Secure sharing system for external equipment between internal and external network equipment

Abstract

The invention provides an external equipment security sharing system between internal and external network equipment. The external equipment security sharing system comprises a control signal processor used for securely transmitting a control instruction of external HID equipment between the equipment; the control signal processor is respectively connected with an external computer host connected to an external network and an internal computer host connected to an internal network and isolated from the external network, and a control instruction of external HID equipment received by the external computer host is safely transmitted to the internal computer host through the control signal processor; and hardware isolation, protocol conversion, data encryption and watermark addition are adopted, so that the data security of an internal computer host is ensured. The data security of the internal computer host can be effectively ensured while the internal computer host and the external computer host share the external equipment.

Description

Technical Field

[0001] This application relates to the field of computer security one-way communication, and particularly to an external device security sharing system between internal and external network devices. Background Art

[0002] In many application scenarios with high security requirements, such as the medical field, financial field, government departments, etc., strict isolation of internal and external network devices needs to be implemented to prevent internal network data from leaking to the external network. However, in actual work, it is necessary to temporarily share the graphical user interface of an internal computer connected to the internal network with personnel on the external network, and even authorize external network personnel to operate the internal computer. At the same time, to improve the operation convenience and desktop neatness of the staff, it is hoped that the internal computer and an external computer connected to the external network can share external HID devices such as keyboards, mice, monitors, etc.

[0003] The traditional shared KVM solution allows users to control multiple computers through a set of KVMs, and there are two ways: one is the network solution, where two computers achieve KVM sharing through network connection and shared control software; the other is the hardware KVM switch solution to achieve shared switching.

[0004] The network solution is based on network protocols such as IP-KVM, and special software needs to be installed on two computers. It has the risk of two-way communication and there is a problem that the internal network has low security as it may be penetrated by network attackers using protocol vulnerabilities. Summary of the Invention

[0005] This application aims at the problems in the prior art and provides an external device security sharing system between internal and external network devices, which can realize the internal computer host sharing the external devices of the external computer host, and at the same time, the data security isolation between the internal and external network computers reaches the security level of physical isolation.

[0006] An external device security sharing system between internal and external network devices includes: a control signal processor for securely transmitting control instructions of external HID devices between devices and a security isolation architecture;

[0007] The control signal processor is respectively connected to an external computer host connected to the external network and an internal computer host connected to the internal network and isolated from the external network, and securely transmits the control instructions of the external HID devices received by the external computer host to the internal computer host through the control signal processor;

[0008] The security isolation architecture includes hardware isolation, protocol conversion, data encryption, and watermark addition to ensure the data security of the internal computer host.

[0009] Further, the control signal processor includes a first interface connected to the external computer host, a second interface connected to the internal computer host, and a security encryption and decryption module. The first interface establishes an encrypted communication link with the external computer host using the virtual serial port protocol. The second interface complies with the USB HID1.11 protocol specification. The security encryption and decryption module integrates an SM4 national encryption algorithm chip and an HMAC-SH256 verification unit, and is respectively connected to the first interface and the second interface;

[0010] The external computer host converts the control instructions of the external HID device into data that meets the virtual serial port protocol and encrypts it based on the SM4-CBC mode to obtain encrypted control instructions, and sends them to the control signal processor;

[0011] The control signal processor receives the encrypted control instructions through the first interface and transmits them to the security encryption and decryption module;

[0012] The security encryption and decryption module decrypts the encrypted control instructions to obtain the decrypted control instructions of the external HID device, and after verifying the integrity of the decrypted control instructions of the external HID device through CRC-32, transmits them to the second interface;

[0013] The second interface converts the decrypted control instructions of the external HID device into a standard report format that complies with the USB HID protocol specification and transmits them to the internal computer host.

[0014] Further, it also includes: a unidirectional video data transmission cable that only allows the transmission of unidirectional video data streams;

[0015] The unidirectional video data transmission cable is respectively connected to the internal computer host and the external computer host. The internal computer host can only transmit video data streams to the external computer host unidirectionally through the unidirectional video data transmission cable. Among them, the video data stream is used to display the graphical user interface screen that is dynamically updated after the internal computer host responds to the control instructions.

[0016] Further, it also includes a video capture card configured on the external computer host. The internal computer host is connected to the video capture card through the unidirectional video data transmission cable and transmits the video data stream to the video capture card unidirectionally;

[0017] The external computer host generates a display window of the internal computer host and renders the video data stream to the display window of the internal computer host. Among them, the display window of the internal computer host is an independent application window of the external computer host.

[0018] Further, the external computer host monitors the handle of the current active window in real time, obtains the handle of the current active window through the GetForegroundWindow function. If the display window of the internal computer host is in the active state, the external computer host transmits the control instruction of the external HID device to the internal computer host through the control signal processor;

[0019] If the display window of the internal computer host is in the inactive state, the external computer host performs an operation corresponding to the control instruction of the external HID device according to the control instruction of the external HID device.

[0020] Further, the external computer host generates a first watermark image containing the external computer host and login information, and merges the first watermark image with the video data stream.

[0021] Further, after the external computer host establishes a remote connection with the remote computer host, it receives the remote control instruction of the external HID device sent by the remote computer host, and unidirectionally transmits the remote control instruction to the internal computer host through the control signal processor.

[0022] Further, the external computer host generates a second watermark image containing the remote computer host and login information, and merges the second watermark image with the video data stream.

[0023] Further, the external computer host monitors the handle of the current active window in real time. If the display window of the internal computer host is in the active state, it performs an authentication operation on the identity information of the operator;

[0024] If the authentication is passed, the external computer host is allowed to transmit the control instruction of the external HID device to the internal computer host through the control signal processor;

[0025] If the authentication fails, the external computer host is prohibited from transmitting the control instruction of the external HID device to the internal computer host through the control signal processor.

[0026] Further, the external computer host generates a third watermark image containing the identity information of the operator, and merges the third watermark image with the video data stream.

[0027] Further, the unidirectional video data transmission cable at least includes an HDMI cable, and both the CEC pin and the HEC pin of the HDMI cable are in a cut-off state, physically cutting off the electrical connection of the reverse communication channel.

[0028] Compared with the prior art, the present application connects an internal computer host in an internal network and an external computer host in an external network through a unidirectional video data transmission cable and a control signal processor, realizing that only the video data stream of the internal computer host is unidirectionally transmitted to the external computer host through the unidirectional video data transmission cable. In addition, the external computer host unidirectionally transmits the control instructions of the external HID device to the internal computer host through the control signal processor. It can be seen that through physical isolation, the present application avoids the possibility of the external computer host reverse penetrating or stealing data from the internal network through the unidirectional video data transmission cable. At the same time, the external computer host can only transmit control instructions to perform limited operations on the internal computer host and cannot obtain the data of the internal computer host from the control signal processor, thereby effectively improving the security of the internal network.

[0029] In order to more clearly understand the present application, the specific implementation manners of the present application will be described below in conjunction with the accompanying drawings. Brief Description of the Drawings

[0030] Figure 1 It is a schematic diagram of an external device security sharing system between internal and external network devices of the present application;

[0031] Figure 2 It is a schematic diagram of an external device security sharing system between internal and external network devices including a video capture card;

[0032] Figure 3 It is a specific schematic diagram of an external HID device in an external device security sharing system between internal and external network devices;

[0033] Figure 4 It is a specific schematic diagram of a control signal processor in an external device security sharing system between internal and external network devices;

[0034] Figure 5 It is a schematic diagram of an external device security sharing system between internal and external network devices including a remote computer host. Detailed Description of the Preferred Embodiments

[0035] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative efforts shall fall within the protection scope of the present application.

[0036] It should be understood that the schematic drawings are not drawn to actual scale. The flowcharts used in this application illustrate operations implemented according to some embodiments of this application. It should be understood that the operations in the flowchart may not be implemented in sequence, and steps without a logical context relationship may be reversed or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart or remove one or more operations from the flowchart under the guidance of the content of this application.

[0037] References to "embodiments" in this document mean that the specific features, structures, or characteristics described in connection with the embodiments can be included in at least one embodiment of this application. The phrase appears in various places in the specification and does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0038] Please refer to Figure 1 , Figure 1 , which is a schematic diagram of an external device security sharing system between internal and external network devices of this application. This application provides an external device security sharing system between internal and external network devices, specifically including: a control signal processor for securely transmitting control instructions of an external HID device between devices, a one-way video data transmission cable that only allows the transmission of a one-way video data stream, and a security isolation architecture;

[0039] The control signal processor is respectively connected to an external computer host connected to the external network and an internal computer host connected to the internal network and isolated from the external network, and securely transmits the control instructions of the external HID device received by the external computer host to the internal computer host through the control signal processor. Among them, the control signal processor transmits the control instructions of the external HID device unidirectionally between devices, specifically transmits the control instructions of the external HID device received by the external computer host to the internal computer host unidirectionally through the control signal processor, to achieve secure transmission between devices such as the external computer host and the internal computer host.

[0040] The one-way video data transmission cable is respectively connected to the internal computer host and the external computer host. The internal computer host can only transmit a video data stream to the external computer host unidirectionally through the one-way video data transmission cable. Among them, the video data stream is used to display the graphical user interface screen dynamically updated by the internal computer host in response to the control instructions.

[0041] The security isolation architecture includes hardware isolation, protocol conversion, data encryption, and watermark addition to ensure the data security of the internal computer host.

[0042] In this embodiment, the external network may be the public Internet. The internal network may be an internal local area network in fields such as the medical field and the financial field, which is used to store highly confidential data. For example, in the medical field, the internal network stores sensitive content such as patients' personal identity information, disease diagnosis records, treatment plans, etc.; in the financial field, the internal network stores key data such as customers' account information and transaction records. Therefore, the internal network is strictly prohibited from being connected to the external network to avoid the leakage of data in the internal network due to potential threats from the external network, thereby protecting the security and privacy of the data.

[0043] The external computer host is a computer device connected to the external network, which allows users to access the external network and serves as an operation terminal for interacting with the external and controlling the internal computer host in this application. For example, it can be a desktop computer or a laptop computer connected to the Internet that ordinary users use daily. The internal computer host is a computer device, medical device, server, etc. connected to the internal network.

[0044] Taking the medical field as an example, the internal computer host connected to the hospital local area network is deployed with an electronic medical record system and a Picture Archiving and Communication Systems (PACS), etc., which are used to store highly confidential information such as patients' medical information. The external computer host connected to the Internet can conduct medical literature queries and online consultations, etc. by accessing the Internet.

[0045] The unidirectional video data transmission cable is a cable that can only achieve unidirectional transmission of video data streams. Its characteristic is to block the control signals with bidirectional data transmission capabilities in standard video data transmission cables, and only enable the video data stream to be transmitted from one end to the other end, thereby ensuring that the data of the internal computer host will not be leaked to the external computer host through the unidirectional video data transmission cable, and at the same time ensuring that the external computer host cannot send instructions such as obtaining data to the internal computer host through the unidirectional video data transmission cable, improving the security of the system. Preferably, the unidirectional video data transmission cable includes HDMI cables, DVI cables, and VGA cables. Among them, the CEC (Consumer Electronics Control) pins and (HDMI Ethernet Channel) pins of the HDMI cable are both in a cut-off state. Specifically, the 13th, 14th, and 19th pins of the HDMI cable are in a cut-off state, physically cutting off the electrical connection of the reverse communication channel.

[0046] Compared with the prior art, in this solution, an internal computer host on the internal network and an external computer host on the external network are connected through a unidirectional video data transmission cable, so that only the video data stream of the internal computer host is allowed to be unidirectionally transmitted to the external computer host through the unidirectional video data transmission cable. In addition, the external computer host unidirectionally transmits control instructions to the internal computer host through a control signal processor. It can be seen that through physical isolation, this application avoids the possibility of the external computer host reverse-penetrating or stealing data from the internal network through the unidirectional video data transmission cable. At the same time, the external computer host can only transmit control instructions to perform limited operations on the internal computer host and cannot obtain the data of the internal computer host from the control signal processor, thereby effectively improving the security of the internal network.

[0047] In one embodiment, please refer to Figure 2 , Figure 2 which is a schematic diagram of an external device security sharing system between internal and external network devices including a video capture card. It also includes a video capture card configured in the external computer host. The video capture card can be built into the external computer host or externally connected to the external computer host. The internal computer host is connected to the video capture card through the unidirectional video data transmission cable and unidirectionally transmits the video data stream to the video capture card.

[0048] The external computer host generates a display window of the internal computer host and renders the video data stream to the display window of the internal computer host. Among them, the display window of the internal computer host is an independent application window of the external computer host.

[0049] Specifically, the external computer host can obtain the video data stream from the video capture card and run a window application program such as a window program based on Qt / WinForms. This window application program can display the video data stream from the internal computer host in real time through a rendering engine such as OpenGL or DirectX.

[0050] Through the display window of the internal computer host, the user can simultaneously compare and view the screens of the external computer host and the internal computer host without frequent switching, effectively improving the user's work efficiency. It solves the problem in the prior art that based on a hardware KVM switch, through physical switches or electronic signal sharing and switching, only "one-to-one" signal switching is supported, and the screens of the external computer host and the internal computer host cannot be compared and displayed in a split-screen or picture-in-picture manner at the same time, resulting in the operator being unable to view the screens of the external computer host and the internal computer host simultaneously and causing a reduction in work efficiency.

[0051] Among them, the video capture card is a device for capturing video data, which can receive video data from a specific signal source (such as a signal transmitted from an internal computer host through a unidirectional video data transmission cable) and convert it into a digital signal format that can be processed by a computer. In this embodiment, the video capture card captures the video data stream transmitted from the internal computer host for processing and display by an external computer host. Preferably, the video data capture card is an HDMI capture card with pre-burned and fixed EDID information, and the CEC pin and HEC pin of the HDMI capture card are both in a cut-off state, specifically, the 13th pin, 14th pin, and 19th pin of the HDMI capture card are in a cut-off state.

[0052] The external computer host can generate the internal computer host display window in the external computer host based on a preset screen splitting ratio. The user can view the information of the local computer host and the internal computer host simultaneously, which is convenient for interaction and operation. Specifically, the splitting ratio can be set to 1:1. Of course, the user can adjust the screen splitting ratio arbitrarily according to their own needs. The internal computer host display window can also be freely adjusted in position and size and is controlled by the window manager.

[0053] The external computer host dynamically generates a first watermark image containing the external computer host and login information. Specifically, when the window application displays the video data stream from the internal computer host in real time through the rendering engine, the first watermark image is merged with the video data stream. Among them, the external computer host and login information include the username of the external computer host, the host IP address, and the login timestamp, etc. The first watermark image can be used as a tracking clue to help identify the source of the leaked screen of the internal computer host, thereby effectively deterring and reducing data leakage behavior and improving the data security of the internal network.

[0054] In another embodiment, please refer to Figure 3 , Figure 3 which is a specific schematic diagram of an external HID device in an external device security sharing system between internal and external network devices. The external HID device includes a mouse, a keyboard, a display, etc. This embodiment is not limited, and existing external HID devices can be used. The mouse, keyboard, and display are connected to the external computer host, and the display is used to display the local graphical user interface (GUI) of the external computer host. The control instructions of the external HID device include input signals of the mouse and keyboard, etc.

[0055] The external computer host monitors the handle of the current active window in real time, and obtains the handle of the current active window through the GetForegroundWindow function in the API of the Window system. If the display window of the internal computer host is in the active state, the external computer host transmits the control instruction of the external HID device to the internal computer host through the control signal processor;

[0056] If the display window of the internal computer host is in the inactive state, the external computer host will execute the operation corresponding to the control instruction of the external HID device according to the control instruction of the external HID device.

[0057] By monitoring the active state of the display window of the internal computer host, the dynamic switching of the control rights of the internal computer host and the external computer host is realized, which can effectively improve the operation efficiency in a multi-window environment.

[0058] Specifically, the external computer host can receive the input signals of the mouse and keyboard. For example, it can execute corresponding operations such as inputting a character or opening a file through the key code signal of the keyboard and the movement and click signals of the mouse. After switching the current window to the display window of the internal computer host, the external computer host transmits the control instruction of the external HID device to the internal computer host through the control signal processor. After receiving the control instruction of the external HID device, the operating system and related driver programs of the internal computer host can parse and process the control instruction of the external HID device, so as to realize the control of the internal computer host and execute operations such as inputting a character or opening a file in the internal computer host.

[0059] In other embodiments, the mouse, keyboard and monitor are connected to the external computer host, and the internal computer host can be only connected to the monitor. The external computer host is only connected to the internal computer host through the control signal processor, and is used to unidirectionally transmit the control instruction of the external HID device of the external computer host to the internal computer host through the control signal processor.

[0060] The external computer host can receive the input signals of the mouse and keyboard, such as the key code signal of the keyboard and the movement and click signals of the mouse, and execute corresponding operations such as inputting a character or opening a file. The external computer host can unidirectionally transmit the input signals of the mouse and keyboard to the internal computer host through the control signal processor. After receiving the input signals of the mouse and keyboard, the operating system and related driver programs of the internal computer host can parse and process the input signals of the mouse and keyboard, so as to realize the control of the internal computer host.

[0061] Of course, one or more combination keys on the keyboard can also be set as the shortcut keys for switching control rights. The external computer host listens for the pressing event of the shortcut keys for switching control rights by setting a monitoring program. When it is detected that the shortcut keys for switching control rights are pressed, the external computer host performs an operation of unidirectionally transmitting the input signals of the mouse and keyboard to the internal computer host through the control signal processor.

[0062] In this embodiment, please refer to Figure 4 , Figure 4 which is a specific schematic diagram of the control signal processor in an external device security sharing system between internal and external network devices. The control signal processor includes a first interface connected to the external computer host, a second interface connected to the internal computer host, and a security encryption and decryption module. The first interface establishes an encrypted communication link with the external computer host using the virtual serial port protocol. The second interface is configured as a USB human-computer interaction device interface and complies with the USB HID1.11 protocol specification. The security encryption and decryption module is connected to the first interface and the second interface. Among them, the security encryption and decryption module integrates an SM4 national encryption algorithm chip and an HMAC-SH256 verification unit.

[0063] The external computer host converts the control instructions of the external HID device into data that meets the virtual serial port protocol and encrypts it based on the SM4-CBC mode to obtain encrypted control instructions, and sends them to the control signal processor.

[0064] The control signal processor receives the encrypted control instructions through the first interface and transmits them to the security encryption and decryption module.

[0065] The security encryption and decryption module decrypts the encrypted control instructions to obtain the decrypted control instructions of the external HID device. After verifying the integrity of the decrypted control instructions of the external HID device through CRC-32, it transmits the decrypted control instructions of the external HID device to the second interface.

[0066] The second interface converts the decrypted control instructions of the external HID device into a standard report format that complies with the USB HID protocol specification and transmits them to the internal computer host.

[0067] Specifically, the external computer host is connected to the first interface of the control signal processor through the USB CDC protocol and is recognized as a virtual serial port device. The external computer host calls the system functions of the operating system to collect the control instructions of the external HID device, such as the input data of peripherals like keyboards and mice, encrypts them using the AES-256-GCM algorithm, encapsulates them into a control instruction serial data frame, and sends them to the control signal processor through the first interface. Of course, encryption can also be performed through algorithms such as AES-128 or SHA-256 to make the encrypted control instruction serial data frame meet commercial cryptography standards such as the international standard AES-256 or SHA-256, etc.

[0068] The control signal processor can use an STM32F4 series MCU chip, which is a controller with dual USB physical interfaces. The first USB physical interface and the second USB physical interface are the first interface and the second interface respectively. The first USB physical interface receives the encrypted control instructions from the external computer host in Device mode. The second USB physical interface executes the USB HID class in Device mode, converts the control instructions of the external HID device into a standard report format that conforms to the USB HID protocol specification, and sends it to the internal computer host, enabling the internal computer host to recognize it as a HID device such as a keyboard or a mouse and perform related operations.

[0069] Before the external computer host sends the encrypted control instructions, the HMAC-SH256 is used to generate a verification authentication code for the control instructions of the external HID device. After the control signal processor decrypts it, through the verification authentication code, it is confirmed that the control instructions of the external HID device have not been tampered with by a man-in-the-middle.

[0070] In addition, the first USB physical interface can be configured as a receive-only mode. Specifically, the transmit endpoint (IN endpoint) is closed in the firmware, and only the receive endpoint (OUT endpoint) is retained. It can also be restricted at the protocol layer so that the external host cannot actively pull data through the virtual serial port and can only send encrypted control instructions unidirectionally. The first USB physical interface, as a standard HID input device (such as a keyboard / mouse), only supports sending HID reports to the internal computer host and has no receive function. The output endpoint can also be disabled in the firmware implementation to ensure that the internal computer host cannot send data in the reverse direction.

[0071] The STM32F4 series MCU chip also has a built-in security encryption and decryption module, which can specifically be a hardware encryption engine (AES / SM4) and an OTP storage area. The preset key can be loaded from the OTP area, and the AES engine is called to decrypt the encrypted control instructions.

[0072] The control signal processor enables the one-way transmission of the HID signal only from the external computer host to the internal computer host, effectively preventing the reverse leakage of internal network data to the external computer host and enhancing the security of internal network data.

[0073] Moreover, by encrypting the control instructions for the external HID device, the confidentiality of the control instructions during transmission can be significantly improved. At the same time, encryption can also ensure the integrity of the control instructions to a certain extent. When the security encryption and decryption module decrypts the instructions, it can verify whether the control instructions of the external HID device have been tampered with during transmission. Once an anomaly is detected, it is prohibited from being sent to the internal computer host to prevent the execution of incorrect instructions and ensure the data security of the internal computer host.

[0074] In another embodiment, the external computer host monitors the current active window handle in real time. If the display window of the internal computer host is in the active state, a permission authentication operation is performed on the operator's identity information;

[0075] If the permission authentication is passed, the control instructions of the external HID device are allowed to be transmitted to the internal computer host through the control signal processor;

[0076] If the permission authentication fails, the control instructions of the external HID device are prohibited from being transmitted to the internal computer host through the control signal processor.

[0077] By setting the permission authentication operation, unauthorized users can be prevented from accessing the internal network, effectively enhancing the data security of the internal network.

[0078] Specifically, the permission authentication operation can be implemented in various ways, such as: username and password verification: requiring the operator to enter a username and password; digital certificate verification: using a digital certificate for identity verification; biometric identification: such as fingerprint recognition, facial recognition, etc.

[0079] The external computer host dynamically generates a third watermark image containing the operator's identity information. Specifically, when the window application program displays the video data stream from the internal computer host in real time through the rendering engine, the third watermark image is merged with the video data stream. Among them, the operator's identity information includes the operator's identity ID, login timestamp, etc. The third watermark image can be used as a tracking clue to help identify the person who leaks the screen of the internal computer host, thus effectively deterring and reducing data leakage behavior and enhancing the data security of the internal network.

[0080] In this embodiment, please refer to Figure 5 , Figure 5Schematic diagram of an external device security sharing system between an internal and external network device, including a remote computer host. After establishing a remote connection with the remote computer host, the external computer host receives the remote control instructions of the external HID device sent by the remote computer host, and unidirectionally transmits the remote control instructions to the internal computer host through the control signal processor.

[0081] The remote computer host can establish a remote connection with the remote computer host through remote desktop software such as Sunflower, TeamViewer, etc. After the remote connection is established, the internal computer host window screen generated by the external computer host is real-time sent to the remote computer host through the remote software, so as to enable the user to view the local screen of the remote computer host and the screen of the internal computer host simultaneously in the remote computer host.

[0082] The remote control instructions are the control instructions of the external HID device received by the remote computer host, such as the input signals of the keyboard and mouse, and are used to control the internal computer host to perform corresponding operations. The remote control instructions are unidirectionally transmitted to the internal computer host through the control signal processor, realizing the secure interaction between the remote computer host and the internal computer host, and effectively improving the data security of the internal network.

[0083] The external computer host dynamically generates a second watermark image containing the remote computer host and login information. Specifically, when the window application program displays the video data stream from the internal computer host in real time through the rendering engine, the second watermark image is merged with the video data stream. Among them, the remote computer host and login information include the user name, IP address, login timestamp, etc. of the remote computer host. The second watermark image can be used as a tracking clue to help identify the person who leaks the screen of the internal computer host, thus effectively deterring and reducing data leakage behavior and improving the data security of the internal network.

[0084] This application is not limited to the above embodiments. If various changes or deformations to this application do not depart from the spirit and scope of this application, and if these changes and deformations belong to the scope of the claims of this application and equivalent technical scope, then this application also intends to include these changes and deformations.

Claims

1. An external device security sharing system between internal and external network devices, characterized in that, Including: A control signal processor and a security isolation architecture for securely transmitting control instructions of an external HID device between devices; The control signal processor is respectively connected to an external computer host connected to an external network and an internal computer host connected to an internal network and isolated from the external network, and securely transmits the control instructions of the external HID device received by the external computer host to the internal computer host through the control signal processor; The security isolation architecture includes hardware isolation, protocol conversion, data encryption, and watermark addition to ensure the data security of the internal computer host.

2. The external device security sharing system between internal and external network devices according to claim 1, wherein, The control signal processor includes a first interface connected to the external computer host, a second interface connected to the internal computer host, and a security encryption and decryption module. The first interface establishes an encrypted communication link with the external computer host using the virtual serial port protocol. The second interface complies with the USB HID1.11 protocol specification. The security encryption and decryption module integrates an SM4 national encryption algorithm chip and an HMAC-SH256 verification unit, and is respectively connected to the first interface and the second interface; The external computer host converts the control instructions of the external HID device into data that meets the virtual serial port protocol and encrypts it based on the SM4-CBC mode to obtain encrypted control instructions, and sends them to the control signal processor; The control signal processor receives the encrypted control instructions through the first interface and transmits them to the security encryption and decryption module; The security encryption and decryption module decrypts the encrypted control instructions to obtain the decrypted control instructions of the external HID device, and after verifying the integrity of the decrypted control instructions of the external HID device through CRC-32, transmits them to the second interface; The second interface converts the decrypted control instructions of the external HID device into a standard report format that complies with the USB HID protocol specification and transmits them to the internal computer host.

3. An external device security sharing system between internal and external network devices according to any one of claim 2, characterized in that Also including: A unidirectional video data transmission cable that only allows the transmission of unidirectional video data streams; The unidirectional video data transmission cable is respectively connected to the internal computer host and the external computer host. The internal computer host can only transmit video data streams to the external computer host unidirectionally through the unidirectional video data transmission cable. Among them, the video data stream is used to display the graphical user interface screen dynamically updated by the internal computer host in response to the control instructions.

4. The external device security sharing system between internal and external network devices according to claim 3, characterized in that, Also including a video capture card configured on the external computer host. The internal computer host is connected to the video capture card through the unidirectional video data transmission cable and transmits the video data stream to the video capture card unidirectionally; The external computer host generates a display window of the internal computer host and renders the video data stream to the display window of the internal computer host. Among them, the display window of the internal computer host is an independent application window of the external computer host.

5. The external device security sharing system between internal and external network devices according to claim 4, wherein The external computer host monitors the handle of the current active window in real time, obtains the handle of the current active window through the GetForegroundWindow function. If the display window of the internal computer host is in the active state, the external computer host transmits the control instruction of the external HID device to the internal computer host through the control signal processor; If the display window of the internal computer host is in the inactive state, the external computer host performs an operation corresponding to the control instruction of the external HID device according to the control instruction of the external HID device.

6. The external device security sharing system between internal and external network devices according to claim 4, characterized in that It includes: the external computer host generates a first watermark image containing the external computer host and login information, and merges the first watermark image with the video data stream.

7. An external device security sharing system between internal and external network devices according to claim 3, characterized in that, After the external computer host establishes a remote connection with the remote computer host, it receives the remote control instruction of the external HID device sent by the remote computer host, and unidirectionally transmits the remote control instruction to the internal computer host through the control signal processor.

8. The external device security sharing system between internal and external network devices according to claim 7, characterized in that, The external computer host generates a second watermark image containing the remote computer host and login information, and merges the second watermark image with the video data stream.

9. An external device security sharing system between internal and external network devices according to claim 5, characterized in that, The external computer host monitors the handle of the current active window in real time. If the display window of the internal computer host is in the active state, it performs an authority authentication operation on the operator's identity information; If the authority authentication is passed, the external computer host is allowed to transmit the control instruction of the external HID device to the internal computer host through the control signal processor; If the authority authentication fails, the external computer host is prohibited from transmitting the control instruction of the external HID device to the internal computer host through the control signal processor.

10. The external device security sharing system between internal and external network devices according to claim 9, characterized in that, The external computer host generates a third watermark image containing the operator's identity information, and merges the third watermark image with the video data stream.

11. The external device security sharing system between internal and external network devices according to claim 2, characterized in that, The unidirectional video data transmission cable at least includes an HDMI cable, and the CEC pin and HEC pin of the HDMI cable are both in the cut-off state, physically cutting off the electrical connection of the reverse communication channel.

Images