each other.

[0052] 2) After configuring the encryption gateway at each Hub / Spoke site, import the CA certificate and the certificate issued by the CA into the encryption gateway.

[0053] 3) The encryption gateway at each site forms a multi-point tunnel link with the help of the underlying routing, and the encryption gateway can obtain the routing entries of each site.

[0054] 4) Based on the dynamic multi-point VPN, the encryption gateways on both the Hub and Spoke nodes first authenticate using digital certificates through the IKE protocol. After negotiating the encryption algorithm, authentication algorithm, encapsulation mode, and DH group identifier, they exchange key material using the DH algorithm. Each node then generates a first-stage encryption key, which establishes a secure transmission channel for the second stage. If the first-stage encryption key negotiation is successful, the node proceeds to the next step. Otherwise, this step repeats until negotiation is complete.

[0055] 5) The encryption gateways on both the Hub and Spoke sides exchange IPSec security parameters and key material over the secure transmission channel established in Phase 1 of IKE. Each side then generates a Phase 2 IPSec encryption key. If Phase 2 encryption key negotiation is successful, the next step is performed. Otherwise, this step is repeated until negotiation is complete.

[0056] 6) The Hub / Spoke site encryption gateway forms a dynamic multi-point encryption tunnel model.

[0057] S3. When an encryption gateway or link on one side fails, the communication endpoints communicating with the failed encryption gateway switch to plain text transmission based on the automatic bypass mechanism, and give priority to the corresponding router for end-to-end non-encrypted data communication; other communication endpoints that do not communicate with the failed encryption gateway still give priority to encrypted communication through the encryption gateway's encrypted tunnel.

[0058] Case 1: Hub-side encryption gateway failure or link failure

[0059] As shown in Figure 5, in the scenario where the hub-side encryption gateway or link fails, data traffic between the hub-spoke site and the spoke-spoke site switches to plaintext transmission based on an automatic bypass mechanism. The corresponding router is selected for end-to-end unencrypted data communication, enabling data communication between the hosts at both ends.

[0060] Specifically, if the Hub-side encryption gateway fails, as shown in Figure 5 (1), the core switch cannot learn the underlying site routes from the encryption gateway. The Hub-side switch then implements unencrypted data communication between the Hub and Spokes through the Hub-side router. Upon receiving the data, the Spoke site routers forward it directly to the end device based on the destination address, automatically switching to unencrypted communication. If the Spoke-side encryption gateway lacks a destination route, the encryption gateway forwards the data packet in plaintext to the router, which then forwards it unencrypted. Upon receiving the data, the Hub-side router forwards it to the switch based on the destination address, which then forwards it to the server or end device.

[0061] When the encryption gateway link on the Hub fails:

[0062] As shown in Figure 5, when all interconnection links between the encryption gateway on the hub and the router fail, the encryption gateway cannot obtain the peer routing entry through the tunnel. At this time, the switch chooses to forward data from the router, realizing end-to-end unencrypted data communication between the hub and the spokes. The encryption gateway on the spokes cannot obtain the peer routing entry and also switches to the unencrypted state.

[0063] As shown in Figure 5, when all interconnection links between the encryption gateway on the hub and the switch fail, the switch cannot obtain the routing entries learned by the encryption gateway. The switch will choose to use the hub-spoke router for end-to-end data communication without encryption. The encryption gateway on the spoke side cannot obtain the route of the other end and also switches to the non-encrypted state.

[0064] Case 2: Spoke-side encryption gateway failure or link failure

[0065] As shown in Figure 6, in the event of a Spoke-side encryption gateway or link failure, Hub-Spokes (Hub-Local Spoke) and Spoke-Spokes (Local Spoke-Any Spoke) that communicate directly with the failed Spoke switch to plaintext transmission based on an automatic bypass mechanism, selecting the appropriate router for end-to-end unencrypted data communication. The failure of the local Spoke's encryption gateway does not affect encrypted communication between the Hub and non-local Spokes or between non-local Spokes and non-local Spokes. That is, Hub-Spokes (Hub-Non-Local Spokes) and Spoke-Spokes (Non-Local Spokes-Non-Local Spokes) that do not directly communicate with the failed encryption gateway still prefer encrypted communication through the encryption gateway's encrypted tunnel.

[0066] When the hub-side encryption gateway is functioning normally and the spoke-side encryption gateway fails, as shown in Figure 6 (1), the end device preferentially chooses the router gateway to implement hub-spoke / spoke-spoke end-to-end unencrypted data communication. When the hub-side router receives data, it forwards it to the switch based on the destination address, which then forwards it to the server or end device. When the spoke-site router receives data, it forwards it directly to the end device based on the destination address, automatically switching to unencrypted communication.

[0067] When the encryption gateway on the Hub is working properly and the link to the encryption gateway on the Spoke side fails:

[0068] As shown in Figure 6, if the uplink link between the Spoke-side encryption gateway and the switch fails, the terminal device will automatically select the router gateway for unencrypted communication with the outside world. When the Hub-side router receives data, it forwards it to the switch based on the destination address. The switch then forwards it to the server or terminal device, switching to unencrypted communication.

[0069] As shown in Figure 6, if the downlink link between the Spoke-side encryption gateway and the switch fails, the terminal device automatically selects the router gateway for unencrypted communication with the outside world. When the Hub-side router receives data, it forwards it to the switch based on the destination address. The switch then forwards it to the server or terminal device, switching to unencrypted communication.

[0070] When the failed encryption gateway or link is restored, the encrypted tunnel between the communication encryption gateways automatically recovers without human intervention, and the endpoints resume using the encrypted tunnel for encrypted data communication. In other words, when the encryption gateway device and link failure on the hub recover, the hub-Spoke and spoke-Spoke encrypted communication links automatically recover without human intervention. When the encryption gateway device and link failure on the spoke recover, the hub-to-Spoke and the spoke-to-other-Spoke encrypted communication links automatically recover without human intervention.

[0071] The electronic device of the present invention includes a central processing unit (CPU), which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) or loaded from a storage unit into a random access memory (RAM). In the RAM, various programs and data required for device operation can also be stored. The CPU, ROM, and RAM are connected to each other via a bus. An input / output (I / O) interface is also connected to the bus.

[0072] Many components in a device are connected to the I / O interface, including: input units, output units, such as various types of displays and speakers; storage units, such as magnetic disks and optical disks; and communication units, such as network cards, modems, wireless communication transceivers, etc. The communication unit allows the device to exchange information / data with other devices via computer networks such as the Internet and / or various telecommunication networks.

[0073] The processing unit performs the various methods and processes described above, such as methods S1 to S3. For example, in some embodiments, methods S1 to S3 may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit. In some embodiments, part or all of the computer program may be loaded and / or installed on the device via a ROM and / or a communication unit. When the computer program is loaded into the RAM and executed by the CPU, one or more steps of methods S1 to S3 described above may be performed. Alternatively, in other embodiments, the CPU may be configured to execute methods S1 to S3 by any other appropriate means (e.g., by means of firmware).

[0074] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0075] The program code for implementing the method of the present invention can be written in any combination of one or more programming languages. Such program code can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0076] In the context of the present invention, machine-readable medium can be a tangible medium that can contain or store a program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0077] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and such modifications or substitutions are intended to be within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A wide area network data bypass encryption transmission method applicable to a rail transit signal service system, characterized in that: The method comprises the following steps: S1. Deploy encryption gateways in parallel with communication endpoints; S2. During normal transmission, an interconnected encrypted tunnel is established between encryption gateways, and each communication endpoint gives priority to using the encryption tunnel of the encryption gateway for encrypted communication; S3. When an encryption gateway or link on one side fails, the communication endpoints communicating with the failed encryption gateway switch to plain text transmission based on an automatic bypass mechanism, and give priority to the corresponding router for end-to-end non-encrypted data communication; other communication endpoints that do not communicate with the failed encryption gateway still give priority to encrypted communication through the encryption gateway's encrypted tunnel.

2. According to claim 1, a wide area network data bypass encryption transmission method applicable to a rail transit signal service system is characterized in that: The wide area network data bypass encryption transmission method is suitable for data communication encryption in Hub-Spoke / Full-Mesh model scenarios.

3. According to claim 1, a wide area network data bypass encryption transmission method applicable to a rail transit signal service system is characterized in that: The step S2 comprises the following steps: S21, establishment of the first-stage encrypted tunnel: the encryption gateways at both communication endpoints perform identity authentication, generate the first-stage encryption key, and establish a secure channel for the second-stage encrypted data transmission; S22, two-stage encrypted data transmission: The communication endpoints at both ends interact with each other through a secure channel, exchange key materials, generate two-stage symmetric encryption keys, and implement encrypted communication at both ends through an encrypted tunnel.

4. A wide area network data bypass encryption transmission method applicable to a rail transit signal service system according to claim 3, characterized in that: The step S21 is specifically as follows: the encryption gateways of the communication endpoints at both ends perform identity authentication by negotiating the encryption algorithm, authentication algorithm, encapsulation mode, DH group identifier, and exchanging digital certificates. After exchanging key materials using the DH algorithm, both parties each generate a first-stage encryption key and establish a secure channel based on the first-stage encryption key.

5. According to claim 3, a wide area network data bypass encryption transmission method applicable to a rail transit signal service system is characterized in that: The step S22 is specifically as follows: the encryption gateways of the communication endpoints at both ends exchange IPSec security parameters and key materials through the secure channel established in the first stage, and both parties each generate a second-stage IPSec encryption key based on the national encryption SM4 to form a dynamic multi-point encryption tunnel model to achieve encrypted communication at both ends.

6. A wide area network data bypass encryption transmission method applicable to a rail transit signal service system according to claim 3, characterized in that: The first-stage encryption key and the second-stage encryption key are automatically generated periodically.

7. A wide area network data bypass encryption transmission method applicable to a rail transit signal service system according to claim 1, characterized in that: The communication endpoints include a Hub site and multiple Spoke sites. There is a data communication demand between the Hub site and the Spoke sites, and there is a data communication demand between the Spoke sites.

8. A wide area network data bypass encryption transmission method applicable to a rail transit signal service system according to claim 7, characterized in that: In the step S3, in the scenario of a Hub-side encryption gateway failure or a link failure, the data traffic between the Hub-Spoke site and the Spoke-Spoke site is switched to plain text transmission based on an automatic bypass mechanism, and the corresponding router is selected for end-to-end data non-encrypted communication to achieve data communication between the hosts at both ends.

9. A wide area network data bypass encryption transmission method applicable to a rail transit signal service system according to claim 7, characterized in that: In the step S3, in the scenario of encryption gateway failure or link failure on the Spoke side, the Hub-Spoke site and Spoke-Spoke site that directly communicate with the failed Spoke site switch to plain text transmission based on the automatic bypass mechanism, and select the corresponding router for end-to-end data non-encrypted communication; the Hub-Spoke site and Spoke-Spoke site that do not directly communicate with the failed encryption gateway give priority to encrypted communication from the encryption tunnel of the encryption gateway.

10. The method for bypass encryption transmission of wide area network data applicable to rail transit signal service system according to claim 1, characterized in that: In the step S3, when the failed encryption gateway or link is restored, the interconnected encryption tunnel between the communication encryption gateways is automatically restored, and the communication endpoints at both ends resume using the encryption tunnel for data encryption communication.

11. An electronic device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: When the processor executes the program, the method according to any one of claims 1 to 10 is implemented.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images