Unidirectional isolation optical shutter equipment and data transfer method thereof

Abstract

The invention discloses a one-way isolation optical shutter device and a data transfer method thereof, and relates to the technical field of network security isolation device data transmission, and the data transfer method applied to a one-way isolation optical shutter extranet machine device comprises the following steps: S1, starting a program A to check historical configuration; s2, the program A loads the program B, and the loaded configuration is issued to the program B through the eBPFMap; s3, the program B obtains the data packet from the input network card; s4, the program B judges a source IP address and a source port in the current data packet; s5, the program B modifies a target IP address, a target port and a target network card interface in the current data packet; s6, the program B calculates a checksum according to the IP header and UDP header load data; and S7, sending the modified data packet through an optical fiber channel of the one-way isolation optical gate device. According to the scheme provided by the invention, the data packet only has two copying processes in the sending process, and signal interruption triggering is not needed.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission of network security isolation devices, and particularly relates to a unidirectional isolation air gap device and a data transfer method thereof. Background Art

[0002] With the rapid development of information technology, the importance of network security is self-evident. Specifically, it has become a common technical means to prevent attacks from untrusted networks through network security isolation devices. For example, unidirectional isolation air gaps are used between the internal office network and the external office network to achieve two-way isolation and data exchange. Among them, the isolation air gap isolates the low-security-level network and the high-security-level network through dedicated isolation components, which can not only resist various attack behaviors based on the TCP / IP protocol but also achieve moderately controllable data exchange between networks of different security levels. Similarly, due to the particularity of the deployment and hardware structure of the unidirectional isolation air gap, there are the following disadvantages when it forwards data: 1. The performance is relatively low. In the prior art, the general process is that the external network machine of the air gap uses the UDP proxy protocol to receive incoming data, and then the sending end encapsulates the incoming data with UDP and forwards it through the fiber channel to the UDP receiving server of the internal network machine. After unpacking, the UDP proxy program of the internal network machine sends the data to the internal network server using the corresponding protocol. In this process, the data must go through the network card to the kernel to the user state, and then from the user state to the kernel and then to the network card. This process involves multiple packet copies and requires an interrupt signal to trigger, which will seriously affect the data transmission performance.

[0003] 2. It is not stable enough. Each UDP proxy of each protocol requires an additional UDP forwarding program to cooperate. Since the UDP forwarding program works in the user state, its performance in receiving data will directly affect whether UDP packets are lost. Packet loss will become an inevitable phenomenon during large traffic or high-speed transmission.

[0004] 3. The scalability is insufficient. As can be seen from the disadvantage 2, due to the diversity of user requirements, multiple UDP proxies and forwarding programs are necessarily required to cooperate, which will inevitably increase the maintenance and labor costs.

[0005] In view of this, this invention is specifically proposed. Summary of the Invention

[0006] The purpose of the present invention is to solve the disadvantages existing in the prior art, and to propose a unidirectional isolation air gap device and a data transfer method thereof, in which the data packet only has 2 copying processes during the sending process and does not require an interrupt signal to trigger.

[0007] To achieve the above purpose, the present invention adopts the following technical solutions: A data transfer method for the external network machine of a unidirectional isolation optical switch, configured with Program A and Program B. Program A is an external network side UDP configuration program, and Program B is an external network side XDP bytecode program B, including the following steps: S1: Start Program A, check the historical configuration through Program A. When there is a historical configuration, read the historical configuration and load the historical configuration into memory.

[0008] S2: Program A loads Program B, attaches Program B to the data input network card, and issues the loaded configuration to Program B through eBPFMap.

[0009] S3: Program B obtains data packets from the input network card according to the configuration information in eBPFMap.

[0010] S4: Program B determines whether the source IP address and source port in the configuration information in eBPFMap are the same as the source IP address and source port in the currently obtained data packet. If they are not the same, the data packet is released.

[0011] S5: Program B modifies the destination IP address, destination port, and destination network card interface in the current data packet to the destination IP address, destination port, and destination network card interface in the configuration information in eBPFMap respectively, and obtains the modified data packet.

[0012] S6: Program B calculates the checksum according to the IP header \ UDP header \ payload data.

[0013] S7: Send the modified data packet through the fiber channel of the unidirectional isolation optical switch device.

[0014] Further, in S1, when there is no historical configuration, a new configuration item is constructed and S2 is entered.

[0015] Further, in S1, when Program A receives a configuration stop instruction, Program B is unloaded, and the currently stored configuration information is saved to the local disk and then exited.

[0016] To achieve the above object, the present invention also adopts the following technical solution: A data transfer method for the internal network machine of a unidirectional isolation optical switch, configured with Program C and Program D. Program C is an external network side UDP configuration program, and Program D is an external network side XDP bytecode program D, including the following steps: S1: Start Program C, check the historical configuration through Program C. When there is a historical configuration, read the historical configuration and load the historical configuration into memory.

[0017] S2: Program C loads Program D, attaches Program D to the data input network card, and issues the loaded configuration to Program D through eBPFMap.

[0018] S3: Program D obtains data packets from the input network card according to the configuration information in the eBPFMap.

[0019] S4: Program D determines whether the destination IP address, destination port, and destination network card in the configuration information in the eBPFMap are the same as those in the currently obtained data packet. If they are not the same, the data packet is discarded.

[0020] S5: Program D calculates the checksum based on the IP header \ UDP header \ payload data.

[0021] S6: Send the data packet through the network card output interface matched by the eBPF Map.

[0022] Furthermore, in S1, when there is no historical configuration, a new configuration item is constructed and S2 is entered.

[0023] Furthermore, in S1, when Program C receives a configuration stop instruction, Program D is uninstalled, and the currently stored configuration information is saved to the local disk and then exited.

[0024] To achieve the above object, the present invention also adopts the following technical solution: A one-way isolation air gap external network machine device, comprising: At least one processor; And a memory communicatively connected to the at least one processor.

[0025] Wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the steps of any one of the one-way isolation air gap external network machine data transfer methods provided by the present invention.

[0026] To achieve the above object, the present invention also adopts the following technical solution: A one-way isolation air gap internal network machine device, comprising: At least one processor; And a memory communicatively connected to the at least one processor.

[0027] Wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the steps of any one of the one-way isolation air gap external network machine data transfer methods provided by the present invention.

[0028] To achieve the above object, the present invention also adopts the following technical solution: A one-way isolation air gap device, comprising: The one-way isolation air gap external network machine device provided by the present invention; And, the one-way isolation optical switch intranet device provided by the present invention.

[0029] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. There are only 2 replication processes during the data packet sending process, so the memory replication cost is reduced; there is no need for an interrupt signal trigger, so the time cost generated by the interrupt signal switching during the user mode and kernel mode switching is reduced.

[0030] 2. Because the number of replications is reduced, the CPU participation is extremely small, and the dependence on the CPU during high-speed data transmission is extremely small, which can effectively reduce the system load; and because the number of replications is reduced and the user mode packet processing function is removed, the forwarding performance and stability can be improved.

[0031] 3. It is easy to expand. For the same type of forwarding requirements, only relevant entries need to be configured to achieve the function, which can effectively reduce the maintenance and labor costs; that is, the solution uses user mode control for different data types, and specific rules can be used for different traffic, which belongs to dynamic programming, and a single solution can be compatible with the vast majority of environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 It is a deployment diagram of a one-way isolation optical switch device.

[0033] Figure 2 It is a flowchart of a data transfer method for the external network machine of a one-way isolation optical switch.

[0034] Figure 3 It is a flowchart of a data transfer method for the internal network machine of a one-way isolation optical switch. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0035] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments.

[0036] Embodiment 1: A one-way isolation optical switch device, as Figure 1 shown, includes: an external network machine device and an internal network machine device.

[0037] The external network machine device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the steps of the following data transfer method for the external network machine of the one-way isolation optical switch.

[0038] A data transfer method for the external network machine of a one-way isolation optical switch, configured with Program A and Program B. Program A is an external network side UDP configuration program, and Program B is an external network side XDP bytecode program B. As Figure 2 shown, it includes the following steps: S11: Start Program A, check the historical configuration through Program A. When there is a historical configuration, read the historical configuration and load the historical configuration into memory.

[0039] S12: Program A loads Program B, attaches Program B to the data input network card, and issues the loaded configuration to Program B through eBPFMap.

[0040] S13: Program B obtains data packets from the input network card according to the configuration information in eBPFMap.

[0041] S14: Program B determines whether the source IP address and source port in the configuration information in eBPFMap are the same as the source IP address and source port in the currently obtained data packet. If they are not the same, the data packet is released.

[0042] S15: Program B modifies the destination IP address, destination port, and destination network card interface in the current data packet to the destination IP address, destination port, and destination network card interface in the configuration information in eBPFMap respectively, and obtains the modified data packet.

[0043] S16: Program B calculates the checksum according to the IP header \ UDP header \ payload data.

[0044] S17: Send the modified data packet through the fiber channel of the one-way isolation optical switch device.

[0045] In an optional embodiment, in S11, when there is no historical configuration, a new configuration item is constructed, and S12 is entered.

[0046] In an optional embodiment, in S11, when Program A receives a configuration stop instruction, unload Program B, save the currently stored configuration information to the local disk, and then exit.

[0047] In the data transfer method for the external network machine of the one-way isolation optical switch in this embodiment, the XDP bytecode program is attached to the input network card in a generic manner, selectively receives the external network UDP input stream according to the configuration, and after re-encapsulating it, directly sends the data to the internal network input network card according to the configuration.

[0048] The described intranet machine device includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein, the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the steps of the following one-way isolation air gap intranet machine data transfer method.

[0049] A one-way isolation air gap intranet machine data transfer method is configured with program C and program D. Program C is an external network side UDP configuration program, and program D is an external network side XDP bytecode program D. As Figure 3 shown, it includes the following steps: S21: Start program C, check the historical configuration through program C. When there is a historical configuration, read the historical configuration and load the historical configuration into memory.

[0050] S22: Program C loads program D, attaches program D to the data input network card, and distributes the loaded configuration to program D through eBPFMap.

[0051] S23: Program D obtains data packets from the input network card according to the configuration information in eBPFMap.

[0052] S24: Program D determines whether the destination IP address, destination port, and destination network card in the configuration information in eBPFMap are the same as those in the currently obtained data packet. If they are not the same, the data packet is discarded.

[0053] S25: Program D calculates the checksum according to the IP header \ UDP header \ payload data.

[0054] S26: Send the data packet through the network card outgoing interface matched by eBPF Map.

[0055] In an optional embodiment, in S21, when there is no historical configuration, a new configuration item is constructed and S2 is entered.

[0056] In an optional embodiment, in S21, when program C receives a configuration stop instruction, program D is unloaded, and the currently stored configuration information is saved to the local disk and then exited.

[0057] In the one-way isolation air gap external network machine data transfer method of this embodiment, the XDP bytecode program is attached to the input network card in a generic manner, receives the UDP input stream encapsulation packet forwarded by the external network according to the configuration, and after de-encapsulation, directly sends the data to the internal network server according to the configuration.

[0058] In summary, in the solution of this embodiment, there are only two replication processes during the data packet sending process, thus reducing the memory replication cost; there is no need for an interrupt signal trigger, thus reducing the time cost generated by the interrupt signal switching during the user mode and kernel mode switching; on the other hand, because the number of replications is reduced, the CPU is rarely involved, and there is little dependence on the CPU during high-speed data transmission, which can effectively reduce the system load; and because the number of replications is reduced and the user mode packet processing function is removed, the forwarding performance and stability can be improved; on the other hand, it is easy to expand. For the same type of forwarding requirements, only relevant entries need to be configured to achieve the function, which can effectively reduce the maintenance and labor costs; that is, the solution uses user mode control for different data types, can use specific rules for different traffic, belongs to dynamic programming, and a single solution can be compatible with the vast majority of environments.

[0059] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention, according to the technical solution and inventive concept of the present invention, makes equivalent substitutions or changes, and should be covered by the protection scope of the present invention.

Claims

1. A one-way isolation optical gate external network machine data transfer method, configured with program A and program B, program A is the external network side UDP configuration program, program B is the external network side XDP bytecode program B, characterized in that: The steps include: S1: Start program A, check the historical configuration through program A, read the historical configuration if it exists, and load the historical configuration into the memory; S2: Program A loads program B, attaches program B to the data input network card, and sends the loaded configuration to program B through eBPFMap; S3: Program B obtains data packets from the input network card according to the configuration information in eBPFMap; S4: Program B determines whether the source IP address and source port in the configuration information in the eBPFMap are consistent with the source IP address and source port in the current data packet obtained. If they are inconsistent, the data packet is released; S5: Program B modifies the target IP address, target port, and target network card interface in the current data packet to the target IP address, target port, and target network card interface in the configuration information in the eBPFMap, and obtains the modified data packet; S6: Program B will calculate the checksum based on the IP header\UDP header\payload data; S7: Send the modified data packet through the optical fiber channel of the unidirectional isolation optical gate device.

2. According to the one-way isolation optical gate external network machine data transfer method of claim 1, it is characterized in that: In S1, when there is no historical configuration, a new configuration item is constructed and enters S2.

3. A one-way isolation optical gate external network machine data transfer method according to claim 1, characterized in that: In S1, when program A receives the configuration stop instruction, it uninstalls program B, saves the currently stored configuration information to the local disk, and then exits.

4. A one-way isolation optical gate intranet machine data transfer method, configured with program C and program D, program C is an external network side UDP configuration program, program D is an external network side XDP bytecode program D, characterized in that: The steps include: S1: Start program C, check the historical configuration through program C, read the historical configuration if it exists, and load the historical configuration into the memory; S2: Program C loads program D, attaches program D to the data input network card, and sends the loaded configuration to program D through eBPFMap; S3: Program D obtains data packets from the input network card according to the configuration information in eBPFMap; S4: Program D determines whether the target IP address, target port, and target network card in the configuration information in the eBPFMap are consistent with the target IP address, target port, and target network card in the current data packet obtained. If they are inconsistent, the data packet is discarded; S5: Program D will calculate the checksum based on the IP header\UDP header\payload data; S6: Send the data packet through the network card outbound interface matched by the eBPF Map.

5. A one-way isolation optical gate external network machine data transfer method according to claim 4, characterized in that: In S1, when there is no historical configuration, a new configuration item is constructed and enters S2.

6. A one-way isolation optical gate external network machine data transfer method according to claim 4, characterized in that: In S1, when program C receives the configuration stop instruction, it uninstalls program D, saves the currently stored configuration information to the local disk, and then exits.

7. A one-way isolation optical gate external network device, characterized in that: include: at least one processor; and, a memory communicatively coupled to the at least one processor; Wherein, the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the steps of the one-way isolation optical gate external network machine data transfer method described in any one of claims 1 to 3.

8. A one-way isolation optical gate intranet device, characterized in that: include: at least one processor; and, a memory communicatively coupled to the at least one processor; Wherein, the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the steps of the one-way isolation optical gate external network machine data transfer method described in any one of claims 4 to 6.

9. A one-way isolation optical shutter device, characterized in that: include: The one-way isolation optical gate external network device as described in claim 7; And, the one-way isolation optical gate intranet device as described in claim 8.

Images