CN101321209A - Safe communication distributed data extraction method and implementing system based on PSTN - Google Patents
Safe communication distributed data extraction method and implementing system based on PSTN Download PDFInfo
- Publication number
- CN101321209A CN101321209A CNA2008100392055A CN200810039205A CN101321209A CN 101321209 A CN101321209 A CN 101321209A CN A2008100392055 A CNA2008100392055 A CN A2008100392055A CN 200810039205 A CN200810039205 A CN 200810039205A CN 101321209 A CN101321209 A CN 101321209A
- Authority
- CN
- China
- Prior art keywords
- assembly
- data
- equipment
- key
- client
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Landscapes
- Telephonic Communication Services (AREA)
- Computer And Data Communications (AREA)
Abstract
The invention belongs to the field of computer system remote supervisory technology, which specially is a security communication distributed data extraction method based on PSTN and realization system. In this invention, the user can send connection command from the server end, perform addressing to plural clients accessing to PSTN network, acknowledge legal access to client using certificate, real-time extract and data on plural clients and package using distributed data extraction middleware after addressing is succeeded, and encrypts the data and command during the transmitting process. The realization system includes an addressing and security communication module and a distributed data extraction module. The previous one consists of a central node digital apparatus, N sub node digital apparatus, a modulation demodulation apparatus and a central encipher etc. The latter one consists of a data integrating component, a client application component and a data extraction component etc. The method and the realization system can ensure the completeness and security of the data during the transmitting process.
Description
Technical field
The invention belongs to computer system remote supervisory technical field, be specifically related to a kind of safe communication distributed teledata extracting method and realization system based on PSTN (public switch telephone network).
Background technology
1. encryption technology
Encryption technology is divided two classes: symmetric cryptography and asymmetric encryption.The principle of asymmetric encryption (RSA, DSA, DH asymmetriccryptography) is as follows:
Use one must can be to anyone disclosed PKI to the private key of unwarranted user cipher device and one.PKI and private key all are associated on mathematics; Data with public key encryption can only be deciphered with private key, and can only use public key verifications with the data of private key signature.PKI can offer anyone; PKI is used for the data that will send to the private key holder are encrypted.Two keys all are unique for communication session.Public key encryption algorithm is also referred to as asymmetric algorithm, and reason is need come data decryption with another key with secret key encryption data.The cardinal principle of symmetry algorithm is exactly an one-way function, f (a)=b, but be difficult to obtain a with b.
A method that can jeopardize with the data of this type password encryption is that each possible key is carried out exhaustive search.According to being used to carry out the encrypted secret key size, also extremely consuming time even use the fastest computer to carry out this search, therefore be difficult to carry out.Use bigger key will make deciphering difficulty more.Can not make the adversary can't retrieve ciphered data though encrypt in theory, this has greatly increased the cost of doing so really.Only retrieve that significant data need spend the trimestral time in several days if carry out thoroughly search, the method for exhaustive search is unpractical so.
Public key encryption has bigger key space (or probable value scope of key), therefore not quite is subjected to the exhaustive attack that each possibility key is all attempted easily.Owing to needn't protect PKI, so it is easy to distribution.Public key algorithm can be used for creating the identity of digital signature with the verification msg transmit leg.Public key encryption is generally used for encrypting key and the IV that a private key algorithm will be used.Behind transmission security key and the IV, the remainder of session will use encrypted private key.
According to the concrete technology that programming realizes, in existing basic platform was realized, the .NET of Microsoft provided following asymmetric (public/private keys) cryptographic algorithm by abstract base class (System.Security.Crytography.AsymmetricAlgorithm):
·DSACryptoServiceProvider
·RSACryptoServiceProvider
But, call above-mentioned base class and realize that in program asymmetric encryption belongs to soft encryption, in specific implementation, bind with concrete the application mutually, limited and encrypted the versatility and the flexibility of using.
2. pass through data extract and the remote transmission of Internet/Intranet
In comparatively ripe industrial monitoring such as industrial control system was used, the extraction of data can be accomplished to support from monitored end " pushing away " data and from monitoring client " drawing " data dual mode downwards upwards.But in the middle of the enterprise-level financial regulation was used, current B/S system mostly only supported the function that client data uploads onto the server, and is initiatively comparatively rare to the function of client extraction data from server; Be the client of representative with the financial software particularly, data have certain sensitiveness, should not insert Internet, and the realization of this " drawing " data can become more complicated.For example, a supervision system, to arrive physically be dispersed in the different location a plurality of when being extracted the data that supervision department needs in real time, as required by (several data storehouse type selecting) in the database of supervision financial software, the Web application system of main flow just can only be taked to require to be supervised " pushing away " data mode that the financial system user initiatively declares to supervisory systems at present, and this can not satisfy the requirement that financial regulation department initiatively extracts data (comprising subject, voucher etc.) to each financial machine client far away.Under this " pushing away data " mode, transfer of data is normally finished by the Internet network, and Internet is the packet switching network, adopts this transmission means, requires monitoring client and monitored end all to be linked into Internet in some way.Thereby can bring following problem:
(1) network security needs the solution of a heavyweight, will adopt the network security system that comprises fire compartment wall, intrusion detection (defence) etc. such as monitoring client (server end), realizes complexity, and the cost height;
(2) monitored end must insert Internet in some way; If there is clear and definite business demand to require monitored end (as financial software) must not insert Internet, then problem can't solve;
(3) if monitored end allows to insert Internet, then must have the Internet IP address that to visit, as inserting by modes such as special line, VPN, modem, ADSL; For satisfying the requirement of the real-time image data of monitoring client, monitored end is must 24 hours online, like this, aforesaid way in various degree have an expensive problem; Under modes such as VPN, modem, ADSL, connect for some reason that barrier interrupts in case also exist once, then reconnect IP address, back and dynamically change, thereby cause the problem that monitoring client can't addressing.
Different with Internet, PSTN (public switch telephone network) is a kind of global voice communications circuit switching network, has nearly about 800,000,000 user.It is a kind of analog electrical phone network of fixed line at first, and current PSTN almost all adopts digital telephone network and comprises mobile and landline telephone.Transmission method based on PSTN is to cooperate a kind of data transfer mode that realizes with computer by telephone line and online special equipment (as: modulator-demodulator etc.).Modulator-demodulator (being Modem), it is the device that carries out conversion of signals between computer and the telephone wire, form by modulator and demodulator two parts, modulator is that being modulated into can be at the device of the defeated voice signal of phone line for digital signal (as file etc.) computer, at receiving terminal, demodulator converts voice signal to and calculates the digital signal that function receives.Just can realize data communication between the computer by modulator-demodulator and telephone wire.
Summary of the invention
The object of the present invention is to provide a kind of distributed data extraction method and realization system that can guarantee data integrity and fail safe in the transmission course based on PSTN.
The present invention is directed to enterprise-level application fields such as financial regulation and monitoring, proposed a kind of distributed data extraction method and realization system based on the PSTN secure communication.The present invention has provided the job step and the composition of distributed data extraction middleware, uses PSTN, Modem and fixed telephone number to carry out device talk and addressing, and design centre encryption equipment and node encrytion module are carried out authentification of user and safe transmission; System according to this method realizes can carry out real time remote supervision or monitoring to a plurality of financial softwares that physically are dispersed on the multiple computers.
In the monitoring and supervising business field, some equipment is unsuitable for and is connected to Internet (as financial system because of depositing sensitive data, be example all hereinafter with financial machine) situation, the present invention proposes and utilize PSTN (common transmission telephone network) to carry out server end to the Active Addressing of client and a solution of secure communication.The data extract in this monitoring and supervising field has two characteristics: 1, initiatively initiates by monitoring client (server end), and 2, should have relatively-stationary addressing mode by the monitored end (client) that monitoring client determined, and can guarantee real-time online; Under normal conditions, financial machine is not exposed on the Internet.Only when needs extract financial machine data, the mode that adopts Modem to dial fixed telephone number is carried out addressing, thereby connects with the financial machine of appointment.Extract data in the financial machine by the data extract middleware again.
This realization system can accomplish in long-range mode, guaranteeing by the host safety of supervision/supervision financial software (not by illegal invasion, unauthorized access) under the situation, from physically being deployed in the different financial software (UFSOFT on many various computing equipment, Kingdee, Boke, Newgrand etc.) in the different software versions, automatic or passive extraction financial data (comprises subject, voucher etc.) function, and carry out encryption in the transmission course with the cryptographic algorithm that meets national business secret standard, guarantee that the financial data that relates to business secret is not cracked or distorts by illegal the intercepting and capturing in transmission course.
The target of this method and the system of realization:
1. supervision/monitoring program can be sent the extraction data command to a plurality of by supervision/monitoring client as required at any time.
2. guarantee by the host of supervision/monitoring program operation not by illegal invasion or visit.
3. guarantee data integrity, the fail safe of data transmission procedure.
4. the data extract middleware can adapt to multiple Web service application, can use with J2EE, ASP.NET uses co-operation.
5. it is convenient to dispose, low as far as possible to server requirement.
6. adaptability is strong, goes for multiple network environment and financial software.
7. interface is clear easy-to-use, and Web uses to use with data extract easily and communicates, and comprises issuing command, obtains data and query State.
8. support rear end, several data storehouse.
The present invention does not use and normally used in the information system terminal equipment is inserted Internet, utilize Internet to carry out the mode of equipment addressing, but propose to use Modem (modulator-demodulator) equipment to carry out the equipment addressing at PSTN (common transmission telephone network), and by the certificate validation access rights, use asymmetric encryption techniques that the transmission data are encrypted, form the solution that slave unit is addressed to secure communication.
Among the present invention, the purposes of Modem no longer is the equipment that is linked on the Internet, but a kind of UNICOM equipment of digital terminal equipment (computer equipments such as server, PC) and PSTN network, use fixed telephone number to carry out addressing between the digital terminal equipment, carry out point-to-point (end-to-end) communication by the PSTN network.By after fixed telephone number addressing success and connecting, use center encryption equipment and node encrytion module transmit certificate between digital device, the authority that conducts interviews is confirmed, guarantee the legitimacy of communication between devices, and use asymmetric encryption techniques that the instruction and the data of transmission are encrypted, to guarantee the transmission security of data.Further, by polling mode, support the star topology structure of a center digital terminal equipment (Centroid) to a plurality of monitored (supervision) digital terminal equipments (child node).Its principle as shown in Figure 1.
Generally, realization system can be divided into addressing and secure communication module, distributed data extraction module two large divisions.Addressing and secure communication module partly are made up of Centroid digital device (as server etc.), a N child node digital device (as financial machine etc.), dialing equipment (as modulation equipment), center encryption equipment, encrypting module, certificate key management unit etc.; The distributed data extraction module partly is made up of data integrated assembly (DI assembly), client application assembly (CA assembly), data extraction component (DEC assembly), Service Database and financial database etc., sees shown in Figure 3.Do specific descriptions below respectively.
Addressing and secure communication module
In the realization system, Centroid digital device (i.e. supervision end server) 3 is by monitoring client modulation equipment (Modem) 2, initiate to 9 addressing of child node numeral equipment (financial machine etc.) via pstn telephone network 1 and monitored end modulation equipment 8, after the addressing success, connecting, the Centroid digital device 3 of monitoring client calls center encryption equipment 4 and sends certificate to the child node numeral equipment 9 of monitored end, with the authentication that communicates.The mode of certification authentication even guaranteed that other third parties have unlawfully carried out addressing and connection to monitored child node numeral equipment, owing to there is not certificate, also can't communicate with monitored child node, stops unauthorized access.In transfer of data, the present invention proposes to use the cryptographic algorithm of national commercial code administration committee approval, the data of transmission is carried out encryption and decryption, to guarantee integrality and the fail safe of data in remote transmission.Encrypt and adopt asymmetric encryption techniques.Centroid digital device and each child node numeral equipment all have the public and private key certificate of oneself, and public and private key certificate is provided (during the change of design server end PKI, to the update strategy of financial machine end) by certificate KMC.At first transmit leg (Centroid digital device) generates an interim session key, and expressly with this secret key encryption, generate the ciphertext module, transmit leg obtains recipient's public key certificate (each financial secret key exists in the server with the LDAP form) again, this session key is encrypted, and encrypted session key and ciphertext send the recipient together to; The recipient is decrypted encrypted session key by the private key certificate of oneself, uses the session key decrypting ciphertext that obtains again, thereby obtains the data of needs.Reverse transfer of data adopts same mechanism to carry out.The granting of certificate and key and safeguard by certificate key management unit independently and undertaken; The certificate key management unit directly is stored in the certificate and the key of child node numeral equipment 9 in the corresponding encrypting module, and the certificate of center encryption equipment 4 and key then are stored in the key card by the certificate key management unit, are called by center encryption equipment 4 by card reader.
This project addressing secure communication module physics deployment diagram as shown in Figure 2.
The distributed data extraction module:
The logical construction of distributed data extraction module mainly comprises: the computing function part, form by data integrated assembly (DI), client application assembly (CA), data extraction component (DEC) etc.; Interconnect portion is made up of distributed communication program (Server) and distributed communication program parts such as (Client).
Data integrated service assembly (DI) operates in monitoring/supervision end, being responsible for client application assembly (CA) with the monitored system of other operation systems of using this middleware, far-end waits and carries out alternately, comprise and accept the parameter that other operation systems transmit about the extraction data, this parameters remote is transferred to the client application of monitored end, receive the extraction data that client application (CA) is passed back, and it is write the database of other operation systems, realize the consistency of data;
The client of monitored/supervision that client application assembly (CA) operates in, it mainly acts on is to finish mutual with remote server, promptly solve the Network Transmission problem of distributed middleware, relevant parameter, data are transmitted between DEC assembly and DI assembly.The CA assembly can be supported under two kinds of different patterns:
A) passive-type client (Waiter pattern) also claims to draw data.Under this kind client mode of operation, the CA assembly does not need the operation user intervention of monitored node, and the instruction from long-range DI assembly is accepted in operation automatically, carries out the operation of extracting data, and calls suitable network operation operating result is returned long-range DI assembly.
B) active client (Reporter pattern) also claims to push away data.This kind client can not moved automatically, needs client's start-up by hand, starts the operation of a data extract then, and contact DI assembly, and data are sent to the DI assembly.
By the network row communication, can support multiple network such as PSTN/Internet/Intranet between CA assembly and the DI assembly.Wherein:
A) client can be passed through particular network, communicates with ICP/IP protocol and DI assembly.
B) DI can be accessed by above-mentioned network.DI is connected to the CA assembly by Modem dialing (perhaps by the Internet network, allow to be connected to public network at monitored node, and have under the prerequisite of fixing public network IP), and sends instruction to the CA assembly, and log-on data is extracted.
DEC is designed to an assembly (specific implementation can be developed to the COM+ assembly by DotNet), must with the running software of monitored/supervision on same physical computing resource, be used for directly extracting monitor data (as financial data etc.) from the database of various monitored systems (as financial software etc.).This assembly is by the client application component call, and the parameter according to the client application assembly transmits extracts corresponding field value in monitored/supervision database, pass client application back after encapsulating, and current encapsulation standard is the mode with XML document.
Monitoring and supervise (server) end specifically affixes one's name to the lower part:
A. data integrated assembly DI,
B. distributed communication program (Server),
C. Service Database;
Monitored end (financial machine end) is disposed with the lower part:
The a.CA assembly,
B. distributed communication program (Client),
C.DEC assembly (containing data extraction program, testing tool, configuration tool) 12.
In specific implementation, distributed communication program (Server) can be incorporated in the DI assembly, and distributed communication program (Client) can be incorporated in the CA assembly.During work, data integrated assembly DI is responsible for sending instructions to the CA assembly, and the data of CA assembly passback is handled the back carry out synchronously with the data of calling system; Call the DEC assembly after the instruction of client application (CA) reception DI assembly, and the data of DEC assembly passback are carried out necessary processing forward give the DI assembly.
Operating procedure based on the data extract of above-mentioned realization system is as follows:
Prerequisite: DI assembly 5 and service application assembly 13 can be visited same Service Database 16; Specific normalizing database of DI assembly 5 regulation, service application assembly 13 must satisfy this standard, by professional device database 16 issuing commands and obtain data.
Draw data type:
The first step starts the DI assembly 5 of monitoring server end, poll Service Database 6; If in Service Database 6, do not find satisfactory data extract record, then change the first step;
Second step was then read this record if find satisfactory data extract record in Service Database 6, decomposed the parameter of this record, inquired about according to parameter, obtained extracting parameters such as a telephone number for the treatment of addressing and commencement date and deadline, subject number, voucher number;
The 3rd step DI assembly 5 calls Modem2, dials the telephone number for the treatment of addressing, via pstn telephone network 1, is initiated to the connection that certain specifies CA assembly 13, if the dialing failure then went back to for the 3rd step, if call all failures for three times, then stops and reports an error;
The 4th step dial-up success, DI assembly 3 calls center encryption equipment 4, and to the encrypting module 14 transmission certification authentications of the child node numeral equipment 4 of specifying CA assembly 13 places, the encrypting module 14 of child node numeral equipment 9 calls the PKI of DI assembly and verifies, if authentication failed went back to for the 3rd step;
The certification authentication success of the 5th step, DI assembly 5 calls center encryption equipment 4 and generates session key, extracting parameter is generated ciphertext with this session key, and the public key encryption with session key and ciphertext usefulness CA assembly 13 sends to the encrypting module 14 of specifying CA assembly 13 places;
The encrypting module 14 reception information at CA assembly 13 places of the 6th step appointment are called the private key of oneself and are decoded, if failure changeed for the 3rd step;
The 7th step decoded successfully, obtained extracting parameter, was transmitted to CA assembly 13, and log-on data is extracted;
The 8th step changeed for the 3rd step if CA assembly 13 extracts data failure; If success becomes specified format (as XML document) with the data encapsulation of extracting, turn back to the encrypting module 14 at these CA assembly 13 places;
The encrypting module 14 at the 9th these CA assembly 13 places of step calls the session key of DI assembly 5 transmission, encrypt, and the ciphertext after will encrypting is encrypted with the private key of oneself again, be back to the center encryption equipment 4 of DI assembly 5 ends, the PKI that center encryption equipment 4 calls this CA assembly 13 is decrypted, and call session key ciphertext is decoded into expressly, be forwarded to DI assembly 5;
The plaintext that the tenth step DI assembly 5 will receive writes Service Database according to the specific data form, interrupts connecting, and finishes.
Push away data type:
Centroid digital device end (supervision end) 3 starts DI assembly 5, the port of intercepting an appointment; If active connection request this port discovery reporter (Reporter), then accept this request and receive the data that transmit, judge whether these data have been expressly, if not, the center encryption equipment of calling is decoded, and will expressly write Service Database with the predetermined data form;
Child node numeral equipment end (being supervised end) 9 users start DEC assembly 12, choose self-defining data, DEC assembly 12 will carry out data encapsulation automatically, call that encrypting module is encrypted and through the telephone number of Modem8 addressing Centroid digital device end 3, the encapsulation of data after will encrypting after connecting sends to Centroid digital device end particular port.
Description of drawings
Fig. 1 is PSTN addressing and secure communication schematic diagram.
Fig. 2 is a secure communication part physics deployment diagram.
Fig. 3 extracts middleware and safe communication system structure chart for distributed data
Number in the figure: 1 is the pstn telephone network, 2 is monitoring client modulation equipment (Modem), 3 is Centroid digital device (supervision end server etc.), 4 is the center encryption equipment, 5 is data integrated assembly (DI assembly), 6 is Service Database, 7 is other service application, and 8 is monitored end modulation equipment (Modem), and 9 is child node numeral equipment (as financial machine etc.), 10 is the child node application module, 11 is the financial system database of being supervised, and 12 are data extraction component (being designated as DEC), and 13 is client application assembly (being called for short the CA assembly), 14 is encrypting module (monitored end), 15 is the PKI of financial machine, and 16 is key card, and 17 is card reader, 18 is the certificate key management unit, and 19 are supervision end PKI.
Embodiment
Enforcement of the present invention needs monitoring client and monitored end that fixed telephone number is all arranged, by Modem and landline telephone wiring digital device (is moved the host that distributed data is extracted middleware and financial software etc., comprise server, PC etc.) access PSTN network, and require to keep access unimpeded, be telephone wire one directly on Modem, Modem one is directly on digital device, like this, monitoring client can be initiated addressing and connection as required in real time; In addition, require the assemblies such as DI, CA, DEC of distributed extraction middleware to operate in respectively on the corresponding host, the different financial softwares that extract, different software versions is within the scope that DEC supports.
Method proposed by the invention and realization system use in information systems such as Science and Technology of Shanghai administrative supervisory system, Songjiang state-owned assets supervisory systems.
Be example with using in the state-owned assets supervisory systems of Songjiang:
What call data extraction system among the present invention is: Songjiang state-owned assets supervisory systems, the database of sharing is the database of this operation system, this system is become by a Web database and a database servers group, and DI assembly and distributed communication program (Server) are deployed on the Web server; The system that is supervised is the financial system of 23 tame state-owned enterprises, is deployed in respectively in the different business finance chamber of 23 families, has all disposed CA assembly, DEC assembly, distributed communication program (client) on every financial machine.
In should using, data extract takes to draw data type, and once typical partial data extracts and the secure communication running is described below:
1, state-owned assets supervisory systems in Songjiang will be extracted the parameter of data, comprise that beginning and ending time section, the symbolization of accounts of which company (child node numbering), supervision, the relevant parameter that the voucher numbering is waited for extracted data etc. write a record of operation system database, and the mark position 1 that will write down; DI finds that this flag bit is 1 record during poll from this database, with this mark position 0, and reading and recording obtains relevant parameter;
2, DI is after getting access to data extraction task, and inquiry child node code database obtains child node addressing (telephone number), initiates once to connect (once fixedly code dialing);
3, after the addressing success, set up the communication link of one bar based on PSTN, DI sends certificate to the encrypting module of this child node deploy, verify that if checking is not passed through, then later any visit to this child node all will be rejected, after checking is passed through, obtain to call the CA operation power of this child node; The encipheror of DI end will generate a key (the SCB2 general-purpose algorithm of the national commercial code of process management board approval) at random, the relevant parameter of data to be extracted is encrypted to ciphertext with this random key, call the PKI of child node again, the key that obtains at random and the ciphertext of generation are encrypted, send the encrypting module of specifying child node to, after this encrypting module received, the CA assembly PKI that calls storage was decrypted, and parameter and instruction after the deciphering are passed to the CA assembly;
4, the CA assembly sends relevant parameter and instruction to the DEC assembly;
5, the DEC assembly is carried out command adapted thereto, and the data of designated parameter are extracted from the financial database of the said firm, according to specified format, is packaged into XML document, is transmitted to CA;
6, the CA assembly receives XML document, calling the random key received (use meets the secret sign indicating number of national commercial code administration committee approval) encrypts, generate ciphertext, again with this ciphertext and random key with the private key in the encrypting module of this child node, encrypt encapsulation, pass to the DI assembly of monitoring client;
7, the DI assembly of monitoring client receives the enciphered data of passing back, and the PKI that calls this child node is decrypted, and the data after the deciphering are sealed off dress with random key again, writes according to specified format in the database table of operation system correspondence;
8, an addressing, authentication, extracted data, secure communication finish, and the DI assembly is carried out next data extraction task.
Claims (4)
1, a kind of safe communication distributed data extraction method based on PSTN, it is characterized in that: use the UNICOM equipment of modulator-demodulator as digital terminal equipment and PSTN network, use fixed telephone number to carry out addressing between the digital terminal equipment, carry out point to point link by the PSTN network; By after fixed telephone number addressing success and connecting, use center encryption equipment and node encrytion module transmit certificate between digital device, the authority that conducts interviews is confirmed, guarantee the legitimacy of communication between devices, and use asymmetric encryption techniques that the instruction and the data of transmission are encrypted, to guarantee the transmission security of data; And, support the star topology structure of a center digital terminal equipment to a plurality of monitored digital terminal equipments by polling mode.
2, a kind of realization system of the safe communication distributed data extraction method based on PSTN is characterized in that: system is divided into addressing and secure communication module, distributed data extraction module two large divisions; Wherein, addressing and secure communication module are made up of Centroid digital device, a N child node digital device, dialing equipment, modulation equipment, center encryption equipment, encrypting module, certificate key management unit; The distributed data extraction module also claims DI assembly, client application assembly also to claim CA assembly, data extraction component also to claim DEC assembly, Service Database and financial database to form by the data integrated assembly;
In addressing and the secure communication module, Centroid digital device (3) is initiated to the addressing of child node numeral equipment (9) via pstn telephone network (1) and monitored end modulation equipment (8) by monitoring client modulation equipment (2), after the addressing success, connecting, the Centroid digital device (3) of monitoring client calls center encryption equipment (4) and sends certificate to the child node numeral equipment (9) of monitored end, with the authentication that communicates;
In the distributed data extraction module, data integrated service assembly operating is held in monitoring/supervision, be responsible for carrying out alternately with the client application assembly of the monitored system of other operation systems of using this middleware, far-end, comprise and accept the parameter that other operation systems transmit about the extraction data, this parameters remote is transferred to the client application of monitored end, receive the extraction data that client application is passed back, and it is write the database of other operation systems, realize the consistency of data;
The client application assembly operating is in the client of monitored/supervision, and it mainly acts on is to finish mutual with remote server, promptly solves the Network Transmission problem of distributed middleware, and relevant parameter, data are transmitted between DEC assembly and DI assembly; The CA assembly can be supported under two kinds of different patterns:
A) passive-type client also claims to draw data, under this kind client mode of operation, CA does not need the operation user intervention of monitored node, and the instruction from long-range DI is accepted in operation automatically, carry out the operation of extracting data, and call suitable network operation operating result is returned long-range DI;
B) active client also claims to push away data, and this kind client can not moved automatically, needs client's start-up by hand, starts the operation of a data extract then, and contact DI assembly, and data are sent to the DI assembly;
Communicate by network between CA assembly and the DI assembly, can support the PSTN/Internet/Intranet multiple network, wherein:
A) client can be passed through particular network, communicates with ICP/IP protocol and DI assembly;
B) the DI assembly is accessed by above-mentioned network.DI is dial-up connection to Wisp by Modem, and sends instruction to Wisp, and log-on data is extracted;
The running software of DEC assembly and monitored/supervision is used for directly extracting monitor data from the database of various monitored systems on same physical computing resource; This assembly is by the client application component call, and the parameter according to the client application assembly transmits extracts corresponding field value in monitored/supervision database, pass client application back after encapsulating, and current encapsulation standard is the mode with XML document.
3, system according to claim 2 is characterized in that Centroid digital device and each child node numeral equipment all have the public and private key certificate of oneself, and public and private key certificate is provided by certificate KMC; At first the Centroid digital device generates an interim session key, and with this secret key encryption expressly, generating the ciphertext module, transmit leg obtains recipient's public key certificate again, this session key is encrypted, and encrypted session key and ciphertext send the recipient together to; The recipient is decrypted encrypted session key by the private key certificate of oneself, uses the session key decrypting ciphertext that obtains again, thereby obtains the data of needs; Reverse transfer of data adopts same mechanism to carry out; The granting of certificate and key and safeguard by certificate key management unit independently and undertaken; The certificate key management unit directly is stored in the certificate and the key of child node numeral equipment in the corresponding encrypting module, and the certificate and the key of center encryption equipment (4) then are stored in the key card by the certificate key management unit, are called by the center encryption equipment by card reader.
4, the operating procedure based on the data extract of claim 2 or 3 described systems is as follows:
Prerequisite: DI assembly 5 and service application assembly (13) can be visited same Service Database (16); Specific normalizing database of DI assembly (5) regulation, service application assembly (13) must satisfy this standard, by professional device database (16) issuing command and obtain data;
Draw data type:
The first step starts the DI assembly (5) of monitoring server end, poll Service Database (6); If in Service Database (6), do not find satisfactory data extract record, then change the first step;
Second step is if find satisfactory data extract record in Service Database (6), then read this record, decompose the parameter of this record, inquire about, obtain extracting parameters such as a telephone number for the treatment of addressing and commencement date and deadline, subject number, voucher number according to parameter;
The 3rd step DI assembly (5) calls monitoring client modulator-demodulator (2), dials the telephone number for the treatment of addressing, via pstn telephone network (1), be initiated to the connection that certain specifies CA assembly (13), if the dialing failure then went back to for the 3rd step, if call all failures for three times, then stop and report an error;
The 4th step dial-up success, DI assembly (3) calls center encryption equipment (4), encrypting module (14) to the child node numeral equipment (4) of specifying CA assembly (13) place sends certification authentication, the encrypting module (14) of child node numeral equipment (9) calls the PKI of DI assembly and verifies, if authentication failed went back to for the 3rd step;
The certification authentication success of the 5th step, DI assembly (5) calls center encryption equipment (4) and generates session key, extracting parameter is generated ciphertext with this session key, and the public key encryption with session key and ciphertext usefulness CA assembly (13) sends to the encrypting module (14) of specifying CA assembly (13) place;
Encrypting module (14) the reception information at CA assembly (13) place of the 6th step appointment is called the private key of oneself and is decoded, if failure changeed for the 3rd step;
The 7th step decoded successfully, obtained extracting parameter, was transmitted to CA assembly (13), and log-on data is extracted;
The 8th step changeed for the 3rd step if CA assembly (13) extracts data failure; If success becomes specified format with the data encapsulation of extracting, turn back to the encrypting module (14) at this CA assembly (13) place;
The encrypting module (14) at the 9th this CA assembly (13) place of step calls the session key of DI assembly (5) transmission, encrypt, and the ciphertext after will encrypting is encrypted with the private key of oneself again, be back to the center encryption equipment (4) of DI assembly (5) end, the PKI that center encryption equipment (4) calls this CA assembly (13) is decrypted, and call session key ciphertext is decoded into expressly, be forwarded to DI assembly ((5));
The plaintext that the tenth step DI assembly (5) will receive writes Service Database according to the specific data form, interrupts connecting, and finishes;
Push away data type:
Centroid digital device end (3) starts DI assembly (5), the port of intercepting an appointment; If at the reportorial active connection request of this port discovery, then accept this request and receive the data that transmit, judge that whether these data have been that expressly if not, the center encryption equipment of calling is decoded, will expressly write Service Database with the predetermined data form;
Child node numeral equipment end (9) user starts DEC assembly (12), choose self-defining data, DEC assembly (12) will carry out data encapsulation automatically, call that encrypting module is encrypted and through the telephone number of monitored end modulator-demodulator (8) addressing Centroid digital device end (3), the encapsulation of data after will encrypting after connecting sends to Centroid digital device end particular port.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2008100392055A CN101321209B (en) | 2008-06-19 | 2008-06-19 | Safe communication distributed data extraction method and implementing system based on PSTN |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN2008100392055A CN101321209B (en) | 2008-06-19 | 2008-06-19 | Safe communication distributed data extraction method and implementing system based on PSTN |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN101321209A true CN101321209A (en) | 2008-12-10 |
| CN101321209B CN101321209B (en) | 2011-11-16 |
Family
ID=40181019
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN2008100392055A Active CN101321209B (en) | 2008-06-19 | 2008-06-19 | Safe communication distributed data extraction method and implementing system based on PSTN |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN101321209B (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102497581A (en) * | 2011-12-14 | 2012-06-13 | 广州杰赛科技股份有限公司 | Digital-certificate-based video monitoring data transmission method and system |
| CN101998223B (en) * | 2009-08-14 | 2014-09-10 | 郭佳 | Method and system for realizing distributed tag number book |
| CN106506672A (en) * | 2016-11-25 | 2017-03-15 | 江西金格科技股份有限公司 | The non-assembly access method of browser intelligent key disk |
| CN107210998A (en) * | 2014-11-11 | 2017-09-26 | 思科技术公司 | Use the adaptive bitrate system architecture of naming domain network |
| CN109582840A (en) * | 2018-10-17 | 2019-04-05 | 广州宏数科技有限公司 | Method, equipment, medium and system based on long-distance network real-time data collection |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO1999033224A1 (en) * | 1997-12-19 | 1999-07-01 | British Telecommunications Public Limited Company | Data communications |
| US6986046B1 (en) * | 2000-05-12 | 2006-01-10 | Groove Networks, Incorporated | Method and apparatus for managing secure collaborative transactions |
| CN100525175C (en) * | 2003-12-01 | 2009-08-05 | 海信集团有限公司 | Housing district communication encipher method based on broadband network |
| CN1707998A (en) * | 2005-04-28 | 2005-12-14 | 上海交通大学 | Safety control method based on information service public data exchange center |
-
2008
- 2008-06-19 CN CN2008100392055A patent/CN101321209B/en active Active
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101998223B (en) * | 2009-08-14 | 2014-09-10 | 郭佳 | Method and system for realizing distributed tag number book |
| CN102497581A (en) * | 2011-12-14 | 2012-06-13 | 广州杰赛科技股份有限公司 | Digital-certificate-based video monitoring data transmission method and system |
| CN102497581B (en) * | 2011-12-14 | 2014-06-25 | 广州杰赛科技股份有限公司 | Digital-certificate-based video monitoring data transmission method and system |
| CN107210998A (en) * | 2014-11-11 | 2017-09-26 | 思科技术公司 | Use the adaptive bitrate system architecture of naming domain network |
| CN107210998B (en) * | 2014-11-11 | 2020-08-14 | 思科技术公司 | Adaptive bit rate system architecture using name domain networks |
| CN106506672A (en) * | 2016-11-25 | 2017-03-15 | 江西金格科技股份有限公司 | The non-assembly access method of browser intelligent key disk |
| CN109582840A (en) * | 2018-10-17 | 2019-04-05 | 广州宏数科技有限公司 | Method, equipment, medium and system based on long-distance network real-time data collection |
| CN109582840B (en) * | 2018-10-17 | 2024-05-10 | 广州宏数科技有限公司 | Method, equipment, medium and system for collecting data in different places in real time based on Internet |
Also Published As
| Publication number | Publication date |
|---|---|
| CN101321209B (en) | 2011-11-16 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN101510877B (en) | Single-point logging-on method and system, communication apparatus | |
| KR101851261B1 (en) | Centralized remote metering system for security based on private block-chained data | |
| CN102647461B (en) | Communication means based on HTTP, server, terminal | |
| CN1708942B (en) | Secure implementation and utilization of device-specific security data | |
| KR101753859B1 (en) | Server and method for managing smart home environment thereby, method for joining smart home environment and method for connecting communication session with smart device | |
| CN110719203B (en) | Operation control method, device and equipment of intelligent household equipment and storage medium | |
| CN105162772A (en) | IoT equipment authentication and key agreement method and device | |
| EP2932428B1 (en) | Method of allowing establishment of a secure session between a device and a server | |
| CN104662870A (en) | Data security management system | |
| CN103248479A (en) | Cloud storage safety system, data protection method and data sharing method | |
| CN1977559B (en) | Method and system for protecting information exchanged during communication between users | |
| CN1973495A (en) | Device and process for wireless local area network association and correspondent product | |
| CN107483415B (en) | Bidirectional authentication method for shared electricity utilization interactive system | |
| CN1671099A (en) | Encryption key sharing scheme for automatically updating shared key | |
| US8230218B2 (en) | Mobile station authentication in tetra networks | |
| CN105681470A (en) | Communication method, server and terminal based on hypertext transfer protocol | |
| CN102595213A (en) | Security certificate method and system of credible TV terminal | |
| CN102572815A (en) | Method, system and device for processing terminal application request | |
| CN101321209B (en) | Safe communication distributed data extraction method and implementing system based on PSTN | |
| CN115473655B (en) | Terminal authentication method, device and storage medium for access network | |
| CN109962781B (en) | Digital certificate distributing device | |
| EP0018129B1 (en) | Method of providing security of data on a communication path | |
| CN107409043B (en) | Distributed processing of products based on centrally encrypted stored data | |
| US20230328047A1 (en) | Platform and Method for Automated Moving Target Defense | |
| CN113794563A (en) | Communication network security control method and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| PE01 | Entry into force of the registration of the contract for pledge of patent right | ||
| PE01 | Entry into force of the registration of the contract for pledge of patent right |
Denomination of invention: Distributed data extraction method and implementation system for secure communication based on PSTN Effective date of registration: 20210827 Granted publication date: 20111116 Pledgee: Pudong Shanghai technology financing Company limited by guarantee Pledgor: SHANGHAI SOFTLINE INFORMATION TECHNOLOGY Co.,Ltd. Registration number: Y2021310000057 |
|
| PC01 | Cancellation of the registration of the contract for pledge of patent right | ||
| PC01 | Cancellation of the registration of the contract for pledge of patent right |
Date of cancellation: 20220909 Granted publication date: 20111116 Pledgee: Pudong Shanghai technology financing Company limited by guarantee Pledgor: SHANGHAI SOFTLINE INFORMATION TECHNOLOGY Co.,Ltd. Registration number: Y2021310000057 |