CN115643221A - HTTP asynchronous transmission method and device across power safety zone and storage medium - Google Patents

Abstract

The invention discloses a method, a device and a storage medium for http asynchronous transmission across power safety zones in the technical field of power safety zone communication, and aims to solve the problem that requests of low-safety zones cannot be processed by high-safety zones in the prior art. The method comprises the steps of obtaining data information in a request queue in a message queue, wherein the message queue is built in a low-security area and comprises the request queue and a response queue, and the data information in the request queue is obtained by monitoring an http request in the low-security area; reassembling the http request, sending the http request to a back-end service, and applying for a request result; and pushing the obtained request result to a response queue of a message queue for subscribing and responding by the low-security area, wherein the low-security area is consumed by the browser according to the response result. The method and the device are used for normally pushing and executing the information in the high-safety area according to the information request in the low-safety area, and can enhance the information interaction capacity between the high-safety area and the low-safety area of the power monitoring system while ensuring the safety level of the power grid.

Description

A HTTP asynchronous transmission method, device and storage medium across power safety zones

technical field

The invention relates to an http asynchronous transmission method, device and storage medium across a power safety zone, and belongs to the technical field of power safety zone communication.

Background technique

As network security becomes more and more important, power grid companies have successively issued regulations prohibiting low-security areas from actively accessing high-security areas. Some power grid companies have divided a DMZ area in the management information area, which has a lower security level than the third security area, and is used to deploy front-end modules of business systems, such as mobile APP front-ends. The DMZ area does not allow the deployment of databases and storage of any power grid data. All the required data needs to be actively pushed by the three security areas, and the isolation gatekeeper is used to complete the isolation from the three areas. The isolation gatekeeper is an enhanced version of the firewall. The isolation gatekeeper disables the TCP/IP protocol, and configures IP and ports at both ends for one-to-one correspondence. Using its internal address mapping function, it only supports directional access from the three areas to the DMZ area. Strategy. Therefore, there is a need for a technology that can forward http requests from low-security areas to back-end services in high-security areas to meet the needs of information interaction between high and low security areas.

Contents of the invention

The purpose of the present invention is to overcome the deficiencies in the prior art, and provide a http asynchronous transmission method, device and storage medium across the power security zone, which is used to push and execute normally from the high security zone according to the information request of the low security zone, and can While ensuring the safety level of the power grid, it enhances the information interaction capability of the high and low security intervals of the power monitoring system.

To achieve the above object, the present invention is achieved by adopting the following technical solutions:

On the one hand, the present invention provides a http asynchronous transmission method across power safety zones, including a power grid communication framework for directional push instructions from a high security zone to a low security zone, and the asynchronous transmission method includes the following steps:

Obtain the data information in the request queue in the message queue, the message queue is built in a low security zone, the message queue includes a request queue and a response queue, and the data information in the request queue is obtained by listening to http requests in the low security zone;

Reassemble the http request and send it to the backend service and apply for the request result;

The obtained request result is pushed to the response queue of the message queue for the low security area to subscribe to the response, and the low security area is used for consumption by the browser according to the response result.

Specifically, the low security zone encapsulates the http request obtained by the low security zone socket in mqtt format, and stores each http request in the message queue after encoding the universal unique identification code; and parses the response queue The UUID for low-security socket responses.

Specifically, the high-security zone uses socket technology to obtain data in the request queue, simulates the data as an http request in the high-security zone and sends it to the back-end service, and pushes the obtained result to the response queue in the message queue .

Specifically, the low security area matches the data in the response queue and the request queue before the response result, and does not respond when there is no matching data in the request queue in the response queue.

Specifically, set the encapsulation format of the http request into: Length, Header length, Header data, Body data; where Length is a 4-byte integer, and its value is equal to the sum of the lengths of Header length, Header data, and Body data, and Header length It is a 4-byte integer whose value is equal to the length of Header data. Header data uses json serialization data, and Body data is custom binary serialization data.

Specifically, the specific method for simulating the data in the request queue into a high security zone http request includes the following steps:

S1. Actively obtain the session content of the request queue in the message queue, and process it sequentially according to the granularity of the session;

S2. After obtaining a single request data in the high security area, search the configuration file according to the serviceName in the queue, find the ip and port corresponding to the request message and replace the target ip and port in the http request header, without modifying any data in the http request bodydata, where serviceName is the unique name of the backend service, including but not limited to the wildcard +.

Specifically, if the high security area waits for the feedback result to time out after the backend service sends the request, a timeout error will be generated and the error will be returned.

Specifically, the high security zone and the low security zone monitor the connection status with the message queue at all times, subscribe and publish corresponding data only when the corresponding connection status is normal, and stop data interaction when the corresponding connection status is abnormal.

On the other hand, the present invention provides a device for http asynchronous transmission across power safety zones, including a processor and a storage medium;

The storage medium is used to store instructions;

The processor is configured to operate according to the instructions to execute the steps of any one of the above-mentioned http asynchronous transmission methods across electric security zones.

In yet another aspect, the present invention provides a storage medium for http asynchronous transmission across power security zones, on which a computer program is stored. The steps of the http asynchronous transfer method.

Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

1. In the present invention, the high-security area actively subscribes to the low-security area to request queue information in the message queue, and reorganizes the obtained information for back-end service identification and execution, and then transfers the corresponding data obtained from the high-security area to the low-security area. This method can improve the communication capability between the low security zone and the high security zone while ensuring the security level of the power grid, which is beneficial for users to interact with the low security zone and get a response;

2. The present invention matches the data in the corresponding queue with the data in the request queue, and does not respond when there is no matching result, which can guarantee the security of pushing information from the high security area to the low security area to a certain extent.

Description of drawings

FIG. 1 is a flowchart of an asynchronous transmission method provided by an embodiment of the present invention;

Fig. 2 is a schematic diagram of a communication relationship of an asynchronous transmission method provided by an embodiment of the present invention.

Detailed ways

The technical solutions of the present invention will be described in detail below through the drawings and specific examples. It should be understood that the embodiments of the present application and the specific features in the examples are detailed descriptions of the technical solutions of the present application, rather than limitations on the technical solutions of the present application. In the case of no conflict, the embodiments of the present application and the technical features in the embodiments may be combined with each other.

Embodiment one:

The embodiment of the present invention provides an http asynchronous transmission method across power security areas, which is used to push and execute normally from high security areas according to information requests from low security areas, and can enhance the high and low security of the power monitoring system while ensuring the security level of the power grid Interval information interaction capability, in order to realize the above functions, this method specifically includes the following steps:

Construct the message queue in the low security zone, and the high security zone actively subscribes to the messages in the message queue in the low security zone, and the message queue proxy software mosquitto can be used for message proxying, and the proxy relationship can be shown in Figure 2;

The http request is monitored by the low security area, and the http request is stored in the request queue of the message queue;

The high-security area reassembles the http request after obtaining the http request from the low-security area. After the http request is reassembled, it sends it to the back-end service and applies for the request result, and the high-security area pushes the request result to the response queue of the message queue;

After the low-security area obtains the response queue, the response result is consumed by the browser. In this method, the high security zone actively links the request data of the low security zone, and reorganizes the data into a format accepted by the high security zone and sends it to the backend service for corresponding response, so that the acceptance request of the low security zone can be normally accepted by the high security zone. Accepting feedback, since the reorganization service of http requests is different from direct communication, it can improve the communication capability between high and low security areas while ensuring the security level of high and low security areas, providing an effective interaction feedback between low security areas and users solution.

The embodiment of the present invention provides an http asynchronous transmission method across power security zones, specifically provides a communication method between high and low security zones, and provides reliable and effective data interaction between high and low security zones. Solutions, specifically:

The low security zone encapsulates the http request obtained by the low security zone socket in mqtt format, and stores each http request in the message queue after encoding the universal unique identification code; and parses the universal unique identifier in the response queue The identifier is for socket responses in the low security zone.

The high-security zone uses socket technology to acquire data in the request queue, simulates the data as an http request in the high-security zone and sends it to the back-end service, and pushes the obtained result to the response queue in the message queue.

For the convenience of explanation, as shown in Figure 2, the request reconstruction service of the high security zone and the request processing service of the low security zone can be set up in the system, and the communication between the low security zone and the high security zone is set to use a socket (socket) Technical framework, the two sockets at this time should be applied to the request processing service and the request reconstruction service respectively, and set the request reconstruction service and the request processing service to communicate with the message queue (as shown in Figure 2);

Specifically, an encoding module and a decoding module can be set in the request processing service of the application system, and the encoding module is used to encapsulate the http request obtained by the socket in the low security area into mqtt (message queue telemetry transmission) The method is to use the socket port to monitor), and store each http request in the message queue after encoding the universal unique identification code (uuid), provide accurate request data for the high security area, and request to reconstruct the service application socket The technology obtains the data in the request queue, simulates the data as an http request and sends it to the back-end service, and pushes the result to the response queue in the message queue. The decoding module is used to analyze the universal unique identification code in the response queue for the set in the low security area. Socket response. This method uses the socket technology to transmit the information to the endpoint, and uses the encoding module and the decoding module to process the http request data, which can provide corresponding identification information for the request reconstruction service, and process the returned output as a request processing service identified signal. As shown in Figure 2, in order to ensure efficient and fast data processing, a connection pool is established using multi-threading technology in the request reconstruction service, that is, the thread pool class ThreadPoolExecutor in the Java concurrent package. Use custom thread pool configuration and reasonably configure thread pool parameters according to server resources to optimize service performance.

The embodiment of the present invention provides an http asynchronous transmission method across power security areas. In order to ensure the accuracy and certain security of data responses, the data in the response queue and the request queue are processed before the response result in the low security area. Response matching, when there is no matching data in the request queue in the response queue, no response will be made. Through data comparison, when the returned data does not have a corresponding request, by not displaying the execution result to the user, good data communication across security zones can be guaranteed Safe and good feedback accuracy.

The embodiment of the present invention provides an http asynchronous transmission method across power safety zones, specifically provides a packaging format for the request reconstruction service to recombine and forward the recombined request, specifically set the encapsulation format of the http request here It is: Length, Header length, Header data, Body data; where Length is a 4-byte integer whose value is equal to the sum of the lengths of Header length, Header data, and Body data, and Header length is a 4-byte integer whose value is equal to that of Header data Length, the Header data part uses json serialized data, and the Body data is custom binary serialized data. The format of the message topic is defined as follows: /v1/{serviceName}/{UUID}/request, where serviceName is the unique name of the backend service, including but not limited to the wildcard + (it can also be a specific backend service name), indicating all services. UUID is the session id, including but not limited to wildcard +, which means all sessions. After the mqtt message is encapsulated, push it to the request queue in the message queue.

The embodiment of the present invention provides an http asynchronous transmission method across power safety zones, specifically provides a reconfiguration and data processing process of the reconfiguration service module according to the above-mentioned encapsulation format, wherein the specific working steps of requesting the reconfiguration service include:

Actively obtain the session content of the request queue in the message queue (subscribe to the data in the request queue), and store it in the cache area of the request reconstruction service according to the granularity of the session, where the granularity refers to the macro and micro levels of data;

Obtain a single request data from the cache area of the request reconstruction service (you can allocate an idle thread from the thread pool to obtain a single request data from the cache area), and reconstruct the HTTP request body according to the obtained session data according to the HTTP protocol;

Search the configuration file according to the serviceName in the queue, find the corresponding ip and port of the request message and replace the target ip and port in the http request header without modifying any data in the body data of the http request, where serviceName is the unique name of the backend service, including but It is not limited to the wildcard + (it can also be the specific name of the backend service, and this step can complete the re-simulation of the request body).

After the reorganization is completed, it starts to wait for data feedback and processing. Specifically, the high security zone forwards the simulated request to the ip address of the target backend service, and waits for the result to be returned; finally, the returned result data is reorganized into mqtt format The data can be pushed to the response queue of the message queue.

Through the above reorganization method, the request of the low security area can be converted into the request of the high security area, and the feedback result can be pushed to the low security area for execution after the high security area, and the request processing service of the low security area can receive the response result , the commands pushed by the high security zone can be executed normally.

The embodiment of the present invention provides an http asynchronous transmission method across power safety zones, setting the timeout period of the session response in the high security zone, and if waiting for the feedback result to time out, a timeout error will be generated and the error will be returned for system communication when a problem occurs Feedback can be done normally.

The embodiment of the present invention provides an http asynchronous transmission method across power safety zones, setting the request reconstruction service and request processing service to monitor the connection status with the message queue at all times, and only subscribe and publish the corresponding data when the corresponding connection status is normal , when the corresponding connection status is abnormal, the data exchange is suspended. Here, the suspension of interaction specifically refers to the suspension of interaction when the connection status is wrong, so as to avoid a large number of errors or data loss caused by the continuous transmission of data when the connection is abnormal, which is conducive to ensuring the normal operation of the communication system.

Embodiment two:

The present invention provides a device for http asynchronous transmission across power safety zones, including a processor and a storage medium;

The storage medium is used to store instructions;

The processor is configured to operate according to the instructions to execute the steps of any one of the http asynchronous transmission methods across the power security zone in the first embodiment.

Embodiment three:

The present invention provides a computer-readable storage medium, on which a computer program is stored, which is characterized in that, when the computer program is executed by a processor, it realizes the http asynchronous transmission across the power safety zone of any item in the first embodiment method steps.

Those skilled in the art should understand that the embodiments of the present application may be provided as methods, systems, or computer

computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowcharts and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and combinations of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a Means for realizing the functions specified in one or more steps of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram. These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart flow or flows and/or block diagram block or blocks.

The above is only a preferred embodiment of the present invention, it should be pointed out that for those of ordinary skill in the art, without departing from the technical principle of the present invention, some improvements and modifications can also be made. It should also be regarded as the protection scope of the present invention.

Claims (10)

1. a kind of http asynchronous transmission method across electric power security zone, it is characterized in that, comprise the grid communication framework that carries out directional push instruction from high security zone to low security zone, described asynchronous transmission method comprises the steps: Obtain the data information in the request queue in the message queue, the message queue is built in a low security zone, the message queue includes a request queue and a response queue, and the data information in the request queue is obtained by listening to http requests in the low security zone; Reassemble the http request and send it to the backend service and apply for the request result; The obtained request result is pushed to the response queue of the message queue for the low security area to subscribe to the response, and the low security area is used for consumption by the browser according to the response result. 2. A kind of http asynchronous transmission method across power security zone according to claim 1, it is characterized in that, described low security zone carries out the http request that low security zone socket acquires mqtt format encapsulation, and every An http request is stored in the message queue after encoding the UUID; and the UUID in the response queue is parsed for the socket response in the low security area. 3. A kind of http asynchronous transmission method across power security zone according to claim 2, it is characterized in that, described high security zone application socket technology obtains the data in the request queue, simulates data into high security zone The http request is sent to the backend service, and the obtained result is pushed to the response queue in the message queue. 4. A kind of http asynchronous transmission method across power safety zone according to claim 1, it is characterized in that, before the response result in the low security zone, the data in the response queue and the request queue are matched in response, when the response queue No response is made when there is no matching data for the request queue. 5. A kind of http asynchronous transmission method across power safety zone according to claim 3, it is characterized in that, the encapsulation format of setting http request is divided into: Length, Header length, Header data, Body data; Wherein Length is 4 A byte integer whose value is equal to the sum of the lengths of Header length, Header data, and Body data. Headerlength is a 4-byte integer whose value is equal to the length of Header data. Header data uses json to serialize data, and Body data is a custom binary serialized data. 6. a kind of http asynchronous transmission method across power security zone according to claim 5, is characterized in that, the concrete method that simulates the data in the request queue into high security zone http request comprises the following steps: S1. Actively obtain the session content of the request queue in the message queue, and process it sequentially according to the granularity of the session; S2. After obtaining a single request data in the high security zone, search for the configuration file according to the serviceName in the queue, find the ip and port corresponding to the request message and replace the target ip and port in the http request header, without modifying any data in the http request body data, Where serviceName is the unique name of the backend service, including but not limited to the wildcard +. 7. The http asynchronous transmission method across power safety zones according to claim 3, characterized in that, if the high security zone waits for the feedback result to time out after the backend service sends a request, a timeout error will be generated and the error will be returned . 8. A method of http asynchronous transmission across power safety zones according to claim 3, wherein the high security zone and the low security zone monitor the connection status with the message queue at all times, and only when the corresponding connection status is normal Subscribe and publish corresponding data, and stop data interaction when the corresponding connection status is abnormal. 9. A device for http asynchronous transmission across power safety zones, characterized in that it includes a processor and a storage medium; The storage medium is used to store instructions; The processor is configured to operate according to the instructions to execute the steps of the http asynchronous transmission method across power safety zones in any one of claims 1-8. 10. A computer-readable storage medium, on which a computer program is stored, characterized in that, when the computer program is executed by a processor, it realizes http asynchronous transmission across an electric power safety zone according to any one of claims 1-8 method steps.

Images