RU2361366C1 - Method of guaranteed information transfer in heterogeneous computer network - Google Patents

Abstract

FIELD: information technologies.

SUBSTANCE: invention relates to computer engineering. According to the invention there are realised mechanisms of consistently interacting computing units in local network as well as in the entire computer network; interaction between finite applications is ensured through automatic queue formation; guaranteed messages delivery is secured by sending delivery receipt to node-sender; there is protected data storage for storing queues, messages and routing table set up on every computing unit; message body processing by indicating finite associated application number is guaranteed; authority of every official cleared for access to work with information resources is systematically checked; identification of every message is ensured using imbedded mechanism identifying officials over electronic digital signature thereby achieving juridical relevance of data exchange.

EFFECT: ensuring information transmission to designated users in heterogeneous computer network.

4 cl, 3 dwg

Description

FIELD OF THE INVENTION

The present invention relates to computer technology, and more particularly to a method for guaranteed bringing information to a heterogeneous computer network.

State of the art

The urgent task of electronic document management systems (EDMS) at the current stage of development of the information technology industry is the task of combining disparate remote information objects of the customer and officials at these objects into a single process for processing electronic documents to ensure manageability through (possibly even operational) document exchange. An even more important point in this kind of exchange is the guarantee of information interaction on a complex of disparate automation objects (and officials), which are also connected by heterogeneous, and often untrusted communication channels, if technical solutions for legally significant EDMS are implemented.

Currently, there are various ways of bringing information, including in a heterogeneous computer network.

So, in the patent of the Russian Federation No. 2130643 (publ. 05/20/1999) a method for providing access to data in the database management system "Linter-VS" is disclosed. In this method, in the process of processing an access request, several checks are made to compare the user admission rank with the access rank of the requested data.

In the patent of the Russian Federation No. 2289886 (publ. 20.12.2006); US patent No. 7177932 (publ. 13.02.2007) disclosed a method, a gateway and a system for transmitting data between a device in a public network and a device in the internal network. The internal network is connected to the public network through a gateway containing an exchange control unit that recognizes the destination of the data addressed to the public network based on the identifier included in the data.

US application No. 2007-0088958 (published on April 19, 2007) discloses a method of using electronic documents in which the ability to process a document depends on the rights of the user.

US patents No. 6237099 (publ. 05/22/2001) and 6622162 (publ. September 16, 2003) describe methods for delivering electronic documents on the network to different users.

In US patents No. 7263551 (publ. 08/28/2007) and 7213066 (publ. 05/01/2007) disclosed methods of network delivery of electronic documents to various devices.

In Japanese applications No. 2006-338213 (publ. 12/14/2006), 2006-197150 (publ. 07/27/2006), 2005-173656 (publ. 06/30/2005), 2004-252506 (publ. 09/09/2004), applications USA No. 2005-262243 (publ. 24.11.2005), 2004-212826 (publ. 28.10.2004), EPO application No. 1102472 (publ. 05.23.2001), international applications No. WO 2007/085768 (publ. 02.08. 2007), WO 03/054767 (publ. 03.07.2003) and WO 02/052769 (publ. 04.07.2002) disclose various methods of processing electronic documents in a heterogeneous network.

All these and many other documents solve particular problems of the delivery of electronic documents in a computer network. But there is no source among them that would suggest or at least imply a method of processing information in a heterogeneous computer network that would guarantee, i.e. reliably (with 100% probability) ensured the delivery of electronic documents to specific users.

SUMMARY OF THE INVENTION

Guaranteed delivery of electronic documents means the consistent interaction of four key guaranteed services related to data exchange operations in heterogeneous geographically distributed computer networks:

- delivery;

- storage;

- processing;

- identification of the official.

Guaranteed delivery determines the reception and transmission of arbitrary electronic documents (messages, files, documents) to any particular official of the computer network in selective and circular modes. Transport capabilities specify the addressing of automation objects with an extended semantic description of the names and ranks of officials (users), provide control over their actions and fulfill the principles of mandatory and discretionary access. Delivery guarantee is the corresponding receipt. The transmission is also provided with a transmission priority marker, which is a means of determining its effective throughput on the communication channel. In addition, it provides:

- almost 100% probability of transmission without distortion of a message of arbitrary volume (up to ~ 1 GB), including during interruptions in communication during the transmission of this message ("resume");

- the ability to address static and dynamic IP addresses;

- the time of establishing a connection and transmitting messages is not standardized and is determined only by the real transmission rate in the channel;

- automatic assignment of alternative data transmission routes;

- software switching of communication channels at the gateway node if there is hardware capability to assign an alternative transmission route.

Guaranteed storage ensures the availability of secure specialized storage at each workstation of an official (including authorized) person, which contains not only the entire queue of incoming and outgoing messages, but also confidential (including secret) documents. In the event of a communication channel rupture, unsent documents are returned to the queue with the automatic assignment of alternative data transmission routes. When sending large amounts of data, the "resume" of the unfinished part of the message is provided in order to optimize the channel load.

Guaranteed processing of the content of the message upon the fact of its routine processing is provided by sending the appropriate processing receipt to the sender.

Information exchange between objects of a computer network is carried out according to the scheme "each with each in duplex mode at the initiative of any subscriber." Support is provided for synchronous (“client-server”) and asynchronous (using queues) modes of data exchange between network subscribers with the ability to register incoming and outgoing messages, including based on the support of the packet switching mechanism.

This ensures the interaction of an arbitrary number of objects of a geographically distributed computer network based on the use of relevant methods of resource allocation and access, a modern information protection and coding system, providing the user with the maximum number of necessary web services for organizing management of both external and internal information space, using various mechanisms and arbitrary communication channels (digital, analog). In addition, the interaction of an arbitrary number of users of the system (officials) is ensured on the basis of a single mechanism for restricting access, as well as an arbitrary number of applied processes, ensuring the integrity of these processes.

Guaranteed identification of a computer network official is carried out on the basis of standardized PKI technology (Private Key Infrastructure) by automatically entering a public key certificate into the body of any outgoing message, as well as checking the certificates of all incoming messages. In addition, a mechanism may be used to encrypt the outgoing traffic of an official presenting his authority by means of a key pair with subsequent authentication by system-wide means of access control.

Thus, there is a need for a method of guaranteed transmission of information in a heterogeneous computer network to specific users.

This problem is solved by the claimed invention, which presents a method of guaranteed information transfer in a heterogeneous computer network formed by geographically distributed automation objects connected by an information exchange backbone into a single global computer network, and including at least two computing units connected by a communication network representing local and (or) global automation objects, at least one of which is equipped with different operations the ionic system, which consists in the following: installing system-wide software for each computing installation in order to obtain a unified secure backbone of information exchange between all computing installations of a heterogeneous computing network; provide for each computing installation a unified means of inter-machine information exchange that implement the physical connectivity of computing installations within a single protected highway of information exchange; provide, by means of inter-machine information exchange, uniform interaction both between computing facilities in a local computer network of an automation object included in a heterogeneous computer network, and between global automation objects within a heterogeneous computer network; reconfigure in each operating system all system interfaces for data exchange to the corresponding data exchange mechanisms of system-wide software; provide, using the means of inter-machine information exchange, the interaction between the end applications of computing facilities within a heterogeneous computing network by automatically creating a queue of outgoing and incoming messages for each end application; in accordance with a predetermined procedure, the body of each message to be exchanged on a single secure information exchange trunk is randomized to protect the contents of this message from unauthorized access; encapsulate in accordance with a predetermined procedure a randomized body of each outgoing message to be exchanged on a single secure information exchange backbone to ensure global routing within a heterogeneous computer network and process the specified message on the receiving node; provide guaranteed message delivery within a heterogeneous computer network by returning to the sending node a receipt for the delivery of the outgoing message to the receiving node; create a secure data warehouse on each computing installation, which is randomized according to the same principle as the message body; save the queues of outgoing and incoming messages to the address of the computing installation or a software application running on it and to the address of another computing installation of a heterogeneous computing network in a secure data warehouse of each computing installation; provide guaranteed storage of incoming and transit messages in a secure data warehouse until the completion of the guaranteed delivery process; save the message routing table within the heterogeneous computer network, as well as the identifier of each final software application operating in the context of system-wide software in a secure data warehouse of each computing installation; provide guaranteed processing of the message body by indicating the number of the final application handler with which the message body should be processed, and upon receipt of this processing, a processing confirmation is sent to the sending node; systematically check the credentials of each official who is allowed to work with the information resources of a heterogeneous computer network, and stop the session of a particular official if at least one parameter from the corresponding access profile stored in the secure data warehouse of the computing installation does not match; provide guaranteed identification of outgoing and (or) incoming or transit messages through the use of a built-in mechanism for identifying officials in a computer network based on an electronic digital signature, thereby achieving the legal significance of information exchange.

The peculiarity of this method is that the system-wide software is formed by adding each of the operating systems with a basic set of transport protocols designed for global three-level addressing of nodes and packet routing, as well as a set of application-level data exchange formats; provide the transit direction of information flows within a heterogeneous computer network due to the mechanisms of guaranteed storage of messages in secure data storages on the nodes of the specific transmission route, as well as the automatic assignment of an alternative transmission route in accordance with the routing table of each computing installation along the transmission route; provide the ability to transmit service messages, including execution instructions, allowing for remote actions within the global computer network; provide a uniform implementation of the data transmission system within the framework of a heterogeneous computer network, including in conditions of pronounced heterogeneity of software and hardware implementations of the network computing installations.

Another feature of this method is that the reconfiguration of the interfaces of each operating system for exchanging data with other computing settings of a heterogeneous computer network is carried out by redirecting information flows between computing settings and application tasks through the corresponding proxy connections available in the system-wide software tools to including application tasks of email clients; the reconfiguration of the interfaces of each operating system for the exchange of data between final software applications in this operating system is carried out by redirecting information flows between these software applications through the appropriate mechanisms of inter-task interaction available in the means of system-wide software; implement a mechanism for assigning priority to sending messages by automatically setting the "width" of the transmission channel with the ability to send messages with the lowest priority in the "background" mode; they implement a message switching mechanism, in which, depending on the “width” of the transmission channel, the minimum size of the minimum sending packets, which the original message is divided before sending, is automatically selected, as well as the mechanism of “sending” the unsent part of the message when a transmission channel fails.

Another feature of this method is that they record all the actions of officials engaged in local or global interactions within a heterogeneous computer network in the corresponding thematic magazines, which are flat tables stored in a secure data warehouse of system-wide software on each computing installation.

Brief Description of the Drawings

The invention is explained further in the detailed description with reference to the accompanying drawings.

Figure 1 represents the general canonical scheme for ensuring the interaction of various information resources of each personal computer, server, etc. with the provision of a unified exchange service with communication channels (KOM unit) in the method of the present invention.

Figure 2 shows the types of information interaction and their methods and mechanisms implemented in the method of the present invention.

Figure 3 shows the possible topology of computer networks with the appointment of alternative routing, presented in the present invention.

DETAILED DESCRIPTION OF THE INVENTION

General requirements for modern nuclear power plants, the failure of which can put an end to the development of any information system, relate, first of all, to the provision of reliable (guaranteed) information exchange on the created information infrastructure:

1) in terms of data exchange (physical connectivity):

- data of any type,

- arbitrary communication channels,

- arbitrary computing environment;

2) in terms of data unification (logical connectivity):

- single address space,

- unified / integrated classifiers,

- harmonized data formats;

3) the integration of “inherited” and relevant tasks of open source software through a single system-wide execution environment;

4) implementation of a unified security policy through common protection mechanisms;

5) centralized control of the computing process at the AS facilities.

General issues of the functioning of modern automated systems (AS) are often resolved in a cardinal way, affecting the very basis of the AS - its architecture. A three-level model of the organization of the computing process within the AS is being implemented with the introduction of the so-called functioning environment in the form of system-wide (system-forming) software (software), the basis of which is the so-called “middleware” software, often belonging to the category Message Oriented Middleware (MOM). The implementation of system-wide software can range from standardized application software that requires major modifications to application tasks, to a meta-application or network provider that provides interfaces for open source software. The tasks of a system-wide speaker environment are as follows:

- providing standard guaranteed services for data exchange and operational management of objects and processes in local and global networks of NPP facilities;

- ensuring guaranteed interaction of functional subsystems and AS objects, integration of open source software on the basis of a unified asynchronous data exchange model;

- ensuring controllability by a single computing process at the NPP objects on the basis of system-wide agreements regarding the addressing of NPP information objects, data formats, system events and scripts for their processing;

- ensuring the protection of information in the AS based on a single consistent security policy based on common mechanisms for access control, integrity control, coding;

- the availability of applied programming tools for solving the problems of adapting open source software in AS.

Here we take into account the notorious fact that far from everywhere there are stable communication channels, and it is not always possible to connect to a remote subscriber via digital dedicated channels. But, even with the usual connectivity options, a modern automated system is obliged to provide not only the collection and storage of information at the lower levels, but also the possibility of guaranteed communication of information, the ability to connect “mobile” users to the system within the framework of vested powers. Thus, the basis of the NPP uptime as a whole is the built-in guaranteed transmission mechanism, which includes guaranteed mechanisms for the transfer, storage and routine processing of information using the “single time” service and the guaranteed identification mechanism based on PKI technology (electronic digital signature - digital signature).

Everything said here about the system-wide environment is nothing more than an almost verbatim interpretation of the well-known principles of SOA - Service-Oriented Architecture (architecture for servicing requests), one of the modern views on the principles of building AS, which implement such a general concept as an integration platform, at the heart of which contains the mentioned system-wide software.

The peculiarities of such an architectural approach in creating speaker systems of an arbitrary nature include the fact that any technology that implies development at least 10 years in advance should emphasize that any revolutionary ideas and methods must necessarily allow them to be integrated into existing information systems exclusively in an evolutionary way. Otherwise, they can only mean another impasse in development. Note that system-wide tools are the most conservative in nature an AS object that is less susceptible to changes than an OS that functions logically “lower”. The system-wide software of the MOM class is not a simple application, it is a meta application (or service) that interacts with the OS based on closed exchange protocols, which creates a new entity - a composite multi-core product with a high degree of security, significantly higher than the security class of the OS itself.

In addition, having at its disposal numerous mechanisms and ways of adapting the capabilities of specific applications to system-wide requirements, the integration platform is a means of involving any relevant “legacy” software that the customer needs in the AS. The main advantages of solving AC tasks on the basis of an integration platform are the following:

- unification of the AS hardware and software environment at the system level;

- unification of the execution environment at the level of system calls;

- Integration of heterogeneous software and hardware platforms;

- single address space of the superimposed network;

- Creation of a universal transport highway with dynamic routing and translation of protocols;

- portability of application software, including “legacy” software;

- service of a single time line, fixing system events;

- ensuring access control and integrity control based on common protection methods;

- condition monitoring and control control at the hardware level and execution level.

Figure 1 shows the so-called canonical diagram of the implementation of the computational process at each workplace (PC, server, etc.), when all the information exchange at the data level goes along standardized “joints” (ODBC, XML, etc.), and at the level of communication channels it is implemented by system-wide means (KOM unit) with the necessary access control to the communication channel (OBI unit). Designations in figure 1: COM - the so-called "transport switch", i.e. a set of procedures responsible for the operation of a communication channel at the level of the exchange protocol; OBI - a set of tools that fixes application processes accessing system resources and confirms or denies access, З _i - i-th task (i = 1,2, ..., n), API UP - a set of API functions of the kernel of system-wide tools (Application Program Interface Universal Platform - application programming interface of the universal platform), OS API - a set of API functions of the kernel of system tools (operating system - OS), CPU - central processor, RAM - RAM, HDD - hard disk drive, I / O - means input / output, TCP / IP IPX / SPX SOD / SPD - transport layer protocols according to the OSI / ISO model, ODBC XML - standard e interaction interfaces in information systems (Open DataBase Connectivity - an open interface to access databases and extensible Markup Language - Extensible Markup Language).

The system-wide tasks of operating the AS assigned to the integration platform and system-wide tools include, first of all, the tasks of exchanging data between network subscribers. These include:

- exchange of documents, messages, files between AS subscribers with the ability to encode data if processing is carried out using various OSs, including with automatic recognition of formats and the launch of processing programs on the receiving side (remote control actions);

- data exchange in its own view (for applications registered in the AS environment), as well as in the XML representation;

- modes of selective and circular delivery of information to subscribers;

- guaranteed communication of information to subscribers upon failure / restoration of communication channels, automatic assignment of alternative data transmission routes;

- automatic acknowledgment of the fact of bringing the information to the processing task at the recipient workstation, the ability to send notifications to the source after completing the data processing cycle on the receiving side;

- support for synchronous (“client-server”) and asynchronous (using queues) modes of data exchange between subscribers;

- Setting addressing and maintaining a directory of addresses;

- Logging of incoming and outgoing messages;

- the ability to change the composition of interacting subscribers during reconfiguration of the system in the case of inclusion (shutdown) of new objects in the AS;

- The ability to address static and dynamic IP addresses.

System-wide tools are a modular system consisting of a compact, reliable kernel and tasks (utilities) that function in its context. They are divided into subsystems according to the type of tasks they perform for speakers.

- Data transmission subsystem. Means of asynchronous guaranteed delivery of encapsulated messages in a heterogeneous geographically distributed AS. Dynamic routing Protocol translation.

- Subsystem of integration. Logical connectivity tools for various TCPs (software and hardware), including: MS Windows NT / 2000 / XP / 2003 / CE, Linux, MacOS, OS / 2, VM / ESA, Sun Solaris. Computing process control in a heterogeneous AS environment.

- Storage subsystem. Means of guaranteed storage of information in a secure storage on each computing installation.

- Security subsystem. Means of delimiting access to information resources of speakers based on the identification and authentication of users (including digital signatures), as well as monitoring the integrity of the computing process of speakers. Integration with perimeter protection.

- Subsystem of data presentation. Web-based distributed data warehouse, search tools and access to heterogeneous speaker information. Semantic and statistical analysis. Resource management.

- The subsystem of remote monitoring and control of the functioning of AS clients based on the provision of remote influences. GIS representation (GIS - geo-information system, i.e. representation of distributed data positioned on a background map).

- Universal API set. Tools for rapid application development.

The integration platform is a developing system; in the future, the platform subsystems can change and expand the platform's functionality in the direction of the tasks put forward by the customer when building the AS.

System-wide tools that provide the possibility of guaranteed communication of information in geographically distributed heterogeneous networks provide ample opportunities in providing various kinds of interactions within the AU.

- User-User

using the built-in means of inter-machine exchange based on the organizational structure of the NPP facility (officials) within the framework of vested powers;

- Object-Object

by means of inter-object exchange based on hierarchical subordination (3 levels) of NPP facilities and facility officials within the framework of vested powers;

- Data-Data

with the help of virtual "data marts" and means of intermediate storage based on the created information exchange infrastructure (users, objects) and system-wide agreements on the presentation of data;

- Application-Application

using queues of incoming / outgoing messages for each application, documents, information exchange regulations, ordered data in XML format, as well as the ability to provide remote effects on the created information exchange infrastructure (users, objects, storefronts).

To ensure automation at the NPP facilities, a process language is developed on the basis of which the processes of passing documents and messages to the NP are formalized. The concepts of system events necessary for building process chains, scripts for processing certain events at branch points are determined. Thus, system-wide agreements are developed in terms of system events and regulations that allow you to close the processing circle with the following type of interaction.

- Process-Process

using queues of associated processes for each application, formalized rules for information exchange, ordered data, as well as the possibility of working out scenarios on the created information exchange infrastructure (users, objects, showcases, applications).

These interactions, as well as the methods and mechanisms necessary for the implementation of these interactions, are shown in figure 2, where it is indicated: П-П - user-user (actions 1-4), О-О - object-object (actions 5-8 ), D-D - data-data (actions 9-11), Pr-Pr - application-application (actions 12-15), Prots-Prots - process-process of action 16-18); DL-DL - ... (actions 19-21).

Thus, it becomes possible to carry out large-scale information projects using arbitrary automation objects available to the customer. Moreover, it becomes possible to expand the functionality of such ASs by expanding the topology of computer networks: from classical topologies of the “star” type, through the actual topology of a “double” or “hierarchical” star, to network-like solutions using all the capabilities of the information infrastructure.

This is shown in FIG.

The present invention implements all of the above in a heterogeneous computer network, which is formed by geographically distributed automation objects connected by a data exchange backbone into a single global computer network. A heterogeneous computer network includes at least two computer facilities connected by a communication network, which are local and (or) global automation objects, at least one of which is equipped with a different operating system. In this heterogeneous computer network, the following actions are performed.

For each computing installation, system-wide software (OPO) is installed to obtain a single secure backbone of information exchange between all computing installations in a heterogeneous computer network. An example of such an HOP is IBM Corp. (WebSphere (CICS, MQ Series etc.)), Microsoft Corp. (Windows (MSMQ), BizTalk Server etc.), Computer Associates (Unicenter), SAP AG (NetWeaver), TIBCO Software (Rendezvous), Oracle Corp. (OTC, OO4O, Fusion Middleware), BEA Systems (WebLogic Enterprise Platform), Sun Microsystems (Java Composite Application Platform Suite (CAPS)), ZAO IVK (IVK Jupiter).

This system-wide software is formed, in particular, by adding each operating system with a basic set of transport protocols designed for global node addressing and packet routing, as well as a set of application-level data exchange formats.

Each computing installation provides unified unified means of inter-machine information exchange that implement the physical connectivity of computing installations within a single protected highway of information exchange. Using these means of inter-machine information exchange, uniform interaction is ensured both between computing facilities in a local computer network of an automation object that is part of a heterogeneous computer network, and between global automation objects within a heterogeneous computer network. At the same time, in each operating system, all system interfaces for data exchange are reconfigured to the corresponding data exchange mechanisms of system-wide software. Such a reconfiguration of the interfaces of each operating system for exchanging data with other computing facilities in a heterogeneous computing network is carried out, for example, by redirecting information flows between computing facilities and application tasks through the corresponding proxy connections available in the system-wide software, including such applied tasks like standard email clients. The reconfiguration of the interfaces of each operating system for the exchange of data between final software applications in this operating system is carried out by redirecting information flows between these software applications through the appropriate mechanisms of inter-task interaction available in the means of system-wide software.

Using the means of inter-machine information exchange, they provide interaction between end applications of computing facilities within a heterogeneous computing network by automatically creating a queue of outgoing and incoming messages for each end application. In this case, the body of each message to be exchanged on a single secure trunk of information exchange is randomized in accordance with a predetermined procedure to ensure that the contents of this message are protected from unauthorized access. As such a procedure, you can specify, for example, the procedure for subscriber traffic encryption on symmetric keys.

In accordance with this predetermined procedure, a randomized body of each outgoing message to be exchanged over a single secure information exchange trunk is encapsulated to ensure global routing within a heterogeneous computer network and to process the specified message on the receiving node. Guaranteed message delivery within a heterogeneous computer network is provided by returning to the sending node a receipt for the delivery of the outgoing message to the receiving node.

When sending a message, a priority assignment mechanism is implemented by automatically setting the "width" of the transmission channel with the ability to send messages with the lowest priority in the "background" mode. In this case, a message switching mechanism is implemented, in which, depending on the “width” of the transmission channel, the minimum size of the minimum send packets, into which the original message is divided before sending, is automatically selected, as well as the mechanism of “sending” the unsent part of the message when a transmission channel fails.

Each computing installation creates a secure data warehouse, which is randomized according to the same principle as the message body. In this secure data warehouse of each computing installation, the queues of outgoing and incoming messages are stored both to the address of the computing installation or the software application running on it, and to the address of another computing installation of a heterogeneous computing network. The secure data warehouse provides guaranteed storage of incoming and transit messages until the completion of the guaranteed delivery process. In addition, the message routing table within the heterogeneous computing network, as well as the identifier of each final software application operating in the context of system-wide software, is stored in a secure data warehouse of each computing installation.

At the same time, in a heterogeneous computer network, the flow of information flows is ensured through the mechanisms of guaranteed storage of messages in secure data storages on the nodes of the specific transmission route, as well as the automatic assignment of an alternative transmission route in accordance with the routing table of each computing installation along the transmission route. In addition, this makes it possible to transmit service messages, including execution instructions, allowing for remote actions within the global computer network. This ensures a uniform implementation of the data transmission system within the framework of a heterogeneous computer network, including in conditions of pronounced heterogeneity of software and hardware implementations of the network computing installations.

Further, the guaranteed processing of the message body is provided by indicating the number of the final application handler with which the message body should be processed, and upon receipt of this processing, a processing confirmation is sent to the sending node. This is another mechanism for guaranteed communication of information.

The network systematically checks the credentials of each official who is allowed to work with the information resources of a heterogeneous computer network and stops the session of a particular official if at least one parameter from the corresponding access profile stored in the protected data warehouse of the computing installation does not match. At the same time, all actions of officials engaged in local or global interactions within a heterogeneous computer network are recorded in the relevant thematic magazines, which are flat tables stored in a secure data warehouse of system-wide software on each computer installation.

Finally, the network provides guaranteed identification of outgoing and (or) incoming or transit messages through the use of a built-in mechanism for identifying officials in a computer network based on an electronic digital signature, thereby achieving the legal significance of information exchange.

Thus, thanks to the proposed method, a guaranteed (with 100% probability) delivery of electronic documents to specific users is provided. One of the main decisions on the creation of information technology support for nuclear power plants, including on the basis of the above mechanisms, is the decision on its architecture. Creating AS on a three-tier architecture using products of the “middle layer” that implement the system-wide functions of the AS allows you to solve all the issues of the joint functioning of heterogeneous information resources based on the full implementation of guaranteed communication of information in modern automated computer networks.

In the present description, the present invention is disclosed by way of examples of its possible implementation. However, these examples are illustrative only and not limiting, and the scope of the invention is defined by the appended claims taking into account any possible equivalents.

Claims (4)

1. A method of guaranteed information transfer in a heterogeneous computer network formed by geographically distributed automation objects connected by an information exchange backbone into a single global computer network, and including at least two computing units connected by a communication network, which are local and (or) global automation objects, at least one of which is equipped with a different operating system than the others, which consists in the fact that:
install system-wide software for each computing installation to obtain a single secure backbone of information exchange between all the computing installations of the aforementioned heterogeneous computer network;
provide for each computing installation a unified means of inter-machine information exchange that implement the physical connectivity of the mentioned computing installations within the framework of the aforementioned unified secure information exchange trunk;
by means of the said means of inter-machine information exchange, provide uniform interaction both between computing facilities in the local computer network of an automation object included in said heterogeneous computer network, and between global automation objects within the framework of said heterogeneous computer network;
reconfigure in each operating system all system interfaces for exchanging data with the corresponding data exchange mechanisms of the aforementioned system-wide software;
using the above-mentioned means of inter-machine information exchange, provide interaction between the end-applications of computing facilities within the framework of the said heterogeneous computing network by automatically creating a queue of outgoing and incoming messages for each of the said end-applications;
in accordance with a predetermined procedure, the body of each message to be exchanged along the aforementioned single secure information exchange trunk is randomized in order to protect the contents of this message from unauthorized access;
encapsulate, in accordance with a predetermined procedure, a randomized body of each outgoing message to be exchanged along the aforementioned unified secure information exchange backbone to ensure global routing within the framework of the aforementioned heterogeneous computer network and process the specified message on the receiving node;
provide guaranteed message delivery within the aforementioned heterogeneous computer network by returning to the sending node a receipt for the delivery of the outgoing message to the receiving node;
create on each of the mentioned computing installation a secure data warehouse, which is randomized according to the same principle as the message body;
storing queues of outgoing and incoming messages in said secure data store of each said computing installation both to the address of said computing installation or a software application running on it and to another computing installation of said inhomogeneous computing network;
provide guaranteed storage of incoming and transit messages in said secure data warehouse until the completion of the guaranteed delivery process;
storing in said secure data storage of each said computing installation a message routing table within said heterogeneous computing network, as well as an identifier of each final software application operating in the context of said system-wide software;
provide guaranteed processing of the message body by indicating the number of the final application handler with which the message body should be processed, and upon receipt of this processing, a processing confirmation is sent to the sending node;
systematically check the credentials of each official authorized to work with the information resources of the said heterogeneous computer network, and stop the session of a particular official if at least one parameter from the corresponding access profile stored in the secure data warehouse of the said computing installation does not match;
provide guaranteed identification of outgoing, and (or) incoming, or transit messages through the use of a built-in mechanism for identifying officials in a computer network based on an electronic digital signature, thereby achieving the legal significance of information exchange. 2. The method according to claim 1, in which:
form the aforementioned system-wide software by adding each of the mentioned operating systems with a basic set of transport protocols designed for global node addressing and packet routing, as well as a set of application-level data exchange formats;
provide the transit direction of information flows within the aforementioned heterogeneous computer network due to the mechanisms of guaranteed storage of messages in secure data storages on the nodes of the specific transmission route, as well as the automatic assignment of an alternative transmission route in accordance with the routing table of each of the computing installations along the transmission route;
provide the ability to transmit service messages, including execution instructions, allowing remote actions within the framework of the aforementioned global computer network;
provide a uniform implementation of the data transmission system within the framework of the aforementioned heterogeneous computer network, including in conditions of pronounced heterogeneity of software and hardware implementations of the aforementioned computing network settings. 3. The method according to claim 1, in which:
said reconfiguration of the interfaces of each operating system for exchanging data with other computing facilities of the aforementioned heterogeneous computing network is carried out by redirecting information flows between computing facilities and application tasks through the corresponding proxy connections available in the means of the aforementioned system-wide software, including such application tasks, as standard email clients;
the mentioned reconfiguration of the interfaces of each operating system for exchanging data between end software applications in this operating system is carried out by redirecting information flows between these software applications through the appropriate mechanisms of inter-task interaction available in the means of the aforementioned system-wide software;
implement a mechanism for assigning priority to sending messages by automatically setting the "width" of the transmission channel with the ability to send messages with the lowest priority in the "background"mode;
they implement a message switching mechanism, in which, depending on the “width” of the transmission channel, the minimum size of the minimum sending packets, which the original message is divided before sending, is automatically selected, as well as the mechanism of “sending” the unsent part of the message when a transmission channel fails. 4. The method according to claim 1, in which:
record all actions of officials carrying out local or global interactions within the framework of the heterogeneous computer network mentioned in the relevant thematic journals, which are flat tables stored in the aforementioned secure data warehouse of system-wide software for each computer installation mentioned.

Images