Shelter hospital network security protection system, method and device

Abstract

The invention discloses a shelter hospital network security protection system, method and device, and relates to the technical field of medical networks, and the system comprises a shelter hospital processing module, a cloud platform and a remote receiving aggregation gateway device. The shelter hospital processing module comprises a source data acquisition module and shelter hospital aggregation gateway equipment; the shelter hospital aggregation gateway equipment and the remote receiving aggregation gateway equipment form a three-layer wide area network; the cloud platform is used for transmitting to-be-transmitted data of the shelter hospital to the remote receiving aggregation gateway device, the cloud platform comprises a plurality of service nodes, and the service nodes communicate through a plurality of heterogeneous physical links; during data transmission, the shelter hospital aggregation gateway device determines an optimal transmission link from the cloud platform, and the optimal transmission link is dynamically updated. The shelter hospital network can be quickly deployed, transmission data loss is reduced, and the service quality of the shelter hospital network is improved.

Description

Technical Field

[0001] The present invention relates to the field of medical network technology, and in particular to a network security protection system, method and device for a shelter hospital. Background Art

[0002] This section is intended to provide a background or context to the embodiments of the invention recited in the claims. No admission is made that the description herein is prior art by inclusion in this section.

[0003] The network construction of Fangcang Cabin Hospital generally includes service function construction, network security measures, equipment hardware construction, operation and maintenance management, etc., among which service function construction generally includes electronic medical record system, video financial control, medical equipment data processing, etc.

[0004] The Fangcang Hospital network has high requirements for security, stability, reliability, manageability, bandwidth and transmission speed. First, the Fangcang Hospital deployment address is not fixed, and generally requires network operators to establish a dedicated network line, but this takes a long time, resulting in slow deployment of Fangcang Hospitals. Secondly, Fangcang Hospitals require a large bandwidth network environment to facilitate the processing of large amounts of medical data. However, due to the short deployment cycle of Fangcang Hospitals and the slow establishment of dedicated network lines, it is easy to lose transmission data. At the same time, many tasks in Fangcang Hospitals require remote medical collaborative processing, such as real-time video conferencing, data sharing and remote diagnosis between medical staff in multiple cities far apart. These tasks have put forward high requirements for network stability, reliability and manageability. However, the existing Fangcang Hospital network service quality is low and it is difficult to meet actual needs.

[0005] In summary, the existing network deployment of Fangcang Cabin Hospitals requires dedicated network lines, is difficult to deploy, has data loss problems in data transmission, and has low network service quality. Summary of the invention

[0006] The embodiment of the present invention provides a network security protection system for a shelter hospital, which is used to realize rapid deployment of a shelter hospital network, reduce transmission data loss, and improve the network service quality of the shelter hospital. The system includes: a shelter hospital processing module, a cloud platform, and a remote receiving aggregation gateway device;

[0007] The Fangcang hospital processing module includes a source data acquisition module and a Fangcang hospital aggregation gateway device; the Fangcang hospital aggregation gateway device and the remote receiving aggregation gateway device form a three-layer wide area network;

[0008] The cloud platform is used to transmit the data to be transmitted from the Fangcang Hospital to the remote receiving aggregation gateway device. The cloud platform includes multiple service nodes, and each service node communicates through multiple heterogeneous physical links;

[0009] The source data acquisition module is used to: acquire multiple types of data to be transmitted, and transmit the data to be transmitted to the Cabin Hospital aggregation gateway device; wherein the network transmission requirements are configured in advance for each type of data to be transmitted; the data to be transmitted carries a type identifier; and the network transmission requirements reflect the requirements for multiple network transmission parameters;

[0010] The Fangcang Cabin Hospital aggregation gateway device is used to: receive data to be transmitted; according to the type identifier of the data to be transmitted, parse and obtain the network transmission requirements pre-configured for the data to be transmitted; obtain the network transmission parameters of the heterogeneous physical links of the cloud platform; determine the best transmission link according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform, wherein the best transmission link includes multiple designated service nodes and the best transmission link is dynamically updated; transmit the data to be transmitted to the cloud platform, so that the cloud platform: uses the best transmission link to transmit the data to be transmitted to the remote receiving aggregation gateway device.

[0011] The embodiment of the present invention provides a method for protecting the network security of a shelter hospital, which is used to achieve rapid deployment of the shelter hospital network, reduce transmission data loss, and improve the network service quality of the shelter hospital. The method includes:

[0012] Acquire multiple types of data to be transmitted in the Fangcang Cabin Hospital; wherein, the network transmission requirements are configured in advance for each type of data to be transmitted; the data to be transmitted carries a type identifier; and the network transmission requirements reflect requirements for multiple network transmission parameters;

[0013] According to the type identifier of the data to be transmitted, parsing obtains the network transmission requirement pre-configured for the data to be transmitted;

[0014] Obtain network transmission parameters of heterogeneous physical links of the cloud platform;

[0015] Determine an optimal transmission link according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform; the optimal transmission link includes multiple designated service nodes, and the optimal transmission link is dynamically updated;

[0016] The data to be transmitted is transmitted to the cloud platform through the best transmission link, so that the cloud platform: uses the best transmission link to transmit the data to be transmitted to the remote receiving aggregation gateway device, so that the remote receiving aggregation gateway device: obtains and processes the data to be transmitted.

[0017] The embodiment of the present invention also provides a network security protection device for a shelter hospital, which is used to realize rapid deployment of the shelter hospital network, reduce transmission data loss, and improve the network service quality of the shelter hospital. The device includes:

[0018] A data acquisition module is used to acquire the data to be transmitted in the square cabin hospital; wherein the network transmission requirements are configured in advance for each type of data to be transmitted; the data to be transmitted carries a type identifier; and the network transmission requirements reflect the requirements for multiple network transmission parameters;

[0019] A data parsing module, used to parse, according to the type identifier of the data to be transmitted, the network transmission requirements pre-configured for the data to be transmitted;

[0020] The cloud platform communication module is used to obtain the network transmission parameters of the heterogeneous physical links of the cloud platform;

[0021] The transmission processing module is used to determine the best transmission link according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform; the best transmission link includes multiple designated service nodes, and the best transmission link is dynamically updated; the data to be transmitted is transmitted to the cloud platform, so that the cloud platform: uses the best transmission link to transmit the data to be transmitted to the remote receiving aggregation gateway device, so that the remote receiving aggregation gateway device: obtains and processes the data to be transmitted.

[0022] An embodiment of the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned method for protecting the network security of a square cabin hospital when executing the computer program.

[0023] An embodiment of the present invention also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned method for protecting the network security of the square cabin hospital is implemented.

[0024] An embodiment of the present invention also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the above-mentioned network security protection method for the square cabin hospital.

[0025] In the embodiment of the present invention, the network security protection system of the square cabin hospital includes: a square cabin hospital processing module, a cloud platform and a remote receiving aggregation gateway device; the square cabin hospital processing module includes a source data acquisition module and a square cabin hospital aggregation gateway device; the square cabin hospital aggregation gateway device and the remote receiving aggregation gateway device form a three-layer wide area network; the cloud platform is used to transmit the to-be-transmitted data of the square cabin hospital to the remote receiving aggregation gateway device, and the cloud platform includes multiple service nodes, each service node communicates through multiple heterogeneous physical links; wherein the source data acquisition module is used to: obtain multiple types of to-be-transmitted data, and transmit the to-be-transmitted data to the square cabin hospital aggregation gateway device; wherein the network transmission requirements are pre-configured for each type of to-be-transmitted data; the to-be-transmitted data The data carries a type identifier; the network transmission requirements reflect the requirements for multiple network transmission parameters; the Fangcang hospital aggregation gateway device is used to: receive the data to be transmitted; according to the type identifier of the data to be transmitted, parse and obtain the network transmission requirements pre-configured for the data to be transmitted; obtain the network transmission parameters of the heterogeneous physical links of the cloud platform; according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform, determine the best transmission link, the best transmission link includes multiple designated service nodes, and the best transmission link is dynamically updated; transmit the data to be transmitted to the cloud platform, so that the cloud platform: uses the best transmission link to transmit the data to be transmitted to the remote receiving aggregation gateway device. In the embodiment of the present invention, the network security protection system of the cabin hospital is based on cloud platform data transmission. The cloud platform includes multiple service nodes, and each service node communicates through multiple heterogeneous physical links. That is, the network security protection system of the cabin hospital in the embodiment of the present invention can use various heterogeneous physical links to transmit data, without the need for operator dedicated line communication, and can achieve rapid deployment; at the same time, the cabin hospital aggregation gateway device and the remote receiving aggregation gateway device of the cabin hospital network security protection system in the embodiment of the present invention form a three-layer wide area network. The cabin hospital aggregation gateway device can determine an optimal transmission link from the cloud platform. This optimal transmission link can also be dynamically updated. When updating, it can be updated according to the real-time network transmission parameters of the heterogeneous physical links of the cloud platform, thereby improving the reliability and stability of data transmission, reducing the loss of transmission data, and being particularly suitable for delay-sensitive medical environments, greatly improving the network service quality of the cabin hospital.

[0026] The network security protection method of the square cabin hospital in the embodiment of the present invention includes: obtaining multiple types of data to be transmitted in the square cabin hospital; wherein, network transmission requirements are pre-configured for each type of data to be transmitted; the data to be transmitted carries a type identifier; the network transmission requirements reflect requirements for multiple network transmission parameters; according to the type identifier of the data to be transmitted, parsing to obtain the network transmission requirements pre-configured for the data to be transmitted; obtaining the network transmission parameters of the heterogeneous physical links of the cloud platform; determining the optimal transmission link according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform; the optimal transmission link includes multiple designated service nodes, and the optimal transmission link is dynamically updated; transmitting the data to be transmitted to the cloud platform through the optimal transmission link, so that the cloud platform: uses the optimal transmission link to transmit the data to be transmitted to the remote receiving aggregation gateway device, so that the remote receiving aggregation gateway device: obtains and processes the data to be transmitted. In the embodiment of the present invention, the network security protection method for the cabin hospital is based on cloud platform data transmission. The cloud platform includes multiple service nodes, and each service node communicates through multiple heterogeneous physical links. That is, the data to be transmitted in the cabin hospital in the embodiment of the present invention can be transmitted using various heterogeneous physical links, without the need for operator dedicated line communication, and rapid deployment of the cabin hospital network can be achieved; at the same time, in the embodiment of the present invention, an optimal transmission link is determined based on the cloud platform, and this optimal transmission link can also be dynamically updated. When updating, it can be updated according to the real-time network transmission parameters of the heterogeneous physical links of the cloud platform, thereby improving the reliability and stability of data transmission, reducing the loss of transmission data, and being particularly suitable for delay-sensitive medical environments, greatly improving the network service quality of the cabin hospital. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0028] Figure 1 This is a schematic diagram of a network security protection system for a shelter hospital in an embodiment of the present invention;

[0029] Figure 2 This is a specific embodiment of the processing module of the Cabin Hospital in the embodiment of the present invention;

[0030] Figure 3 This is another specific embodiment of the processing module of the square cabin hospital in the embodiment of the present invention;

[0031] Figure 4 This is a flow chart of a network security protection method for a shelter hospital in an embodiment of the present invention;

[0032] Figure 5 Schematic diagram of a network security protection device for a shelter hospital in an embodiment of the present invention. DETAILED DESCRIPTION

[0033] To make the purpose, technical solution and advantages of the embodiments of the present invention more clear, the embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0034] The acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0035] The existing network deployment of Fangcang Cabin Hospitals requires a dedicated network line, which is difficult to deploy. There are also problems with data loss in data transmission, and the network service quality is low.

[0036] The embodiment of the present invention proposes a network security protection system for square cabin hospitals. Figure 1 Schematic diagram of a network security protection system for a shelter hospital in an embodiment of the present invention. Figure 1 As shown, the system includes a square cabin hospital processing module, a cloud platform and a remote receiving and processing module;

[0037] The Fangcang hospital processing module at least includes a source data acquisition module and a Fangcang hospital aggregation gateway device; the remote receiving processing module at least includes a remote receiving aggregation gateway device;

[0038] The cloud platform is used to transmit the data to be transmitted in the square cabin hospital to the remote receiving aggregation gateway device. The cloud platform includes multiple service nodes, and each service node communicates through multiple heterogeneous physical links.

[0039] In the embodiment of the present invention, a network aggregation gateway device is used to realize a wide area self-organizing network. Specifically, the square cabin hospital aggregation gateway device and the remote receiving aggregation gateway device form a three-layer wide area network.

[0040] In the embodiment of the present invention, the aggregation gateway device is used as SASE (Secure Access Service Edge) to connect the edge and cloud of the Fangcang Hospital, and use a variety of heterogeneous physical links to achieve data transmission in Fangcang Hospital. The heterogeneous physical links include but are not limited to one or any combination of the following: satellite signals, wired networks, 3G, 4G, 5G, and wireless networks. Fangcang Hospital can use the existing basic network around it, such as one or any combination of heterogeneous physical links to quickly deploy the network, integrate bandwidth, stabilize traffic, and reduce link deterioration, so as to meet the Fangcang Hospital's requirements for rapid construction, stability, reliability, and security.

[0041] The source data acquisition module in the embodiment of the present invention may include but is not limited to the following source data acquisition devices: monitoring cameras, servers, computers, switches, electrical monitoring equipment, gas detection equipment, and medical equipment such as ventilators and monitors.

[0042] The source data acquisition module is used to acquire various types of data to be transmitted and transmit the data to be transmitted to the Fangcang Hospital aggregation gateway device. The types can be classified according to the type of source data acquisition device, or according to data function, acquisition occasion, etc.

[0043] In one embodiment, the type identification of the data to be transmitted includes: a plurality of different network segment information; wherein different network segments are pre-configured for source data acquisition devices in different application scenarios in the square cabin hospital; the application scenarios include one or any combination of the following:

[0044] Pharmacy area, infectious disease ward area, surgical ward area, emergency area, testing area, medical consultation area, and computer room area.

[0045] Figure 2 This is a specific embodiment of the processing module of the Cabin Hospital in the embodiment of the present invention. Figure 2 Only a small number of application scenarios are used as examples. For example, the data collected from the pharmacy area and the infectious ward area is configured as the medical network segment, and the data collected from the infrastructure operation monitoring area is configured as the infrastructure network segment. All data are first aggregated into a data cabin, which has core switches, core servers, network firewalls, wireless base stations, etc. All data to be transmitted are transferred from the data cabin to the aggregation gateway device of the Cabin Hospital.

[0046] In an embodiment of the present invention, network transmission requirements are pre-configured for each type of data to be transmitted, and the network transmission requirements reflect the requirements for multiple network transmission parameters. The types of data to be transmitted can be divided into medical data and infrastructure data, wherein the types of data to be transmitted can also be divided into the forms of images, voices, documents, etc. Specifically, the following network transmission parameter requirements can be set for each type of data: the number of redundant copies of data, whether to actively retransmit, whether to turn on FEC (Forward error correction), whether to adapt, whether to delay sensitive, whether to retransmit in segments, minimum and maximum jitter, packet loss, single-stream average bit rate, etc. During implementation, users can also be allowed to customize network transmission requirements for specific departments or occasions.

[0047] For example, in low-latency sensitive surgical scenarios, priority is given to using links with reliable bandwidth and the lowest latency to send data, and other links are used as backup links. When the backup link bandwidth still has redundancy, redundant copies of low-latency sensitive data are sent, and FEC error correction is enabled. For general departments, the adaptive option can be used to reasonably calculate the real-time link bandwidth and reasonably allocate the link bandwidth.

[0048] The Fangcang Cabin Hospital aggregation gateway device is used to: receive data to be transmitted; according to the type identifier of the data to be transmitted, parse and obtain the network transmission requirements pre-configured for the data to be transmitted; obtain the network transmission parameters of the heterogeneous physical links of the cloud platform; determine the best transmission link according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform, wherein the best transmission link includes multiple designated service nodes and the best transmission link is dynamically updated; transmit the data to be transmitted to the cloud platform, so that the cloud platform: uses the best transmission link to transmit the data to be transmitted to the remote receiving aggregation gateway device.

[0049] During implementation, a main server and multiple servers can be set up in the square cabin hospital to be responsible for network transmission and scheduling, and the network transmission requirements of various types of data can be stored in a designated server. After parsing and obtaining the type identifier of a certain data to be transmitted, the network transmission requirements can be directly obtained from the local.

[0050] During implementation, a server periodically obtains the network transmission parameters of the heterogeneous physical links of the cloud platform through the Fangcang Cabin Hospital aggregation gateway device, including the real-time RTT (Round-Trip Time) of the link, packet loss information, estimated available bandwidth information, etc., so as to dynamically update the optimal transmission link.

[0051] Finally, the data to be transmitted is transmitted to the remote receiving module through multiple service nodes of the optimal transmission link.

[0052] The aggregation gateway device in the embodiment of the present invention is based on software-defined network technology and provides the following capabilities to meet the use requirements of the Fangcang Hospital:

[0053] Provide the ability to aggregate local link bandwidth and reliable data transmission: The bandwidth of different local heterogeneous physical links is reasonably allocated and used through a transmission algorithm based on the shelter scenario, thus providing support for local link reliability.

[0054] Providing cloud data transfer capabilities: Due to the remote shelter deployment environment, cross-domain access is involved, and data needs to be transferred to the cloud to avoid data loss. The cloud service nodes transmit data through different intermediate service nodes to prevent cross-domain network failures between the two points.

[0055] Providing networking capabilities: Aggregation gateway devices support two operating modes: gateway mode and bridge mode. The bridge mode mainly solves the data transmission problem in telemedicine scenarios where two points must be interconnected using a Layer 2 network protocol. The gateway mode mainly solves the data transmission problem in telemedicine scenarios where two points must be interconnected using different VLANs. The networking method can prevent external networks from directly accessing the Fangcang network environment, which would lead to data security risks. External networks must be connected to the aggregation gateway to access the Fangcang hospital network environment.

[0056] Through the multi-link private routing strategy, the networking routing information can be queried faster, so that it can be quickly forwarded to the peer device of the remote receiving and processing module. It supports domain name addressing and IP addressing, and self-detects and optimizes routing nodes for domain name / IP. For networking data, based on five-tuples and custom routing table items, it can quickly find routing targets and forward data, thereby achieving reliable and stable data transmission.

[0057] During implementation, the data type can be identified in units of five-tuples to obtain network transmission requirements, which can be sent to different transmission algorithm threads for processing, and the packetized data to be transmitted can be transmitted through various heterogeneous links.

[0058] The server of the Fangcang Cabin Hospital processing module in the embodiment of the present invention can obtain the dynamic transmission status of the cloud platform transmission channel resources, and dynamically adjust the configuration of redundant data packets through the Fangcang Cabin Hospital aggregation gateway device. When the network condition is poor, more redundant data packets are configured to improve the reliability of data transmission; when the network condition is good, fewer redundant data packets are configured to improve the efficiency of data transmission. At the remote receiving end, when individual data packets are delayed, timed out or lost, the data can be restored based on the redundant data packets. In this way, the overall transmission delay effect can be shortened.

[0059] In one embodiment, the Fangcang Hospital aggregation gateway device is specifically used for:

[0060] Determine multiple transmission paths according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform;

[0061] Using a pre-trained intelligent selection model, the best transmission link is screened from multiple transmission paths; the intelligent selection model is trained using historical network transmission parameters of multiple transmission links for data to be transmitted; the network transmission parameters include the size of the data packet to be transmitted, jitter, delay, and packet loss rate.

[0062] During implementation, link quality information of multiple available transmission paths, such as bandwidth, delay, packet loss rate, etc., is obtained, and the best path is selected for data transmission using the trained intelligent selection model and link quality information.

[0063] Among them, the best transmission link uses tunnel encryption technology to establish a virtual encrypted channel for transmission. During implementation, the cloud platform will have multiple links to transmit data, and each link can be independently encrypted using TLS (Transport Layer Security, TLS, Transport Layer Security) or SSL (Secure Socket Layer). During implementation, APN / VPN is used to establish a virtual private network to further improve network transmission security.

[0064] In one embodiment, the type identification of the data to be transmitted has a priority;

[0065] The Fangcang Cabin Hospital aggregation gateway device is specifically used for: receiving multiple data to be transmitted; parsing and obtaining the network transmission requirements and the priority of each data to be transmitted that are pre-configured for each data to be transmitted according to the type identifiers of the multiple data to be transmitted; determining the best transmission link for each data to be transmitted in order of priority from high to low; and transmitting all data to be transmitted to the cloud platform in order of priority from high to low.

[0066] This example can achieve data distribution sorted by priority.

[0067] In one embodiment, the square cabin hospital processing module includes a plurality of square cabin hospital aggregation gateway devices; wherein the square cabin hospital aggregation gateway device has a unique identifier, and each square cabin hospital aggregation gateway device is pre-configured to transmit a specified type of data to be transmitted;

[0068] Each Fangcang hospital aggregation gateway device is specifically used to: receive data to be transmitted of a specified type according to the identification of the Fangcang hospital aggregation gateway device; and transmit the data to be transmitted of the specified type to the cloud platform in order of priority from high to low.

[0069] In this example, the Fangcang hospital aggregation gateway device and the remote receiving aggregation gateway device can be configured to only process the specified type of data to be transmitted. For example, Fangcang hospital aggregation gateway device 1# only sends medical data of type a, and remote receiving aggregation gateway device 2# only receives medical data of type a.

[0070] Figure 3 This is another specific embodiment of the processing module of the square cabin hospital in the embodiment of the present invention. Figure 3 As shown, the Fangcang hospital processing module also includes an isolated DMZ (demilitarized zone); the DMZ area is used to: form a buffer zone between the source data acquisition module and the Fangcang hospital aggregation gateway device, and deploy a four-layer application proxy server in the DMZ area.

[0071] In one embodiment, the square cabin hospital processing module also includes an intrusion processing module, which is used to: use artificial intelligence technology to handle malicious attacks.

[0072] For example, network security protection devices such as IPS / IDS (Intrusion Prevention Systems, IPS for short, Intrusion Detection Systems, IDS for short) are introduced to deal with malicious intrusions.

[0073] In the embodiment of the present invention, a network firewall, an intrusion processing module and a security audit monitoring system can also be used to monitor and prevent potential malicious attacks and intrusions to ensure network security. The internal network is isolated by deploying a four-layer application proxy server in the DMZ area, and the remote medical collaboration capability is realized to prevent attackers from accessing other networks through virtual network tunnels.

[0074] In the embodiment of the present invention, the intrusion processing module can be divided into an intrusion prevention module and an intrusion prevention module.

[0075] The intrusion prevention module has the following functions:

[0076] -Real-time monitoring of network traffic: IDS can monitor the traffic in the Fangcang Hospital network in real time, identify abnormal traffic patterns, and detect potential intrusion behaviors, including network scanning, malware propagation, and unauthorized access.

[0077] -Discover security vulnerabilities and attacks: IDS can identify security vulnerabilities and known attack behaviors in the network, discover potential threats in a timely manner, and take appropriate measures to respond and defend.

[0078] -Issuing alarms and notifications: When the IDS detects an intrusion, it will issue an alarm and notify the network administrator so that timely measures can be taken to respond and handle it and protect the security of the square cabin hospital network.

[0079] The intrusion prevention module has the following functions:

[0080] - Actively block intrusions: IPS can actively block identified intrusions, such as preventing attack traffic from entering the shelter hospital network, thus protecting the security and stability of the network.

[0081] - Enhanced network protection capabilities: Compared with IDS, IPS can not only detect intrusion behaviors, but also take active measures to defend and improve network security.

[0082] -Automated response and repair: IPS can automatically respond to intrusions, quickly take defensive and repair measures, and reduce the impact and losses of network attacks.

[0083] The network firewall in the embodiment of the present invention has the following functions:

[0084] -Monitor and filter network traffic: The network firewall can monitor and filter the traffic in and out of the Fangcang Hospital network, screen and control the traffic according to preset rules, and prevent unauthorized access and malicious attacks.

[0085] -Provide network access control: Through the access control rules of the firewall, access to the cabin hospital network can be restricted and only authorized users and devices can be allowed to access, thereby protecting the security of the network.

[0086] -Prevent the spread of malware: Firewalls can detect and block the spread of malware, such as viruses and Trojans, protecting devices and data within the Fangcang Hospital network from infection and damage.

[0087] In one embodiment, the system includes a remote receiving processing module, which includes a remote receiving aggregation gateway device and a decryption module; the Cabin Hospital processing module also includes an encryption module;

[0088] The encryption module is used to: receive the data to be transmitted sent by the source data acquisition module, encrypt the data to be transmitted according to a preset encryption and decryption method, and transmit the encrypted data to be transmitted to the Fangcang Hospital aggregation gateway device;

[0089] The Fangcang Hospital aggregation gateway device is specifically used to: transmit the encrypted data to be transmitted to the cloud platform through the best transmission link, so that the cloud platform: transmits the encrypted data to be transmitted to the remote receiving aggregation gateway device;

[0090] The remote receiving aggregation gateway device is specifically used to: receive the encrypted data to be transmitted, and transmit the encrypted data to be transmitted to the decryption module;

[0091] The decryption module is used to decrypt the encrypted data to be transmitted according to a preset encryption and decryption method to obtain the decrypted data to be transmitted.

[0092] The preset encryption and decryption method is implemented by using any algorithm that complies with the public key infrastructure PKI.

[0093] For example, according to the preset encryption and decryption method, the data to be transmitted is divided into several sub-blocks, and the sub-blocks are sequentially encoded, and the encrypted sub-blocks are pushed to multiple different transmission links, and finally decrypted in the remote receiving processing module. Each sub-block can be encrypted by algorithms such as AES (Advanced Encryption Standard) and IPsec (Internet Protocol Security, IPSec).

[0094] During implementation, a link load balancing algorithm, such as weighted round-robin or minimum number of connections, may be used to evenly distribute data sub-blocks to each transmission path.

[0095] For example, data can be hashed using MD5 (Message-Digest Algorithm 5), SHA512 (Secure Hash Algorithm 512), etc. to ensure data integrity; data can be encrypted using AES, 3DES, etc. to achieve data encryption.

[0096] In an embodiment of the present invention, each transmission can choose to use part or all of the available transmission paths according to the network quality and confidentiality requirements. In actual transmission, it is necessary to consider the actual conditions of the communication tasks and different transmission paths, dynamically allocate paths, and avoid congestion and load imbalance on a certain path. In order to further improve security, when the same source terminal A (for example, a certain cabin hospital aggregation gateway device) is transmitted to the receiving terminal B (for example, a certain remote receiving aggregation gateway device), a different transmission link should be selected each time to avoid the transmission link being too fixed and the data being intercepted by eavesdroppers. The multi-transmission link intelligent selection algorithm is based on the accumulated data recorded in the actual historical transmission application examples of the current endpoint, mainly including sub-block data packet size, jitter, delay, packet loss rate, etc., and is trained through an artificial intelligence network to obtain the selection algorithm with the best expected value and the highest security.

[0097] During the data transmission process, different data sub-blocks have to go through multiple paths, and each path contains multiple relay nodes (i.e., service nodes), and these paths and relay nodes are dynamically and randomly determined during the transmission process. The number, location, and hop count of these relay nodes are random, floating, stateless, and uncertain, objectively forming a hidden dark web. The data sub-blocks are distributed on different paths for transmission, and intercepting the sub-block data on any one of the paths cannot restore the original data. Therefore, it is too difficult to intercept the sub-block data packets of all links and paths, decrypt them all, and correctly sort and restore them. It is almost impossible to complete, which greatly increases the difficulty of decryption and cracking, making the data transmission from the source node to the target node untraceable and unmonitorable, effectively shielding malicious tracking, scanning, and attacks. In this way, during the data transmission process, through the combination of multiple links, multiple network planes, multiple operators, and multiple paths, packet loss, delay, and network jitter are effectively reduced, and the network service quality and communication confidentiality are greatly improved.

[0098] In one embodiment, the cabin hospital processing module also includes a data disaster recovery module, which is used to: store data backup off-site; enable a preset disaster recovery plan when the cabin hospital network is abnormal; the disaster recovery plan includes the cabin hospital data disaster recovery process and emergency handling methods.

[0099] In one embodiment, the square cabin hospital processing module further includes an identity authentication module, which can verify the identity of the user or device by user name, password, biometrics, etc. The identity authentication method includes the following:

[0100] -Username / Password: Username and password are the most common authentication methods;

[0101] -Multi-factor authentication (MFA): MFA requires users to provide two or more authentication factors, such as username, password, biometric information, etc.

[0102] -Multi-factor authentication (MFA): MFA requires users to provide three or more authentication factors.

[0103] In one embodiment, the Fangcang Cabin Hospital processing module also has security vulnerability scanning and repair using automated tools, which can improve security management efficiency.

[0104] In one embodiment, the square cabin hospital processing module also has a security audit monitoring module, which adopts centralized management to improve security management efficiency.

[0105] During implementation, network firewalls, intrusion processing modules and security audit monitoring modules can be combined to monitor and prevent potential malicious attacks and intrusions.

[0106] In summary, the network security protection system of the square cabin hospital in the embodiment of the present invention can connect the cloud and edge of the square cabin hospital through the network aggregation gateway device as SASE, and use the rich civil network resources to realize the virtual network tunnel, obtain the robustness, reliability and availability of the transmission; and through the authentication, authorization, encryption and other mechanisms, the transmission security of the telemedicine collaborative data is guaranteed. Make full use of the diversity and independence of the civil network, aggregate the rich heterogeneous physical link resources through the software-defined virtual network tunnel, monitor the link status in real time during the transmission process, perform load balancing on the link, avoid failures and network congestion, and obtain the robustness, reliability and availability of the transmission. At the same time, identity authentication, device authentication, multi-factor authentication and other mechanisms are used to verify the identity of the object and grant appropriate network access rights; and each physical link can independently perform channel TLS / SSL encryption (supporting multiple encryption algorithms, such as AES, 3DES, etc.), thereby forming a complex transmission model of multi-channel independent encryption and dynamic slicing random interleaving, which ensures the transmission security of telemedicine collaborative data. At the same time, the identity authentication mechanism ensures that only authorized users and devices can access the network aggregation gateway to protect the system from unauthorized access and attacks. In addition, the system also uses network firewalls, intrusion processing modules and security audit monitoring modules to monitor and prevent potential malicious attacks and intrusions to ensure network security. The internal network is isolated by deploying a four-layer application proxy server in the DMZ area, while realizing telemedicine collaboration capabilities to prevent attackers from accessing other networks through virtual network tunnels. In addition, the system also has measures or functions such as data backup and recovery mechanisms, security vulnerability scanning and repair, security training and awareness education, which improve the security and reliability of the system. The system has high security and protection capabilities and is suitable for critical network environments such as shelter hospitals.

[0107] It should be noted that the network security protection system for the cabin hospital provided in the embodiment of the present invention can also be used in the field of cloud computing, and can also be used in any technical field other than the field of cloud computing. The embodiment of the present invention does not limit the application field of the network security protection system for the cabin hospital.

[0108] The embodiment of the present invention also provides a network security protection method for a Cabin Hospital, as described in the following embodiment. The method is described from the perspective of the total server of the Cabin Hospital, which is implemented by scheduling or controlling the source data acquisition module, the Cabin Hospital aggregation gateway device, etc. Since the principle of solving the problem by this method is similar to that of the Cabin Hospital Network Security Protection System, the implementation of this method can refer to the implementation of the Cabin Hospital Network Security Protection System, and the repetition will not be repeated.

[0109] Figure 4 FIG. 1 is a flow chart of a network security protection method for a square cabin hospital in an embodiment of the present invention. Figure 4 As shown, the method includes:

[0110] Step 401: Acquire multiple types of data to be transmitted in the Fangcang Hospital; wherein, a network transmission requirement is configured in advance for each type of data to be transmitted; the data to be transmitted carries a type identifier; and the network transmission requirement reflects requirements for multiple network transmission parameters;

[0111] Step 402: according to the type identifier of the data to be transmitted, parse and obtain the network transmission requirement pre-configured for the data to be transmitted;

[0112] Step 403: Obtain network transmission parameters of heterogeneous physical links of the cloud platform; the cloud platform includes multiple service nodes, and each service node communicates through multiple heterogeneous physical links;

[0113] Step 404: Determine an optimal transmission link according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform; the optimal transmission link includes multiple designated service nodes, and the optimal transmission link is dynamically updated;

[0114] Step 405: transmit the data to be transmitted to the cloud platform via the best transmission link, so that the cloud platform: uses the best transmission link to transmit the data to be transmitted to the remote receiving aggregation gateway device, so that the remote receiving aggregation gateway device: obtains and processes the data to be transmitted.

[0115] In one embodiment, the type identification of the data to be transmitted includes: a plurality of different network segment information; wherein different network segments are pre-configured for source data acquisition devices in different application scenarios in the square cabin hospital; the application scenarios include one or any combination of the following:

[0116] Pharmacy area, infectious disease ward area, surgical ward area, emergency area, testing area, medical consultation area, and computer room area.

[0117] In one embodiment, the type identification of the data to be transmitted has a priority;

[0118] Get the data to be transmitted from the Fangcang Hospital, including:

[0119] Obtain multiple data to be transmitted from the Fangcang Hospital;

[0120] According to the type identifier of the data to be transmitted, the network transmission requirements pre-configured for the data to be transmitted are obtained by parsing, including:

[0121] According to the type identifiers of the multiple data to be transmitted, the network transmission requirements pre-configured for each data to be transmitted and the priority of each data to be transmitted are obtained by parsing;

[0122] According to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform, the optimal transmission link is determined, including:

[0123] Determine the best transmission link for each data to be transmitted in descending order of priority;

[0124] Transmit the data to be transmitted to the cloud platform through the optimal transmission link, including:

[0125] All data to be transmitted are transferred to the cloud platform in order of priority from high to low.

[0126] In one embodiment, before transmitting the data to be transmitted to the cloud platform through the optimal transmission link, the method further includes:

[0127] Encrypt the data to be transmitted according to the preset encryption and decryption method;

[0128] Transmit the data to be transmitted to the cloud platform through the optimal transmission link, including:

[0129] The encrypted data to be transmitted is transmitted to the cloud platform.

[0130] In one embodiment, the preset encryption and decryption method is implemented using any algorithm that complies with PKI.

[0131] In one embodiment, determining the best transmission link according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform includes:

[0132] Determine multiple transmission paths according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform;

[0133] Using a pre-trained intelligent selection model, the best transmission link is screened from multiple transmission paths; the intelligent selection model is trained using historical network transmission parameters of multiple transmission links for data to be transmitted; the network transmission parameters include the size of the data packet to be transmitted, jitter, delay, and packet loss rate.

[0134] In one embodiment, the optimal transmission link uses tunnel encryption technology to establish a virtual encrypted channel for transmission.

[0135] In one embodiment, the heterogeneous physical link includes one or any combination of the following: satellite signal, wired network, 4G, 5G.

[0136] In one embodiment, it further includes:

[0137] Use artificial intelligence technology to deal with malicious attacks.

[0138] In one embodiment, after the data to be transmitted is transmitted to the cloud platform through the optimal transmission link, the method further includes:

[0139] Offsite storage of data backup;

[0140] When the network of the Fangcang Hospital is abnormal, the preset disaster recovery plan is activated; the disaster recovery plan includes the Fangcang Hospital data disaster recovery process and emergency handling methods.

[0141] The embodiment of the present invention also provides a network security protection device for a shelter hospital, as described in the following embodiment. Since the principle of the device to solve the problem is similar to the network security protection method for a shelter hospital, the implementation of the device can refer to the implementation of the network security protection method for a shelter hospital, and the repeated parts will not be repeated.

[0142] Figure 5 Schematic diagram of a network security protection device for a shelter hospital in an embodiment of the present invention. Figure 5 As shown, the device comprises:

[0143] The data acquisition module 501 is used to acquire the data to be transmitted of the square cabin hospital; wherein the network transmission requirements are configured in advance for each type of data to be transmitted; the data to be transmitted carries a type identifier; and the network transmission requirements reflect the requirements for multiple network transmission parameters;

[0144] The data parsing module 502 is used to parse the type identifier of the data to be transmitted to obtain the network transmission requirement pre-configured for the data to be transmitted;

[0145] The cloud platform communication module 503 is used to obtain network transmission parameters of heterogeneous physical links of the cloud platform; the cloud platform includes multiple service nodes, and each service node communicates through multiple heterogeneous physical links;

[0146] The transmission processing module 504 is used to determine the best transmission link according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform; the best transmission link includes multiple designated service nodes, and the best transmission link is dynamically updated; the data to be transmitted is transmitted to the cloud platform, so that the cloud platform: uses the best transmission link to transmit the data to be transmitted to the remote receiving aggregation gateway device, so that the remote receiving aggregation gateway device: obtains and processes the data to be transmitted.

[0147] In one embodiment, the type identification of the data to be transmitted includes: a plurality of different network segment information; wherein different network segments are pre-configured for source data acquisition devices in different application scenarios in the square cabin hospital; the application scenarios include one or any combination of the following:

[0148] Pharmacy area, infectious disease ward area, surgical ward area, emergency area, testing area, medical consultation area, and computer room area.

[0149] In one embodiment, the type identification of the data to be transmitted has a priority;

[0150] The data acquisition module 501 is specifically used for:

[0151] Obtain multiple data to be transmitted from the Fangcang Hospital;

[0152] The data analysis module 502 is specifically used for:

[0153] According to the type identifiers of the multiple data to be transmitted, the network transmission requirements pre-configured for each data to be transmitted and the priority of each data to be transmitted are obtained by parsing;

[0154] The transmission processing module 504 is specifically used for:

[0155] Determine the best transmission link for each data to be transmitted in descending order of priority;

[0156] All data to be transmitted are transferred to the cloud platform in order of priority from high to low.

[0157] In one embodiment, it further includes:

[0158] An encryption module, used for encrypting the data to be transmitted according to a preset encryption and decryption method before the transmission processing module 504 transmits the data to be transmitted to the cloud platform through the optimal transmission link;

[0159] The transmission processing module 504 is specifically used for:

[0160] The encrypted data to be transmitted is transmitted to the cloud platform.

[0161] In one embodiment, the preset encryption and decryption method is implemented using any algorithm that complies with PKI.

[0162] In one embodiment, the transmission processing module 504 is specifically used to:

[0163] Determine multiple transmission paths according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform;

[0164] Using a pre-trained intelligent selection model, the best transmission link is screened from multiple transmission paths; the intelligent selection model is trained using historical network transmission parameters of multiple transmission links for data to be transmitted; the network transmission parameters include the size of the data packet to be transmitted, jitter, delay, and packet loss rate.

[0165] In one embodiment, the optimal transmission link uses tunnel encryption technology to establish a virtual encrypted channel for transmission.

[0166] In one embodiment, the heterogeneous physical link includes one or any combination of the following: satellite signal, wired network, 3G, 4G, 5G.

[0167] In one embodiment, it further includes:

[0168] The malicious attack processing module is used to handle malicious attacks using artificial intelligence technology.

[0169] In one embodiment, it further includes:

[0170] The data backup processing module is used to store data backup remotely after the transmission processing module 504 transmits the data to be transmitted to the cloud platform through the optimal transmission link; when the network of the square cabin hospital is abnormal, the preset disaster recovery plan is enabled; the disaster recovery plan includes the square cabin hospital data disaster recovery process and emergency handling methods.

[0171] An embodiment of the present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned method for protecting the network security of a square cabin hospital when executing the computer program.

[0172] An embodiment of the present invention also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned method for protecting the network security of the square cabin hospital is implemented.

[0173] An embodiment of the present invention also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the above-mentioned network security protection method for the square cabin hospital.

[0174] In the embodiment of the present invention, the network security protection system of the square cabin hospital includes: a square cabin hospital processing module, a cloud platform and a remote receiving aggregation gateway device; the square cabin hospital processing module includes a source data acquisition module and a square cabin hospital aggregation gateway device; the square cabin hospital aggregation gateway device and the remote receiving aggregation gateway device form a three-layer wide area network; the cloud platform is used to transmit the to-be-transmitted data of the square cabin hospital to the remote receiving aggregation gateway device, and the cloud platform includes multiple service nodes, each service node communicates through multiple heterogeneous physical links; wherein the source data acquisition module is used to: obtain multiple types of to-be-transmitted data, and transmit the to-be-transmitted data to the square cabin hospital aggregation gateway device; wherein the network transmission requirements are pre-configured for each type of to-be-transmitted data; the to-be-transmitted data The data carries a type identifier; the network transmission requirements reflect the requirements for multiple network transmission parameters; the Fangcang hospital aggregation gateway device is used to: receive the data to be transmitted; according to the type identifier of the data to be transmitted, parse and obtain the network transmission requirements pre-configured for the data to be transmitted; obtain the network transmission parameters of the heterogeneous physical links of the cloud platform; according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform, determine the best transmission link, the best transmission link includes multiple designated service nodes, and the best transmission link is dynamically updated; transmit the data to be transmitted to the cloud platform, so that the cloud platform: uses the best transmission link to transmit the data to be transmitted to the remote receiving aggregation gateway device. In the embodiment of the present invention, the network security protection system of the cabin hospital is based on cloud platform data transmission. The cloud platform includes multiple service nodes, and each service node communicates through multiple heterogeneous physical links. That is, the network security protection system of the cabin hospital in the embodiment of the present invention can use various heterogeneous physical links to transmit data, without the need for operator dedicated line communication, and can achieve rapid deployment; at the same time, the cabin hospital aggregation gateway device and the remote receiving aggregation gateway device of the cabin hospital network security protection system in the embodiment of the present invention form a three-layer wide area network. The cabin hospital aggregation gateway device can determine an optimal transmission link from the cloud platform. This optimal transmission link can also be dynamically updated. When updating, it can be updated according to the real-time network transmission parameters of the heterogeneous physical links of the cloud platform, thereby improving the reliability and stability of data transmission, reducing the loss of transmission data, and being particularly suitable for delay-sensitive medical environments, greatly improving the network service quality of the cabin hospital.

[0175] The network security protection method of the square cabin hospital in the embodiment of the present invention includes: obtaining multiple types of data to be transmitted in the square cabin hospital; wherein, network transmission requirements are pre-configured for each type of data to be transmitted; the data to be transmitted carries a type identifier; the network transmission requirements reflect requirements for multiple network transmission parameters; according to the type identifier of the data to be transmitted, parsing to obtain the network transmission requirements pre-configured for the data to be transmitted; obtaining the network transmission parameters of the heterogeneous physical links of the cloud platform; determining the optimal transmission link according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform; the optimal transmission link includes multiple designated service nodes, and the optimal transmission link is dynamically updated; transmitting the data to be transmitted to the cloud platform through the optimal transmission link, so that the cloud platform: uses the optimal transmission link to transmit the data to be transmitted to the remote receiving aggregation gateway device, so that the remote receiving aggregation gateway device: obtains and processes the data to be transmitted. In the embodiment of the present invention, the network security protection method for the cabin hospital is based on cloud platform data transmission. The cloud platform includes multiple service nodes, and each service node communicates through multiple heterogeneous physical links. That is, the data to be transmitted in the cabin hospital in the embodiment of the present invention can be transmitted using various heterogeneous physical links, without the need for operator dedicated line communication, and rapid deployment of the cabin hospital network can be achieved; at the same time, in the embodiment of the present invention, an optimal transmission link is determined based on the cloud platform, and this optimal transmission link can also be dynamically updated. When updating, it can be updated according to the real-time network transmission parameters of the heterogeneous physical links of the cloud platform, thereby improving the reliability and stability of data transmission, reducing the loss of transmission data, and being particularly suitable for delay-sensitive medical environments, greatly improving the network service quality of the cabin hospital.

[0176] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0177] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0178] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0179] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0180] The specific embodiments described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network security protection system for square cabin hospitals, characterized in that: The system includes: Cabin Hospital processing module, cloud platform and remote receiving aggregation gateway device; The Fangcang hospital processing module includes a source data acquisition module and a Fangcang hospital aggregation gateway device; the Fangcang hospital aggregation gateway device and the remote receiving aggregation gateway device form a three-layer wide area network; The cloud platform is used to transmit the data to be transmitted from the Fangcang Hospital to the remote receiving aggregation gateway device. The cloud platform includes multiple service nodes, and each service node communicates through multiple heterogeneous physical links; The source data acquisition module is used to: acquire multiple types of data to be transmitted, and transmit the data to be transmitted to the Cabin Hospital aggregation gateway device; wherein the network transmission requirements are configured in advance for each type of data to be transmitted; the data to be transmitted carries a type identifier; and the network transmission requirements reflect the requirements for multiple network transmission parameters; The Fangcang Cabin Hospital aggregation gateway device is used to: receive data to be transmitted; according to the type identifier of the data to be transmitted, parse and obtain the network transmission requirements pre-configured for the data to be transmitted; obtain the network transmission parameters of the heterogeneous physical links of the cloud platform; determine the best transmission link according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform, wherein the best transmission link includes multiple designated service nodes and the best transmission link is dynamically updated; transmit the data to be transmitted to the cloud platform, so that the cloud platform: uses the best transmission link to transmit the data to be transmitted to the remote receiving aggregation gateway device.

2. The system according to claim 1, characterized in that The type identifier of the data to be transmitted includes: a plurality of different network segment information; wherein different network segments are pre-configured for source data acquisition devices in different application scenarios in the Fangcang Hospital; the application scenarios include one or any combination of the following: Pharmacy area, infectious disease ward area, surgical ward area, emergency area, testing area, medical consultation area, and computer room area.

3. The system according to claim 2, characterized in that The type identification of the data to be transmitted has priority; The Fangcang Cabin Hospital aggregation gateway device is specifically used for: receiving multiple data to be transmitted; parsing and obtaining the network transmission requirements and the priority of each data to be transmitted that are pre-configured for each data to be transmitted according to the type identifiers of the multiple data to be transmitted; determining the best transmission link for each data to be transmitted in order of priority from high to low; and transmitting all data to be transmitted to the cloud platform in order of priority from high to low.

4. The system according to claim 3, characterized in that The Fangcang hospital processing module includes a plurality of Fangcang hospital aggregation gateway devices; wherein the Fangcang hospital aggregation gateway device has a unique identifier, and each Fangcang hospital aggregation gateway device is pre-configured to transmit a specified type of data to be transmitted; Each Fangcang hospital aggregation gateway device is specifically used to: receive data to be transmitted of a specified type according to the identification of the Fangcang hospital aggregation gateway device; and transmit the data to be transmitted of the specified type to the cloud platform in order of priority from high to low.

5. The system according to claim 1, characterized in that The Fangcang Cabin Hospital processing module also includes an isolated DMZ area; the DMZ area is used to: form a buffer zone between the source data acquisition module and the Fangcang Cabin Hospital aggregation gateway device, and deploy a four-layer application proxy server in the DMZ area.

6. The system according to claim 1, wherein: The system includes a remote receiving and processing module, which includes a remote receiving aggregation gateway device and a decryption module; the Cabin Hospital processing module also includes an encryption module; The encryption module is used to: receive the data to be transmitted sent by the source data acquisition module, encrypt the data to be transmitted according to a preset encryption and decryption method, and transmit the encrypted data to be transmitted to the Fangcang Hospital aggregation gateway device; The Fangcang Hospital aggregation gateway device is specifically used to: transmit the encrypted data to be transmitted to the cloud platform through the best transmission link, so that the cloud platform: transmits the encrypted data to be transmitted to the remote receiving aggregation gateway device; The remote receiving aggregation gateway device is specifically used to: receive the encrypted data to be transmitted, and transmit the encrypted data to be transmitted to the decryption module; The decryption module is used to decrypt the encrypted data to be transmitted according to a preset encryption and decryption method to obtain the decrypted data to be transmitted.

7. The system according to claim 6, characterized in that The preset encryption and decryption method is implemented by using any algorithm that complies with the public key infrastructure PKI.

8. The system according to claim 1, wherein: The Fangcang Hospital aggregation gateway device is specifically used for: Determine multiple transmission paths according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform; The best transmission link is screened from multiple transmission paths using a pre-trained intelligent selection model; the intelligent selection model is trained using historical network transmission parameters of multiple transmission links for data to be transmitted; The network transmission parameters include the size of the data packet to be transmitted, jitter, delay, and packet loss rate.

9. The system according to claim 1, characterized in that The optimal transmission link adopts tunnel encryption technology to establish a virtual encryption channel for transmission.

10. The system according to claim 1, wherein: The heterogeneous physical link includes one or any combination of the following: satellite signal, wired network, 4G, and 5G.

11. The system according to claim 1, characterized in that The Fangcang Cabin Hospital processing module also includes an intrusion processing module, which is used to: use artificial intelligence technology to handle malicious attacks.

12. The system of claim 1, wherein: The Fangcang hospital processing module also includes a data disaster recovery module, which is used to: store data backup off-site; enable a preset disaster recovery plan when the Fangcang hospital network is abnormal; the disaster recovery plan includes the Fangcang hospital data disaster recovery process and emergency handling methods.

13. A network security protection method for a shelter hospital, characterized in that: include: Acquire multiple types of data to be transmitted in the Fangcang Cabin Hospital; wherein, the network transmission requirements are configured in advance for each type of data to be transmitted; the data to be transmitted carries a type identifier; and the network transmission requirements reflect requirements for multiple network transmission parameters; According to the type identifier of the data to be transmitted, parsing obtains the network transmission requirement pre-configured for the data to be transmitted; Obtaining network transmission parameters of heterogeneous physical links of a cloud platform; the cloud platform includes multiple service nodes, each service node communicates through multiple heterogeneous physical links; Determine an optimal transmission link according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform; the optimal transmission link includes multiple designated service nodes, and the optimal transmission link is dynamically updated; The data to be transmitted is transmitted to the cloud platform through the best transmission link, so that the cloud platform: uses the best transmission link to transmit the data to be transmitted to the remote receiving aggregation gateway device, so that the remote receiving aggregation gateway device: obtains and processes the data to be transmitted.

14. The method according to claim 13, characterized in that The type identifier of the data to be transmitted includes: a plurality of different network segment information; wherein different network segments are pre-configured for source data acquisition devices in different application scenarios in the Fangcang Hospital; the application scenarios include one or any combination of the following: Pharmacy area, infectious disease ward area, surgical ward area, emergency area, testing area, medical consultation area, and computer room area.

15. The method according to claim 14, characterized in that The type identification of the data to be transmitted has priority; Get the data to be transmitted from the Fangcang Hospital, including: Obtain multiple data to be transmitted from the Fangcang Hospital; According to the type identifier of the data to be transmitted, the network transmission requirements pre-configured for the data to be transmitted are obtained by parsing, including: According to the type identifiers of the multiple data to be transmitted, the network transmission requirements pre-configured for each data to be transmitted and the priority of each data to be transmitted are obtained by parsing; According to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform, the optimal transmission link is determined, including: Determine the best transmission link for each data to be transmitted in descending order of priority; Transmit the data to be transmitted to the cloud platform through the optimal transmission link, including: All data to be transmitted are transferred to the cloud platform in order of priority from high to low.

16. The method according to claim 13, characterized in that Before transmitting the data to be transmitted to the cloud platform through the optimal transmission link, it also includes: Encrypt the data to be transmitted according to the preset encryption and decryption method; Transmit the data to be transmitted to the cloud platform through the optimal transmission link, including: The encrypted data to be transmitted is transmitted to the cloud platform.

17. The method according to claim 16, characterized in that The preset encryption and decryption method is implemented using any algorithm that complies with PKI.

18. The method according to claim 13, characterized in that According to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform, the optimal transmission link is determined, including: Determine multiple transmission paths according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform; Using a pre-trained intelligent selection model, the best transmission link is screened from multiple transmission paths; the intelligent selection model is trained using historical network transmission parameters of multiple transmission links for data to be transmitted; the network transmission parameters include the size of the data packet to be transmitted, jitter, delay, and packet loss rate.

19. The method of claim 13, wherein: The optimal transmission link adopts tunnel encryption technology to establish a virtual encryption channel for transmission.

20. The method of claim 13, wherein: The heterogeneous physical link includes one or any combination of the following: satellite signal, wired network, 4G, and 5G.

21. The method of claim 13, wherein: Also includes: Use artificial intelligence technology to deal with malicious attacks.

22. The method of claim 13, wherein: After the data to be transmitted is transmitted to the cloud platform through the optimal transmission link, it also includes: Offsite storage of data backup; When the network of the Fangcang Hospital is abnormal, the preset disaster recovery plan is activated; the disaster recovery plan includes the Fangcang Hospital data disaster recovery process and emergency handling methods.

23. A network security protection device for a square cabin hospital, characterized in that: include: A data acquisition module is used to acquire the data to be transmitted in the square cabin hospital; wherein the network transmission requirements are configured in advance for each type of data to be transmitted; the data to be transmitted carries a type identifier; and the network transmission requirements reflect the requirements for multiple network transmission parameters; A data parsing module, used to parse, according to the type identifier of the data to be transmitted, the network transmission requirements pre-configured for the data to be transmitted; A cloud platform communication module, used to obtain network transmission parameters of heterogeneous physical links of the cloud platform; the cloud platform includes multiple service nodes, each service node communicates through multiple heterogeneous physical links; The transmission processing module is used to determine the best transmission link according to the network transmission requirements pre-configured for the data to be transmitted and the network transmission parameters of the heterogeneous physical links of the cloud platform; the best transmission link includes multiple designated service nodes, and the best transmission link is dynamically updated; the data to be transmitted is transmitted to the cloud platform, so that the cloud platform: uses the best transmission link to transmit the data to be transmitted to the remote receiving aggregation gateway device, so that the remote receiving aggregation gateway device: obtains and processes the data to be transmitted.

24. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 13 to 22 is implemented.

25. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 13 to 22 is implemented.

26. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the method according to any one of claims 13 to 22 is implemented.

Images