Method and apparatus for forwarding data across network segments, storage medium, and electronic device

Abstract

The present invention provides a method and apparatus for forwarding data across network segments, a storage medium, and an electronic device, applied to the technical field of industrial control. The method is applied to a forwarding service node. The forwarding service node multicasts a first data packet containing a service identifier to a first network segment; upon reception of the data packet, an application service registered in the first network segment sends a second data packet containing an application identifier and an IP address and a port number of a device end in a second network segment; after authentication succeeds, a binding relationship between the application identifier and the port number is established; then a dedicated UDP channel is established, and the second data packet is forwarded to a specified address and port through the channel; a device performs processing and then replies with a protocol message; and the forwarding service node forwards the message to the application service on the basis of the binding relationship. Therefore, data communication across network segments can be implemented, thereby simplifying a communication process, and improving data transmission efficiency across network segments.

Description

A method, apparatus, storage medium, and electronic device for cross-network segment data forwarding

[0001] This application claims priority to Chinese Patent Application No. 202411409643.1, filed on October 10, 2024, entitled "A method, apparatus, storage medium and electronic device for cross-network segment data forwarding", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This invention relates to the field of industrial control technology, and in particular to a cross-network segment data forwarding method, apparatus, storage medium, and electronic device. Background Technology

[0003] In modern industrial control systems, to achieve efficient management and ensure system security, networks are typically divided into multiple segments and isolated using VLAN (Virtual Local Area Network) technology. Specifically, configuration software and instrument management software usually run on segment A, while intelligent APL instruments, communication cards, and conventional I / O cards run on segment B. While this network segmentation method improves system security, it also introduces challenges related to cross-segment communication.

[0004] For example, the instrument management software running on network segment A needs to manage the I / O devices on network segment B, while the configuration software running on network segment A needs to download configuration settings to the I / O devices on network segment B. However, due to network isolation, network segment A and network segment B cannot communicate directly, leading to difficulties in management and configuration operations.

[0005] Therefore, how to solve the data communication problem between different network segments within a control system and achieve efficient data transmission across network segments has become a key issue that urgently needs to be addressed by those skilled in the art. Summary of the Invention

[0006] In view of the above problems, the present invention provides a cross-network segment data forwarding method, apparatus, storage medium, and electronic device to overcome or at least partially solve the above problems. The technical solution is as follows:

[0007] A cross-network segment data forwarding method, applied to a forwarding service node, the method comprising:

[0008] A first data packet containing the service identifier of the forwarding service node is multicast to the first network segment, so that each application service registered in the first network segment can obtain the first data packet and send a second data packet to the forwarding service node according to the service identifier. The second data packet includes the application identifier of the application service, the IP address and port number of the device in the second network segment.

[0009] Obtain the second data packet sent by the application service, and extract the application identifier of the application service, the IP address of the second network segment, and the port number;

[0010] Based on the application identifier, the authorization authentication center is used to perform authorization authentication. If the application identifier has the ability to access the device terminal corresponding to the port number in the IP address, a binding relationship between the application identifier and the port number is established.

[0011] A UDP channel is established between the application identifier and the port number. The second data packet is forwarded to the IP address and the port number through the UDP channel, so that the device corresponding to the port number processes the second data packet upon receiving it and replies with a first protocol message to the forwarding service node.

[0012] Based on the binding relationship, the first protocol message is forwarded to the application service.

[0013] Optionally, if the application identifier has the capability to access the device corresponding to the port number in the IP address, the method further includes:

[0014] Record successful authentication sessions between the application identifier, the IP address, and the port number in the permission log;

[0015] Obtain the third data packet sent by the application service, wherein the second data packet includes the application identifier of the application service, the IP address of the device in the second network segment, and the port number;

[0016] The permission record is checked to see if there is a successful permission authentication session between the application identifier, the IP address and the port number. If so, the third data packet is forwarded to the IP address and the port number through the UDP channel so that the device corresponding to the port number can process the third data packet upon receiving it and reply with a second protocol message to the forwarding service node.

[0017] Based on the binding relationship, the second protocol message is forwarded to the application service.

[0018] Optionally, the permission record uses a least recently used strategy caching algorithm to manage sessions. If the number of saved successful permission authentication sessions exceeds a preset session threshold, the earliest used successful permission authentication session is deleted, and the latest used successful permission authentication session is saved.

[0019] Optionally, obtaining the second data packet sent by the application service includes:

[0020] The second data packet sent by the application service is received via the soft bus of the first network segment.

[0021] Optionally, if the application identifier has the capability to access the device corresponding to the port number in the IP address, the method further includes:

[0022] Identify the data type of the second data packet;

[0023] Based on the data type, allocate bandwidth and priority to the second data packet;

[0024] The forwarding of the second data packet to the IP address and the port number via the UDP channel includes:

[0025] According to the bandwidth and the priority, the second data packet is transmitted to the IP address and the port number via the UDP channel.

[0026] Optionally, the device may include APL instruments, temperature sensors, pressure sensors, flow meters, electric valves, industrial Ethernet switches, and HMI touch screens.

[0027] Optionally, the UDP channel integrates an adaptive congestion control algorithm to dynamically adjust the data transmission rate.

[0028] A cross-network segment data forwarding device is applied to a forwarding service node. The device includes: a forwarding service data packet multicast unit, a first application service data packet acquisition unit, an application authorization authentication unit, a first application service data packet forwarding unit, and a first protocol message forwarding unit.

[0029] The forwarding service data packet multicast unit is used to multicast a first data packet containing the service identifier of the forwarding service node to the first network segment, so that each application service registered in the first network segment can obtain the first data packet and send a second data packet to the forwarding service node according to the service identifier. The second data packet includes the application identifier of the application service, the IP address and port number of the device in the second network segment.

[0030] The first application service data packet acquisition unit is used to acquire the second data packet sent by the application service and extract the application identifier of the application service, the IP address of the second network segment and the port number;

[0031] The application permission authentication unit is used to perform permission authentication with the permission authentication center based on the application identifier, and to establish a binding relationship between the application identifier and the port number when the application identifier has the ability to access the device terminal corresponding to the port number in the IP address.

[0032] The first application service data packet forwarding unit is used to establish a UDP channel between the application identifier and the port number, and forward the second data packet to the IP address and the port number through the UDP channel, so that the device corresponding to the port number can process the second data packet upon receiving it and reply with a first protocol message to the forwarding service node;

[0033] The first protocol message forwarding unit is used to forward the first protocol message to the application service according to the binding relationship.

[0034] A computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the cross-network segment data forwarding method described in any of the preceding claims.

[0035] An electronic device includes at least one processor, at least one memory connected to the processor, and a bus; wherein the processor and the memory communicate with each other via the bus; the processor is used to call program instructions in the memory to execute the cross-network segment data forwarding method described above.

[0036] By utilizing the above technical solution, the present invention provides a cross-network segment data forwarding method, apparatus, storage medium, and electronic device, applied to a forwarding service node. The method includes: multicasting a first data packet containing the service identifier of the forwarding service node to a first network segment, so that each application service registered in the first network segment can obtain the first data packet, and sending a second data packet to the forwarding service node according to the service identifier, wherein the second data packet includes the application identifier of the application service, the IP address and port number of the device in the second network segment; obtaining the second data packet sent by the application service, and extracting the application identifier of the application service, the IP address and port number of the second network segment; performing authorization authentication with an authorization authentication center based on the application identifier, and establishing a binding relationship between the application identifier and the port number if the application identifier has the ability to access the device corresponding to the port number in the IP address; establishing a UDP channel between the application identifier and the port number, and forwarding the second data packet to the IP address and port number through the UDP channel, so that the device corresponding to the port number can process the second data packet upon receiving it and reply with a first protocol message to the forwarding service node; and forwarding the first protocol message to the application service according to the binding relationship. This invention constructs a forwarding service node for cross-network segment communication between different network segments. It sends a service ID to the application service via multicast, so that the application service only needs to send data to the forwarding service and specify the device in the target network segment to achieve cross-network segment data communication and efficient data transmission.

[0037] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0038] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0039] Figure 1 shows a flowchart of one embodiment of the cross-network segment data forwarding method provided by the present invention;

[0040] Figure 2 shows a schematic diagram of the architecture of the data forwarding service provided in an embodiment of the present invention;

[0041] Figure 3 shows a timing diagram of the cross-network segment data forwarding method provided in an embodiment of the present invention;

[0042] Figure 4 shows a schematic diagram of a cross-network segment data forwarding device provided in an embodiment of the present invention;

[0043] Figure 5 shows a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0044] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0045] In the field of communications, various solutions have been proposed to address the challenges of cross-network segment communication. However, these solutions have limitations when applied to industrial control systems. For example, while the RTP protocol offers good real-time performance, it is unsuitable for industrial control; UDP port mapping methods cannot achieve packet response; and multicast-based unidirectional transmission structures do not meet the requirements for bidirectional communication. Therefore, a new technical solution is urgently needed that can enable bidirectional data transmission across network segments in industrial control systems while ensuring network security, thereby improving system management efficiency and ease of operation.

[0046] Based on this, this embodiment of the invention provides a cross-network segment data forwarding method applied to a forwarding service node. The method includes: multicasting a first data packet containing the service identifier of the forwarding service node to a first network segment, allowing registered application services in that network segment to obtain the first data packet. After obtaining the first data packet, the application service sends a second data packet containing the application identifier, a second network segment IP address, and a port number to the forwarding service node based on the service identifier. Upon receiving the second data packet, the forwarding service node extracts the application identifier, IP address, and port number, and performs authentication with an authentication center. After confirming that the application identifier has access rights, a binding relationship is established between the application identifier and the port number. A UDP channel is established between the application identifier and the port number, and the second data packet is forwarded to the specified IP address and port number through this channel. Upon receiving the second data packet, the device processes it and replies with a first protocol message to the forwarding service node. Based on the binding relationship, the forwarding service node forwards the first protocol message to the corresponding application service, thereby realizing cross-network segment data communication, simplifying the communication process, and improving the efficiency of cross-network segment data transmission.

[0047] Figure 1 shows a flowchart of one implementation of the cross-network segment data forwarding method provided in this embodiment of the invention. This method is applied to a forwarding service node and includes:

[0048] S100. A first data packet containing the service identifier of the forwarding service node is multicast to the first network segment, so that each application service registered in the first network segment can obtain the first data packet and send a second data packet to the forwarding service node according to the service identifier. The second data packet includes the application identifier of the application service, the IP address and port number of the device in the second network segment.

[0049] The first network segment refers to the network sub-area containing configuration software and instrument management software. The configuration software is used to configure, monitor, and control the automation system, and provides a human-machine interface (HMI) and system configuration tools, enabling operators to manage and monitor the entire system. The instrument management software is used to manage and maintain various industrial instruments, including calibration, diagnostics, and data acquisition functions.

[0050] Multicast is a network communication method that allows a sender to send data packets to a specific group of receivers, rather than sending them individually to each receiver (unicast) or to all receivers in the network (broadcast).

[0051] The service identifier is a unique identifier for the forwarding service node, used to identify the forwarding service node.

[0052] A data packet is a unit of data transmitted in a network, encapsulated from protocol messages. Data packets are formed by encapsulating data and protocol header information together for transmission over the network. A data packet typically includes a data portion (payload) and a header portion (control information).

[0053] The application service that is running and registered in the first network segment is configured to receive multicast packets, and therefore can obtain the service identifier of the forwarding service node in the first data packet multicast to the first network segment by the forwarding service node.

[0054] The second network segment refers to the network sub-area containing intelligent APL instruments, communication cards, and conventional I / O cards. Intelligent APL instruments (Advanced Physical Layer) serve as the physical layer of advanced industrial networks, supporting higher data transmission speeds and longer transmission distances. Communication cards are used for inter-device communication, supporting different communication protocols and network topologies. Conventional I / O cards, or input / output modules, are used to connect sensors and actuators to achieve signal acquisition and control.

[0055] The application identifier refers to the unique identity of an application service, which is used to identify the application service.

[0056] The port number refers to the unique identifier of the local port on the device side of the second network segment, which is used to identify the local port.

[0057] Specifically, in this embodiment of the invention, a data packet containing a forwarding service node identifier can be sent using multicast in the first network segment. This data packet contains the service identifier of the forwarding service node, the purpose of which is to inform other devices of the node's existence and purpose. In the first network segment, some application services have been registered and configured to receive this type of multicast data packet. After receiving this multicast data packet, these registered application services can obtain the service identifier information within it. Based on the forwarding service node identifier information previously received in the first data packet, the application service determines the forwarding service node to which to send the data packet and sends the second data packet to that forwarding service node.

[0058] S110. Obtain the second data packet sent by the application service, and extract the application identifier, IP address and port number of the second network segment of the application service.

[0059] The embodiments of the present invention can parse the second data packet and extract the application identifier of the application service, the IP address and port number of the second network segment, thereby determining the source and destination information of the forwarding request of the second data packet, so as to perform correct routing and forwarding.

[0060] S120. Perform authorization authentication with the authorization center based on the application identifier. If the application identifier has access to the device corresponding to the port number in the IP address, establish a binding relationship between the application identifier and the port number.

[0061] Specifically, in this embodiment of the invention, an authorization request can be initiated to the authorization center based on the application identifier. The purpose is to verify whether the application has permission to access the specified device. If the authorization center confirms that the application identifier does indeed have the access permission, and that the access permission is for a device with a specific IP address and port number, then based on the confirmation of permission, a binding relationship will be established to associate the application identifier with the specific device port number. That is, the application identifier is officially authorized to access the corresponding device through the port number.

[0062] Optionally, in embodiments of the present invention, if the application identifier does not have access to the device corresponding to the port number in the IP address, the corresponding forwarding failure information can be fed back to the application service.

[0063] S130. Establish a UDP channel between the application identifier and the port number, and forward the second data packet to the IP address and port number through the UDP channel, so that the device corresponding to the port number can process the second data packet upon receiving it and reply with the first protocol message to the forwarding service node.

[0064] The UDP channel is a data transmission channel implemented using UDP (User Datagram Protocol). This embodiment of the invention can create a dedicated UDP channel between the application service corresponding to the application identifier and the local port corresponding to the port number, for bidirectional data communication between the two parties.

[0065] Protocol messages are message formats defined according to a specific network protocol, used to implement specific communication functions.

[0066] In this embodiment of the invention, the second data packet can be forwarded via a UDP channel to the local port corresponding to the port number on the device under the IP address of the second network segment. Upon receiving the second data packet, the device will perform corresponding processing and, after processing, generate a first protocol message, which will then be sent back to the forwarding service node.

[0067] S140. Based on the binding relationship, forward the first protocol message to the application service.

[0068] This invention provides a cross-network segment data forwarding method applied to a forwarding service node. The method includes: multicasting a first data packet containing the service identifier of the forwarding service node to a first network segment, so that each application service registered in the first network segment can obtain the first data packet, and sending a second data packet to the forwarding service node according to the service identifier, wherein the second data packet includes the application identifier of the application service, the IP address and port number of the second network segment; obtaining the second data packet sent by the application service, and extracting the application identifier of the application service, the IP address and port number of the device in the second network segment; performing authorization authentication with an authorization authentication center based on the application identifier, and establishing a binding relationship between the application identifier and the port number if the application identifier has the ability to access the device corresponding to the IP address and the port number; establishing a UDP channel between the application identifier and the port number, and forwarding the second data packet to the IP address and the port number through the UDP channel, so that the device corresponding to the port number can process the second data packet upon receiving it and reply with a first protocol message to the forwarding service node; and forwarding the first protocol message to the application service according to the binding relationship. This invention constructs a forwarding service node for cross-network segment communication between different network segments. It sends a service ID to the application service via multicast, so that the application service only needs to send data to the forwarding service and specify the device in the target network segment to achieve cross-network segment data communication and efficient data transmission.

[0069] Optionally, based on one or more embodiments corresponding to Figure 1 above, in another optional embodiment provided by this invention, when the application identifier has a device end that accesses the IP address corresponding to the port number, the method may further include:

[0070] Record successful authentication sessions between the application identifier, IP address, and port number in the permission log; obtain the third data packet sent by the application service, wherein the second data packet includes the application identifier of the application service, the IP address and port number of the device in the second network segment; check whether a successful authentication session between the application identifier, IP address, and port number exists in the permission log; if so, forward the third data packet to the IP address and port number via the UDP channel, so that the device corresponding to the port number can process the third data packet upon receiving it and reply with a second protocol message to the forwarding service node; and forward the second protocol message to the application service according to the binding relationship.

[0071] The permission record is a storage mechanism used to record and maintain information about the authentication status of application identifiers, IP addresses, and port numbers. Through these permission records, the system can quickly determine whether a specific application identifier has already obtained permission to access a specific IP address and port number, thereby avoiding repeated authentication steps in subsequent communications and improving efficiency.

[0072] A successful authentication session refers to an association recorded after the initial authentication is completed. This association indicates that a specific application identifier has successfully obtained permission to access a specific IP address and port number. This session record can be used in subsequent communication processes to avoid repeated authentication steps.

[0073] This invention improves the efficiency of industrial control data transmission in large-scale, high-frequency data communication scenarios by recording relevant session information after successful initial authentication and querying these records in subsequent communications, thereby skipping repeated authentication steps and directly forwarding and processing data.

[0074] Optionally, the permission record uses a least recently used strategy caching algorithm to manage sessions. If the number of successfully authenticated sessions exceeds a preset session threshold, the earliest successfully authenticated session is deleted, and the latest successfully authenticated session is saved.

[0075] The Least Recently Used (LRU) caching algorithm is used to manage which cached data should be deleted. The LRU strategy deletes data that has not been accessed for the longest time.

[0076] Optionally, the preset session threshold can be 10. In this embodiment of the invention, when the number of successfully authenticated sessions exceeds 10, a cyclic overwrite method is used to overwrite the earliest successfully authenticated session with the latest usage time, so as to always keep the number of records below 10.

[0077] This invention employs an LRU (Least Recently Used) strategy to prioritize the retention of recently used session records, ensuring that the system cache stores only the records most likely to be accessed again. This reduces the probability of cache misses and the number of times repeated authentication is required, thereby improving overall data communication efficiency.

[0078] Optionally, based on one or more embodiments corresponding to Figure 1 above, in another optional embodiment provided by this invention, obtaining the second data packet sent by the application service may specifically include:

[0079] The second data packet sent by the application service is received via the soft bus of the first network segment.

[0080] The Soft Bus enables communication between application services and forwarding service nodes through software, logically creating a virtual communication channel.

[0081] The embodiments of the present invention utilize soft bus technology to quickly receive and process second data packets sent by application services, reducing data processing waiting time and transmission latency, thereby improving overall data transmission efficiency.

[0082] Optionally, based on one or more embodiments corresponding to Figure 1 above, in another optional embodiment provided by the present invention, when the application identifier has a device end corresponding to the port number in the access IP address, the method may further include:

[0083] Identify the data type of the second data packet; allocate bandwidth and priority to the second data packet according to the data type; transmit the second data packet to the IP address and port number via the UDP channel according to the bandwidth and priority.

[0084] Specifically, embodiments of the present invention can analyze the second data packet to determine its data type, and then allocate corresponding bandwidth and priority according to the data type to ensure that data packets of different data types receive appropriate resources. Finally, according to the set bandwidth and priority, the data packet is transmitted to the device end that matches the IP address and port number through the UDP channel.

[0085] By identifying and prioritizing data packets, this invention effectively optimizes the efficiency and quality of data transmission, ensuring that critical data in the industrial control field can be transmitted in a timely manner to prevent potential dangerous events and guarantee the efficient and stable operation of industrial control systems in complex and dynamic environments.

[0086] Optionally, based on one or more embodiments corresponding to Figure 1 above, in another optional embodiment provided by the present invention, the device includes an APL instrument, a temperature sensor, a pressure sensor, a flow meter, an electric valve, an industrial Ethernet switch, and an HMI touch screen.

[0087] Among them, APL instruments are industrial instruments that utilize advanced physical layer technology and are typically used to achieve efficient data transmission and communication.

[0088] A temperature sensor is a device used to measure temperature. It converts temperature changes into electrical signals for further processing or control.

[0089] Pressure sensors are used to measure the pressure of fluids or gases. They convert pressure signals into electrical signals for further processing or control.

[0090] A flow meter is a device that measures the flow rate of a fluid (liquid or gas).

[0091] Among them, an electric valve is a valve that is operated by an electric actuator.

[0092] An industrial Ethernet switch is a network device designed specifically for industrial environments, used to connect and manage multiple network devices.

[0093] An HMI (Human Machine Interface) touchscreen is a device used for human-machine interaction, typically in industrial control systems, to display system status, parameters, and provide an input interface for control commands. HMI touchscreens can display graphics, text, and data, and allow users to interact with the system via touch.

[0094] Optionally, based on one or more embodiments corresponding to Figure 1 above, in another optional embodiment provided by the present invention, the UDP channel integrates an adaptive congestion control algorithm to dynamically adjust the data transmission rate.

[0095] The Adaptive Congestion Control Algorithm is a mechanism used in network transmission that aims to dynamically adjust the data transmission rate to adapt to changes in network conditions, thereby maximizing effective bandwidth utilization and minimizing network congestion and data loss.

[0096] Specifically, embodiments of the present invention can use application layer protocols to implement congestion control on UDP channels, or they can use enhanced protocols to introduce adaptive congestion control algorithms into UDP channels. These enhanced protocols can be QUIC (Quick UDP Internet Connections), DTLS (Datagram Transport Layer Security), RTP (Real-time Transport Protocol), and RTCP (RTP Control Protocol). By introducing adaptive congestion control algorithms into UDP channels, embodiments of the present invention can improve the data transmission efficiency and reliability of industrial control data.

[0097] To facilitate understanding of the overall scheme of the cross-network segment data forwarding method provided by this invention, an example is given here: On network segment A, the service ID (Identifier) ​​of the forwarding service is published via multicast. Each application on network segment A obtains the service ID of the forwarding service by receiving multicast data packets, and can then send data to the forwarding service via the soft bus of network segment A. After receiving the data packet notified via the soft bus, the forwarding service parses the data packet content and extracts the source application ID, the IP address of the device on network segment B, and the port number. It performs authorization authentication on the extracted application ID and requests verification from the authorization authentication center. If the authentication center reports that the current application ID has the authorization to access the IO device at the specified address, processing continues; otherwise, a transmission failure is reported. Once authentication is successful, the forwarding service records the authorization of the application ID, and subsequent communications do not require re-authentication. The authorization record uses an LRU (Least Recently Used) method, retaining only the records of the current 10 sessions, and overwriting records after 10 sessions. A dedicated UDP channel is established by mapping the application ID sending data to the local port number. Simultaneously, the data packet is forwarded to the IP address and port number of the device on network segment B. After receiving the corresponding UDP packet, device B processes the data and replies with a protocol message to the IP address and local port bound to the forwarding service. At this point, the forwarding service forwards the received data from the device back to the application service on network segment A using the application ID.

[0098] This invention creates an application node across different network segments, capable of communicating with both network segment A and network segment B simultaneously. A forwarding service runs on this node, broadcasting its service ID via multicast to network segment A so that registered services on network segment A can recognize it. When an application needs to communicate with a device on network segment B, it simply sends data to the forwarding service on network segment A, specifying the IP address and port number of the target device on network segment B. Upon receiving the data, the forwarding service forwards it to the designated device on network segment B, thus enabling cross-network segment device communication. This approach simplifies the communication process between different network segments and improves the system's flexibility and scalability.

[0099] Figure 2 shows a schematic diagram of the data forwarding service architecture provided in this embodiment of the invention. After obtaining the service ID of the forwarding service, ionet_tunnel_0_0, through multicast, application service 1 can communicate with the APL instrument on network segment B. Application service 1 sends HART-IP protocol messages to the APL instrument for instrument configuration. The forwarding service binds a port for communication with the APL instrument. When the instrument replies with a protocol message, the forwarding service forwards the reply message back to the application via the application ID (application service 1) on network segment A.

[0100] Figure 3 shows a timing diagram of the cross-network segment data forwarding method provided in this embodiment of the invention. When an application needs to access a device, it first needs to obtain the location of the forwarding service through a multicast message. Then, the application sends a data packet to the forwarding service. After receiving the data packet, the forwarding service first authenticates with the permission center to confirm that the application has access rights. After successful authentication, the forwarding service sends the data to the IO device. The IO device processes the data and sends back a response, after which the forwarding service forwards the response back to the application, thereby completing a data interaction.

[0101] Although the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous.

[0102] It should be understood that the various steps described in the method embodiments of the present invention may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present invention is not limited in this respect.

[0103] Corresponding to the above method embodiments, this invention also provides a cross-network segment data forwarding device, the structure of which is shown in Figure 4. It is applied to a forwarding service node and includes: a forwarding service data packet multicast unit 10, a first application service data packet acquisition unit 20, an application permission authentication unit 30, a first application service data packet forwarding unit 40, and a first protocol message forwarding unit 50.

[0104] The forwarding service data packet multicast unit 10 is used to multicast a first data packet containing the service identifier of the forwarding service node to the first network segment, so that each application service registered in the first network segment can obtain the first data packet and send a second data packet to the forwarding service node according to the service identifier. The second data packet includes the application identifier of the application service, the IP address and port number of the device in the second network segment.

[0105] The first application service data packet acquisition unit 20 is used to acquire the second data packet sent by the application service and extract the application identifier, IP address and port number of the second network segment of the application service.

[0106] The application permission authentication unit 30 is used to perform permission authentication with the permission authentication center based on the application identifier. When the application identifier has access to the device end corresponding to the port number in the IP address, a binding relationship between the application identifier and the port number is established.

[0107] The first application service data packet forwarding unit 40 is used to establish a UDP channel between the application identifier and the port number, and forward the second data packet to the IP address and port number through the UDP channel, so that the device corresponding to the port number can process the second data packet upon receiving it and reply with a first protocol message to the forwarding service node.

[0108] The first protocol message forwarding unit 50 is used to forward the first protocol message to the application service according to the binding relationship.

[0109] Optionally, the device may further include: a successful authentication session recording unit, a second application service data packet acquisition unit, an authorization record query unit, a second application service data packet forwarding unit, and a second protocol message forwarding unit.

[0110] The authorization authentication success session recording unit is used to record the authorization authentication success session between the application identifier, IP address and port number in the authorization record when the application identifier has access to the device end corresponding to the IP address and port number.

[0111] The second application service data packet acquisition unit is used to acquire the third data packet sent by the application service, wherein the second data packet includes the application identifier of the application service, the IP address and port number of the device in the second network segment.

[0112] The permission record query unit is used to query the permission record to see if there is a successful permission authentication session between the application identifier, IP address and port number. If so, the second application service data packet forwarding unit is triggered.

[0113] The second application service data packet forwarding unit is used to forward the third data packet to the IP address and port number through the UDP channel, so that the device corresponding to the port number can process the third data packet upon receiving it and reply with a second protocol message to the forwarding service node.

[0114] The second protocol message forwarding unit is used to forward the second protocol message to the application service according to the binding relationship.

[0115] Optionally, the permission record uses a least recently used strategy caching algorithm to manage sessions. If the number of successfully authenticated sessions exceeds a preset session threshold, the earliest successfully authenticated session is deleted, and the latest successfully authenticated session is saved.

[0116] Optionally, the first application service data packet acquisition unit 20 can be specifically used to receive the second data packet sent by the application service through the soft bus of the first network segment.

[0117] Optionally, the device may also include a data type identification unit and a resource allocation unit.

[0118] The data type identification unit is used to identify the data type of the second data packet when the application identifier has access to the device end corresponding to the port number in the IP address.

[0119] The resource allocation unit is used to allocate bandwidth and priority to the second data packet based on the data type.

[0120] The first application service data packet forwarding unit 40 can be specifically used to transmit the second data packet to the IP address and port number via the UDP channel according to bandwidth and priority.

[0121] Optionally, the equipment includes APL instruments, temperature sensors, pressure sensors, flow meters, electric valves, industrial Ethernet switches, and HMI touch screens.

[0122] Optionally, the UDP channel integrates an adaptive congestion control algorithm to dynamically adjust the data transmission rate.

[0123] This invention provides a cross-network segment data forwarding device applied to a forwarding service node. The device is used to: multicast a first data packet containing the service identifier of the forwarding service node to a first network segment, so that each application service registered in the first network segment can obtain the first data packet, and send a second data packet to the forwarding service node according to the service identifier, wherein the second data packet includes the application identifier of the application service, the IP address and port number of the device in the second network segment; obtain the second data packet sent by the application service, and extract the application identifier of the application service, the IP address and port number of the second network segment; perform authorization authentication with an authorization authentication center based on the application identifier, and if the application identifier has the ability to access the device corresponding to the port number in the IP address, establish a binding relationship between the application identifier and the port number; establish a UDP channel between the application identifier and the port number, and forward the second data packet to the IP address and port number through the UDP channel, so that the device corresponding to the port number, upon receiving the second data packet, processes the second data packet and replies with a first protocol message to the forwarding service node; and forward the first protocol message to the application service according to the binding relationship. This invention constructs a forwarding service node for cross-network segment communication between different network segments. It sends a service ID to the application service via multicast, so that the application service only needs to send data to the forwarding service and specify the device in the target network segment to achieve cross-network segment data communication and efficient data transmission.

[0124] Regarding the apparatus in the above embodiments, the specific manner in which each unit performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0125] The cross-network segment data forwarding device includes a processor and a memory. The aforementioned forwarding service data packet multicast unit 10, first application service data packet acquisition unit 20, application permission authentication unit 30, first application service data packet forwarding unit 40, and first protocol message forwarding unit 50 are all stored as program units in the memory. The processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0126] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured, and by adjusting kernel parameters, a first data packet containing a service identifier is multicast to the first network segment. After receiving this packet, the application service registered in the first network segment sends a second data packet containing the application identifier, the IP address of the device in the second network segment, and the port number. Upon successful authentication, a binding relationship is established between the application identifier and the port number, and a dedicated UDP channel is established. This channel forwards the second data packet to the specified address and port. The device processes the packet and replies with a protocol message. The forwarding service node then forwards the message to the application service through the binding relationship, thus achieving cross-network segment data communication, simplifying the communication process, and improving the efficiency of cross-network segment data transmission.

[0127] This invention provides a computer-readable storage medium storing a program that, when executed by a processor, implements the cross-network segment data forwarding method.

[0128] This invention provides a processor for running a program, wherein the program executes the cross-network segment data forwarding method during runtime.

[0129] As shown in Figure 5, this embodiment of the invention provides an electronic device 1000, which includes at least one processor 1001, at least one memory 1002 connected to the processor 1001, and a bus 1003. The processor 1001 and the memory 1002 communicate with each other via the bus 1003. The processor 1001 is used to call program instructions in the memory 1002 to execute the aforementioned cross-network segment data forwarding method. The electronic device in this document can be a server, PC, PAD, mobile phone, etc.

[0130] The present invention also provides a computer program product that, when executed on an electronic device, is suitable for executing a program that initializes a method for cross-network segment data forwarding.

[0131] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus, electronic devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable device, create means for implementing the functions specified in one or more blocks of the flowchart illustrations and / or one or more blocks of the block diagrams.

[0132] In a typical configuration, an electronic device includes one or more processors (CPUs), memory, and a bus. The electronic device may also include input / output interfaces, network interfaces, etc.

[0133] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, like read-only memory (ROM) or flash RAM, and memory includes at least one memory chip. Memory is an example of computer-readable media.

[0134] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0135] In the description of this invention, it should be understood that if the terms "upper", "lower", "front", "rear", "left" and "right" are used to indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, they are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the position or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this invention.

[0136] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0137] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0138] The above are merely embodiments of the present invention and are not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of the claims of the present invention.

Claims

1. A method for cross-network segment data forwarding, characterized in that, Applied to a forwarding service node, the method includes: A first data packet containing the service identifier of the forwarding service node is multicast to the first network segment, so that each application service registered in the first network segment can obtain the first data packet and send a second data packet to the forwarding service node according to the service identifier. The second data packet includes the application identifier of the application service, the IP address and port number of the device in the second network segment. Obtain the second data packet sent by the application service, and extract the application identifier of the application service, the IP address of the second network segment, and the port number; Based on the application identifier, the authorization authentication center is used to perform authorization authentication. If the application identifier has the ability to access the device terminal corresponding to the port number in the IP address, a binding relationship between the application identifier and the port number is established. A UDP channel is established between the application identifier and the port number. The second data packet is forwarded to the IP address and the port number through the UDP channel, so that the device corresponding to the port number processes the second data packet upon receiving it and replies with a first protocol message to the forwarding service node. Based on the binding relationship, the first protocol message is forwarded to the application service.

2. The method according to claim 1, characterized in that, If the application identifier has the capability to access the device corresponding to the port number in the IP address, the method further includes: Record successful authentication sessions between the application identifier, the IP address, and the port number in the permission log; Obtain the third data packet sent by the application service, wherein the second data packet includes the application identifier of the application service, the IP address of the device in the second network segment, and the port number; The permission record is checked to see if there is a successful permission authentication session between the application identifier, the IP address and the port number. If so, the third data packet is forwarded to the IP address and the port number through the UDP channel so that the device corresponding to the port number can process the third data packet upon receiving it and reply with a second protocol message to the forwarding service node. Based on the binding relationship, the second protocol message is forwarded to the application service.

3. The method according to claim 2, characterized in that, The permission record uses a least recently used strategy caching algorithm to manage sessions. If the number of saved successful permission authentication sessions exceeds a preset session threshold, the earliest used successful permission authentication session is deleted, and the latest used successful permission authentication session is saved.

4. The method according to claim 1, characterized in that, The step of obtaining the second data packet sent by the application service includes: The second data packet sent by the application service is received via the soft bus of the first network segment.

5. The method according to claim 1, characterized in that, If the application identifier has the capability to access the device corresponding to the port number in the IP address, the method further includes: Identify the data type of the second data packet; Based on the data type, allocate bandwidth and priority to the second data packet; The forwarding of the second data packet to the IP address and the port number via the UDP channel includes: According to the bandwidth and the priority, the second data packet is transmitted to the IP address and the port number via the UDP channel.

6. The method of claim 1, wherein, The equipment includes APL instruments, temperature sensors, pressure sensors, flow meters, electric valves, industrial Ethernet switches, and HMI touch screens.

7. The method according to claim 1, characterized in that, The UDP channel integrates an adaptive congestion control algorithm to dynamically adjust the data transmission rate.

8. A cross-network segment data forwarding device, characterized in that, The device, applied to a forwarding service node, includes: a forwarding service data packet multicast unit, a first application service data packet acquisition unit, an application authorization authentication unit, a first application service data packet forwarding unit, and a first protocol message forwarding unit. The forwarding service data packet multicast unit is used to multicast a first data packet containing the service identifier of the forwarding service node to the first network segment, so that each application service registered in the first network segment can obtain the first data packet and send a second data packet to the forwarding service node according to the service identifier. The second data packet includes the application identifier of the application service, the IP address and port number of the device in the second network segment. The first application service data packet acquisition unit is used to acquire the second data packet sent by the application service and extract the application identifier of the application service, the IP address of the second network segment and the port number; The application permission authentication unit is used to perform permission authentication with the permission authentication center based on the application identifier, and to establish a binding relationship between the application identifier and the port number when the application identifier has the ability to access the device terminal corresponding to the port number in the IP address. The first application service data packet forwarding unit is used to establish a UDP channel between the application identifier and the port number, and forward the second data packet to the IP address and the port number through the UDP channel, so that the device corresponding to the port number can process the second data packet upon receiving it and reply with a first protocol message to the forwarding service node; The first protocol message forwarding unit is used to forward the first protocol message to the application service according to the binding relationship.

9. A computer-readable storage medium having stored thereon a program, characterized in that, When the program is executed by the processor, it implements the cross-segment data forwarding method as described in any one of claims 1 to 7.

10. An electronic device, characterized in that, The electronic device includes at least one processor, at least one memory connected to the processor, and a bus; wherein the processor and the memory communicate with each other through the bus; the processor is used to call program instructions in the memory to execute the cross-network segment data forwarding method as described in any one of claims 1 to 7.

Images