TCP connection separation with complete semantic, control method and system

Abstract

The invention relates to a method for ensuring semantic integrity for the isolation and control of TCP connection and a system thereof, which pertains to the field of information safety. After TCP processing step after the modification of the method of the invention ensures that an SYN message is received, the information of the characteristics of the message is notified to another network processing unit; the SYN message is regenerated and sent to a network by another network processing unit; after another network processing unit receives an ACK, a protocol stack generates a corresponding message. The system of the invention comprises a TCP handshake processing module, a TCP connecting and checking module, an application-layer data checking module, an application-layer protocol processing module and a safe data switching channel module. The method and system of the invention can not only isolate the TCP connection between an internal network and an external network and carry out application-layer data switching, but also can ensure the semantic integrity of the TCP and the situation that a server is closed, but a client still can establish the TCP connection cannot occur.

Description

technical field [0001] The invention relates to a method and system in the technical field of network information security, in particular to a method and system for isolating and controlling TCP connections with complete semantics. Background technique [0002] With the development of information technology and network interconnection technology, network and information security issues have become increasingly prominent. Due to the continuous improvement and development of network attack methods and hacking techniques, ordinary network security products cannot meet the security requirements of important networks and data. For users with high-level network security requirements such as finance, government and scientific research institutions, they often establish a dedicated internal network, which is physically or logically isolated from the public network. This brings inconvenience to information exchange between different trust domains, and various isolation technologies ...

AI Technical Summary

Problems solved by technology

The present invention solves the problem that the above-mentioned network security isolation system cannot guarantee the semantic integrity of the TCP connection, can support various network applications based on the TCP protocol, and presents the TCP connection characteristics consistent with the connection and data exchange permission to the client, that is, if it can establish TCP connection can complete data exchange based on TCP

Images