Gatekeeper isolation exchange system and method

Abstract

The invention provides a gatekeeper isolation exchange system and method. The system comprises an external network end, an internal network end and a data ferry device. The external network end and the internal network end are respectively provided with a data packaging module and a Flag module. And the data packaging module is used for packaging the service data according to the communication protocol to obtain a service data packet, and the tail of the service data packet is provided with a CRC check code. The Flag module is used for configuring identity information of the service data to obtain an identity information data packet, the identity information data packet comprises an identity authentication code, and the identity authentication code is a binary variable. The data ferry device comprises a data packet transmission module, an identity verification module and a CRC verification module. The identity verification module is used for carrying out identity authentication on the identity information data packet, the CRC verification module is used for judging whether the service data packet is complete or not, and the data packet transmission module is used for forwarding the verified service data and / or identity information data to a target network. According to the invention, different types of data can be quickly identified and processed, the flexibility is high, and the transmission efficiency is high.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network gate isolation switching system and method. Background Art

[0002] In order to effectively reduce the risk of hacker intrusion and data theft, prevent data leakage and attacks, protect sensitive data within the enterprise, ensure that data is not stolen, tampered with or leaked during transmission, and protect the integrity and security of data, a network gate is usually required between the internal and external network data interaction to cut off the direct connection between the two networks, ensuring that even if one network is attacked, it will not directly affect the other network, thereby effectively preventing the spread of network attacks. When data is transmitted from one network to another, the network gate will perform operations such as protocol stripping and repackaging on the data to avoid potential protocol vulnerabilities from being exploited and ensure the legitimacy and security of the ferrying data. FPGA (Field Programmable Gate Array) has the advantages of pure hardware architecture, high reliability of physical isolation, and data parallel processing capabilities, which can significantly improve the speed and efficiency of data exchange, making it a common data ferry.

[0003] At present, when FPGA is used for data ferrying in the existing technology, it often participates in a lot of transaction-type processing work, and the logic is too complicated, such as various state controls, data verification, etc. In the process of data ferrying between internal and external network hosts, there are many types of messages. At present, FPGA processing is prone to errors, and there is a problem of opacity between internal and external networks. However, FPGA cannot realize online program upgrades through remote operation and maintenance. When there are bugs, they cannot be repaired and solved in time, and positioning and debugging are also inconvenient. Therefore, it is urgent to optimize the processing logic of FPGA. Summary of the invention

[0004] The object of the present invention is to provide a network gate isolation switching system and method to solve the above-mentioned problems, which can quickly identify and process different types of data with high flexibility and high transmission efficiency.

[0005] The present invention proposes a network gate isolation switching system, including an external network end, an internal network end and a data ferry connected to the external network end and the internal network end respectively. In data transmission, one of the external network and the internal network acts as a command initiating network, and the other acts as a target network.

[0006] The external network end and the internal network end are both provided with a data encapsulation module and a Flag module. The data encapsulation module is used to encapsulate the service data according to the communication protocol to obtain a service data packet. A CRC check code is provided at the end of the service data packet. The Flag module is used to configure the identity information of the service data to obtain an identity information data packet. The identity information data packet includes an identity authentication code, and the identity authentication code is a binary variable.

[0007] The data ferryer includes a data packet transmission module, an identity verification module and a CRC verification module. The identity verification module is used to authenticate the identity information data packet. The CRC verification module is used to calculate the CRC value of the received business data, compare the calculated CRC value with the CRC verification code at the end of the business data packet, and determine whether the business data packet is complete. The data packet transmission module is used to forward the verified business data and / or identity information data to the target network.

[0008] In one embodiment, the communication protocol is the UDP protocol, the service data packet is a UDP message, and a CRC32 check code is set at the end of the service data packet.

[0009] In one embodiment, the identity information data packet is 32 bytes, including a 3-byte status identifier, a 4-byte time identifier, a 1-byte sequence number, a 19-byte identity authentication code, and a 3-byte status identifier;

[0010] The identity authentication code is generated by performing MD5 operation on the first ten bytes of the identity information data packet.

[0011] In one embodiment,

[0012] When the data packet transmission module transmits the verified service data, the verified service data is forwarded to the target network according to the fixed data length, and the fixed data length is less than the IP maximum message length of UDP;

[0013] When the data packet transmission module transmits the verified identity information data, it forwards the complete identity information data packet to the target network.

[0014] In one embodiment, the data ferry is an FPGA.

[0015] In one embodiment, the data ferryer also includes a storage module, which includes an identity information storage unit and a business data storage unit. The identity information storage unit is used to store identity information data after verification, and the business data storage unit is used to store business data after verification.

[0016] The present invention also proposes a network gate isolation switching method, which is applied to the network gate isolation switching system as described above, and comprises the following steps:

[0017] The data ferry receives the business data packet and identity information data packet from the instruction initiating network;

[0018] Perform CRC check on the service data packet;

[0019] Authenticating the identity information data packet;

[0020] Only after the CRC check of the business data packet and the identity authentication of the identity information data packet have all passed, the business data from the instruction initiating network will be written into the data ferry;

[0021] When the target network requests to obtain business data, the data ferry forwards the business data from the instruction initiating network to the target network after the identity authentication of the identity information data packet is passed.

[0022] In one embodiment,

[0023] When the command initiates a network reset operation, if the reset is successful, the data ferry returns an ACK confirmation message;

[0024] When the instruction initiates the network to set the identity information operation, if the data ferry passes the identity authentication, the identity information data will be overwritten and an ACK confirmation message will be returned, otherwise, the data will be discarded;

[0025] When the instruction initiates the network to upload business data, if the data ferry passes the CRC check, the business data will be overwritten and an ACK confirmation message will be returned; otherwise, the data will be discarded.

[0026] In one embodiment, the ACK confirmation message is 32 bytes.

[0027] In one embodiment,

[0028] When the target network performs an identity information read operation, the data ferry returns a complete identity information data packet;

[0029] When the target network performs a read operation on business data, the data ferry forwards the verified business data according to the fixed data length.

[0030] Compared with the prior art, the network gate isolation switching system and method of the present invention have the following beneficial effects:

[0031] 1) The present invention can verify the identity information data in detail during data transmission, perform identity recognition and authentication, and use simple CRC verification for business data without content verification. The data ferry can reduce unnecessary processing overhead while ensuring data accuracy, thereby improving the overall efficiency of data transmission and processing.

[0032] 2) The data ferry in the present invention can easily identify and process different types of data without the need for complex parsing and verification of each business data packet, thereby improving the flexibility of the data ferry in processing different types of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A schematic diagram of the structure of a network gate isolation switching system according to an embodiment of the present invention;

[0034] Figure 2 A data structure diagram of a UDP message according to an embodiment of the present invention;

[0035] Figure 3 A data structure diagram of an identity information data packet according to an embodiment of the present invention;

[0036] Figure 4 A data structure diagram of an identity authentication code according to an embodiment of the present invention;

[0037] Figure 5 The diagram is a schematic diagram of message interaction between a data ferry and internal and external networks according to an embodiment of the present invention. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical solution and advantages of the present invention more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments of the specification. It should be noted that many specific details are set forth in the following description to facilitate a full understanding of the present invention, but the present invention can also be implemented in other ways different from those described herein, and those skilled in the art can make similar generalizations without violating the connotation of the present invention, so the present invention is not limited by the specific embodiments disclosed below.

[0039] Secondly, "one embodiment" or "an embodiment" in this application refers to a specific feature, structure or characteristic that can be included in at least one implementation of the present invention. The "in one embodiment" and "an embodiment" that appear in different places in this specification do not all refer to the same embodiment, nor are they separate or selective embodiments that are mutually exclusive with other embodiments. The terms "including" and "comprising" indicate the presence of the claimed features, but do not exclude the presence of one or more other features. The term "and / or" used in this application includes any and all combinations of one or more of the relevant listed items.

[0040] To solve the above problems, the present invention simplifies the business processing logic of the data ferry, so that the data ferry only provides the mechanism of intranet and intranet data ferry and cache, and does not participate in various transactional strategies of intranet and intranet application services. The complex data ferry strategy is completed by the application program responsible for data processing in the intranet and intranet (such as flag setting, data verification, fault tolerance processing, etc.). The data ferry is only equivalent to a filter with a built-in whitelist mechanism. The specific design is as follows.

[0041] The present invention proposes a network gate isolation switching system, including an external network end, an internal network end and a data ferry connected to the external network end and the internal network end respectively. In data transmission, one of the external network and the internal network is used as a command initiating network, and the other is used as a target network. Figure 1 As shown. Both the external network end and the internal network end are provided with a data packet module and a Flag module. The data packet module is used to packetize the business data according to the communication protocol to obtain a business data packet, and a CRC check code is set at the end of the business data packet. The Flag module is used to configure the identity information of the business data to obtain an identity information data packet, and the identity information data packet includes an identity authentication code, and the identity authentication code is a binary variable (flag). By simply identifying the identity information, the verification efficiency of the identity information can be improved. The data ferry includes a data packet transmission module, an identity verification module, a CRC verification module and a storage module. The identity verification module is used to authenticate the identity information data packet; the CRC verification module is used to calculate the CRC value of the received business data, and compare the calculated CRC value with the CRC check code at the end of the business data packet to determine whether the business data packet is complete; the data packet transmission module is used to forward the verified business data and / or identity information data to the target network. The storage module includes an identity information storage unit and a business data storage unit, the identity information storage unit is used to store the identity information data after verification, and the business data storage unit is used to store the business data after verification.

[0042] Among them, the business data packet carries business data, that is, the core data to be transmitted, such as numbers, text, images, audio, etc.; and the identity information data packet carries the identity information of the business data, such as source address, destination address, port information, etc.

[0043] The data ferry device of one embodiment of the present invention is a FPGA.

[0044] The storage module of an embodiment of the present invention is a 72KB RAM storage, which is used for temporarily storing business data and identity information data.

[0045] The communication protocol of an embodiment of the present invention is the UDP protocol. Correspondingly, the service data packet is a UDP message, and a CRC32 check code is set at the end of the service data packet. That is, the data ferry uses the UDP protocol to communicate with the intranet end and / or the extranet end. The specific structure of the UDP message is as follows: Figure 2As shown, it includes a two-byte data header (0xFE, 0xEF), a one-byte data type (APPType), a four-byte data length (high byte first), business data (data), and a four-byte CRC32 checksum. The CRC32 checksum is the checksum of all bytes from the data header to the end of the data. The data length byte contains the CRC32 data, that is, if the length of the data is len1, since the last 4 bytes are the CRC32 checksum, the data length in the message is len1+4. The business data (data) is transparent to the data ferry and is not parsed by the data ferry.

[0046] There are only five types of messages (in pairs) exchanged between the data ferry and the internal and external networks, namely UDP.SetFlag (message type is 0xF1), UDP.SetFlag.ACK (message type is 0xE1), UDP.GetFlag (message type is 0xF2), UDP.GetFlag.Flag (message type is 0xE2), UDP.PutData (message type is 0xF3), UDP.PutData.ACK (message type is 0xE3), UDP.GetData (message type is 0xF4), UDP.GetData.Data (message type is 0xE4), UDP.Reset (message type is 0xF5), UDP.Reset.ACK (message type is 0xE5). This is also the core function of the data ferry. No other types of messages are required. The data ferry only does this most basic and simplified mechanism. All application logic and business type definition and processing are controlled by the application itself and put into the business data data structure by the application itself.

[0047] For UDP.SetFlag, the business data is flag. After the identity verification is passed, the data ferryer writes this data to the identity information storage unit; for UDP.GetFlag, the data ferryer returns data from the identity information storage unit; for UDP.SetData, the data ferryer writes this data to the business data storage unit after passing the CRC32 verification; for UDP.GetData, the data ferryer returns data from the business data storage unit.

[0048] The identity information data packet of an embodiment of the present invention is 32 bytes, including a 3-byte status flag (APPFlag), a 4-byte time flag, a 1-byte sequence number, a 19-byte identity authentication code and a 3-byte status flag (APPFlag). Figure 3As shown. Byte 0, byte 1, byte 2 and byte 29, byte 30, byte 31 are the same status identifier APPFlag, which is to ensure that there is no error when one reads and the other writes on the internal and external networks: when it is detected that the 6-byte APPFlag is different, it is considered that the other party has not finished writing (such as being read away during the writing process), and it is necessary to re-read until the 6 bytes are the same before using APPFlag. The time identifier, in seconds, is set by the writer to mark the moment when this APPFlag is written. It is used for the internal network to determine the APPFlag timeout and reset it to the default state in abnormal situations. For example, when the internal network determines that the APPFlag stays in a type for more than a specified time, it will immediately reset to the default state of 0×0 to avoid the internal network logic being locked when an abnormality occurs on either side. The sequence number is set by the internal and external networks when SetFlag, and is accumulated by 1 each time. It is used for the internal and external networks to determine whether it is the sequence number set last time and perform business verification.

[0049] The identity authentication code is generated by performing MD5 (Message-Digest Algorithm 5) operation on the first ten bytes of the identity information data packet. It is used by the data ferry to verify the validity of the identity information and prevent third-party applications from disguising messages to initiate data penetration or attacks. The MD5 operation result is 16 bytes. The data structure of the identity authentication code is as follows: Figure 4 As shown, the 16 bytes of the MD5 operation result are divided into four groups, each with four bytes, and each group is separated by one byte. Figure 4 In the example, F1, F2, and F3 represent the first byte, the second byte, and the third byte respectively.

[0050] When the data packet transmission module transmits verified business data, the data ferry does not take or judge the data in the message, and forwards the verified business data to the target network according to a fixed data length each time. The fixed data length is less than the maximum IP message length of UDP. The fixed length is returned to simplify the internal program logic of the data ferry, so that the data ferry does not need to save the effective length of the internal data area. No matter how many bytes are written by the business each time, the data ferry returns all the data in the internal data area. The actual valid data in the returned data is managed and judged by the business application itself. In one embodiment of the present invention, the fixed data area length is temporarily set to 60K or 1K. First, 60K is set to test the packet loss rate of the data ferry. If the packet loss rate is relatively large, 1K processing will be used.

[0051] When the data packet transmission module transmits the verified identity information data, it forwards the complete (32-byte) identity information data packet to the target network. The data ferry does not judge the identity information data and returns a fixed 32 bytes each time, regardless of whether these 32 bytes are valid.

[0052] The present invention also proposes a network gate isolation switching method, which is applied to the network gate isolation switching system as described above, and comprises the following steps:

[0053] 1) After receiving the reset command from the command initiating network, the data ferry performs the reset operation;

[0054] 2) The data ferry receives the business data packet and identity information data packet from the command initiating network;

[0055] 3) Perform CRC check on the service data packet;

[0056] 4) Authenticate the identity information data packet;

[0057] 5) Only after the CRC check of the business data packet and the identity authentication of the identity information data packet have all passed, the business data from the instruction initiating network will be written into the data ferry;

[0058] Specifically, Figure 5 As shown, when the instruction initiates the network to perform a reset (Reset) operation, if the reset is successful, the data ferry returns an ACK confirmation message to confirm that the data ferry is successfully reset. When the instruction initiates the network to set identity information (SetFlag) operation, if the data ferry passes its identity authentication, the identity information data will be overwritten and an ACK confirmation message will be returned through UDP to confirm that the identity information data sent by the sender has been successfully received; otherwise, the data will be discarded and no message will be returned. When the instruction initiates the network to upload business data (PutData) operation, if the data ferry passes its CRC check, the business data will be overwritten and an ACK confirmation message will be returned through UDP to confirm that the business data sent by the sender has been successfully received; otherwise, the data will be discarded and no message will be returned.

[0059] The data ferry does not distinguish between internal and external networks. When receiving a request, it performs related operations, performs identity authentication and CRC verification of business data, and does not perform overwrite checks on business data and identity information data. Failure is returned only when an error occurs inside the data ferry and data cannot be written. In other words, regardless of the operation on business data or identity information data, in any other case, after verification, it will directly overwrite and write and return an ACK confirmation message of successful writing.

[0060] The ACK confirmation message in one embodiment of the present invention is 32 bytes.

[0061] 6) When the target network requests to obtain business data, the data ferry device authenticates the identity information data packet and then forwards the business data from the instruction initiating network to the target network.

[0062] Specifically, Figure 5 As shown in the figure, when the target network performs an operation to read identity information (GetFlag), the data ferry returns a complete (32-byte) identity information data packet. When the target network performs an operation to read business data (GetData), the data ferry forwards the business data that has passed the verification according to the fixed data length. For read operations (i.e., get operations), the data ferry directly returns relevant content at any time. In other words, GetFlag and GetData will return success as long as the identity authentication is passed, unless the UDP connection fails, the target network will fail to read.

[0063] Since the internal and external network ferrying program controls data ferrying through the identity verification module, if the identity verification fails, the business data will not be ferryed, so the data ferry does not need to perform complex business data verification. The business data only needs to be simply verified, using the CRC32 verification algorithm. The last 4 bytes are the CRC verification code of the business data packet, with the high first and the low last. Any third-party program simulates sending a data message to the data ferry. If the CRC32 verification is met, the data will only go to the data ferry, but will not be ferryed and will not go to the other end (target network). The purpose of doing this is mainly to reduce the amount of instruction code for the data ferry and improve the efficiency of data ferrying.

[0064] Specifically, when a third-party program simulates sending packets to ferry data, for identity information packets, the data ferry will write to the internal identity information storage unit only if the identity verification passes, and return UDP.SetFlag.ACK. If the verification fails, the message will be discarded, not written, and not replied. Through this mechanism, the packet attack of the third party will be filtered by the data ferry. For business data packets, the third party sends packets, and the data that meets the CRC32 verification result will be written into the business data storage area of ​​the data ferry. Since the identity information data must be written after the data is sent to trigger the data ferrying behavior, and the identity information will be filtered because the verification fails, the written business data will not be ferryed and cannot reach the intranet. Overall, for any attack behavior on the external network, the data cannot reach the intranet. Because the UDP mechanism is adopted, it is connectionless and stateless. For any attack UDP message, the data ferry is a black hole in the eyes of third-party applications. The data sent in is absorbed, and the intranet does not have it.

[0065] It should be noted that, in the present application, unless otherwise clearly specified and limited, "connection", "setting" and other similar terms should be understood in a broad sense. For example, "connection" can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, an indirect connection through an intermediate medium, or the internal connection of two components. Technical personnel in the field can understand the specific meaning of the above terms in this application according to the specific circumstances.

[0066] The present invention has the following beneficial effects:

[0067] 1) The present invention can verify the identity information data in detail during data transmission, perform identity recognition and authentication, and use simple CRC verification for business data without content verification. The data ferry can reduce unnecessary processing overhead while ensuring data accuracy, thereby improving the overall efficiency of data transmission and processing.

[0068] 2) The data ferry in the present invention can easily identify and process different types of data without the need for complex parsing and verification of each business data packet, thereby improving the flexibility of the data ferry in processing different types of data.

[0069] Although the above methods are illustrated and described as a series of actions for simplicity of explanation, it should be understood and appreciated that these methods are not limited by the order of the actions, because according to one or more embodiments, some actions may occur in a different order and / or concurrently with other actions from those illustrated and described herein or not illustrated and described herein but understandable to those skilled in the art.

[0070] The construction and arrangement of the present application shown in a plurality of different exemplary embodiments are only exemplary. Although only a few embodiments are described in detail in this disclosure, it should be readily understood by those who refer to this disclosure that many modifications are possible (e.g., size, structure, shape and proportion, as well as parameter values, mounting arrangements, use of materials, color, directional changes, etc.) without substantially departing from the novel teachings and advantages of the subject matter described in the application. For example, the element shown as integrally formed can be composed of multiple parts or elements, the position of the element can be inverted or otherwise changed, and the nature or number or position of the discrete element can be changed or changed. Therefore, all such modifications are intended to be included in the scope of the present invention. The order or sequence of any process or method steps can be changed or reordered according to alternative embodiments. In the claims, any "device plus function" clause is intended to cover the structure described herein that performs the function, and is not only structurally equivalent but also equivalent structure. Without departing from the spirit and essence of the present invention, a person skilled in the art can make various corresponding modifications and changes according to the present invention, but these corresponding modifications and changes should all fall within the scope of protection of the present invention.

Claims

1. A network gate isolation switching system, comprising an external network end, an internal network end and a data ferry connected to the external network end and the internal network end respectively. In data transmission, one of the external network and the internal network is used as a command initiating network, and the other is used as a target network, characterized in that: The external network end and the internal network end are both provided with a data encapsulation module and a Flag module. The data encapsulation module is used to encapsulate the service data according to the communication protocol to obtain a service data packet. A CRC check code is provided at the end of the service data packet. The Flag module is used to configure the identity information of the service data to obtain an identity information data packet. The identity information data packet includes an identity authentication code, and the identity authentication code is a binary variable. The data ferryer includes a data packet transmission module, an identity verification module and a CRC verification module. The identity verification module is used to authenticate the identity information data packet. The CRC verification module is used to calculate the CRC value of the received business data, compare the calculated CRC value with the CRC verification code at the end of the business data packet, and determine whether the business data packet is complete. The data packet transmission module is used to forward the verified business data and / or identity information data to the target network.

2. The network gate isolation switching system according to claim 1, characterized in that: The communication protocol is the UDP protocol, the service data packet is a UDP message, and a CRC32 check code is set at the end of the service data packet.

3. The network gate isolation switching system according to claim 1, characterized in that: The identity information data packet is 32 bytes, including a 3-byte status identifier, a 4-byte time identifier, a 1-byte sequence number, a 19-byte identity authentication code, and a 3-byte status identifier; The identity authentication code is generated by performing MD5 operation on the first ten bytes of the identity information data packet.

4. The network gate isolation switching system according to claim 2, characterized in that: When the data packet transmission module transmits the verified service data, the verified service data is forwarded to the target network according to the fixed data length, and the fixed data length is less than the IP maximum message length of UDP; When the data packet transmission module transmits the verified identity information data, it forwards the complete identity information data packet to the target network.

5. The network gate isolation switching system according to claim 1, characterized in that: The data ferry device is FPGA.

6. The network gate isolation switching system according to claim 1, characterized in that: The data ferryer also includes a storage module, which includes an identity information storage unit and a business data storage unit. The identity information storage unit is used to store identity information data that has passed verification, and the business data storage unit is used to store business data that has passed verification.

7. A network gate isolation switching method, characterized in that: The method is applied to the network gate isolation switching system according to any one of claims 1 to 6, comprising the following steps: The data ferry receives the business data packet and identity information data packet from the instruction initiating network; Perform CRC check on the service data packet; Authenticating the identity information data packet; Only after the CRC check of the business data packet and the identity authentication of the identity information data packet have all passed, the business data from the instruction initiating network will be written into the data ferry; When the target network requests to obtain business data, the data ferry forwards the business data from the instruction initiating network to the target network after the identity authentication of the identity information data packet is passed.

8. The network gate isolation switching method according to claim 7, characterized in that: When the command initiates a network reset operation, if the reset is successful, the data ferry returns an ACK confirmation message; When the instruction initiates the network to set the identity information operation, if the data ferry passes the identity authentication, the identity information data will be overwritten and an ACK confirmation message will be returned, otherwise, the data will be discarded; When the instruction initiates the network to upload business data, if the data ferry passes the CRC check, the business data will be overwritten and an ACK confirmation message will be returned; otherwise, the data will be discarded.

9. The network gate isolation switching method according to claim 8, characterized in that: The ACK confirmation message is 32 bytes.

10. The network gate isolation switching method according to claim 7, characterized in that: When the target network performs an identity information read operation, the data ferry returns a complete identity information data packet; When the target network performs a read operation on business data, the data ferry forwards the verified business data according to the fixed data length.

Images