A data communication two-way ferry isolation device and method

Abstract

An embodiment of the present invention provides a data communication bidirectional ferry isolation device, comprising: a first processing unit, a second processing unit, and a ferry unit; wherein the ferry unit comprises a single-pole double-throw switch, a CPU, and a memory module; one or more ferry units are provided for bidirectional transmission of data packets; the single-pole double-throw switch is used to connect the transmission path between the first processing unit and the ferry unit or to connect the transmission path between the second processing unit and the ferry unit; when the first processing unit is connected to the ferry unit, the first processing unit is used for data interaction between the first network machine and the ferry unit; when the second processing unit is connected to the ferry unit, the second processing unit is used for data interaction between the second network machine and the ferry unit. The present invention designs and implements a multi-channel bidirectional ferry technology, which can realize bidirectional isolation and exchange of data of network systems in different security domains under the premise of ensuring that the physical paths of different security domains are relatively independent.

Description

Technical Field

[0001] The present invention relates to the field of information security interaction, and in particular to a data communication two-way ferry isolation device and method. Background Art

[0002] The main purpose of the two-way isolation product is to block cross-network connections, terminate the TCP / IP protocol, and implement the landing of application data in different security domains.

[0003] When using bidirectional isolation technology to exchange data between two networks, such as file synchronization between network A (external network) and network B (intranet), an application service similar to FTP can be started on the external machine of bidirectional isolation. The FTP client of a file server or a terminal user of network A can upload files to the FTP server of the bidirectional isolation external machine. After receiving the file, the FTP server performs a security check and uses a private encapsulation protocol to segment, mark, and encapsulate the data file, and then interacts with the file system of the internal machine through the isolation component. A program similar to the FTP application client is started on the internal machine to upload the file of the file system to the FTP server specified by network B. Of course, file synchronization can have various modes such as FTP, SAMBA, and SFTP. In addition to supporting file synchronization, it also supports synchronization modes for databases, audio and video streams, emails, and other data. The synchronization mode also has active mode (active acquisition by the internal and external machines of bidirectional isolation) or passive mode (active push by internal and external users).

[0004] The current structure of the two-way isolation technology is a 2+1 structure, which consists of three parts: an external network machine, an internal network machine, and a two-way ferry isolation device. The structure diagram is as follows: Figure 2 As shown. In actual application, the bidirectional isolation technology often faces competition in bandwidth, communication delay, concurrent access volume, etc. When implementing bidirectional isolation components, many manufacturers often use internal and external network machines to directly connect FPGA cards to bidirectional ferry isolation devices in order to pursue higher indicators. The bidirectional ferry isolation device is often implemented by adding FPGA card to optical fiber / coaxial cable / network cable. This method is contrary to the principle of ferrying. Although the TCP / IP protocol is stripped from the communication protocol level, the external network machine and the internal network machine are always in an online connection state. Once the FPGA board has a bug or its own program is hacked, it will directly cause the networks in two different security domains to form a direct path, and its security will be greatly reduced. Summary of the invention

[0005] In order to solve the above problems, the present invention provides a data communication two-way ferry isolation device and method. The present invention designs and implements a multi-channel two-way ferry technology, which can realize two-way isolation and exchange of data of network systems in different security domains while ensuring the relative independence of physical paths in different security domains.

[0006] In a first aspect of the present invention, a data communication bidirectional ferry isolation device is provided, comprising: a first processing unit, a second processing unit, and a ferry unit; wherein:

[0007] The ferry unit includes a single-pole double-throw switch, a CPU, and a memory module; one or more ferry units are provided for bidirectional transmission of data packets; the single-pole double-throw switch is used to connect the transmission path between the first processing unit and the ferry unit or to connect the transmission path between the second processing unit and the ferry unit;

[0008] When the first processing unit is connected to the ferry unit, the first processing unit is used to receive data sent by the first network machine, parse and split it into data packets and send it to the ferry unit; at the same time, receive data packets sent by the ferry unit, parse and reassemble them into data and send them to the first network machine;

[0009] When the second processing unit is connected to the ferry unit, the second processing unit is used to receive data sent by the second network machine, parse and split it into data packets and send them to the ferry unit; at the same time, it receives data packets sent by the ferry unit, parses and reassembles them into data and sends them to the second network machine.

[0010] Furthermore, the ferry unit CPU is used to control the movement of the single-pole double-throw switch, establish a communication link, and monitor the transmission status of data.

[0011] Furthermore, the memory module in the ferry unit is used for data caching.

[0012] Furthermore, multiple ferry units transmit data simultaneously and in parallel.

[0013] Furthermore, the first processing unit or the second processing unit includes: a CPU, a memory module, and a storage module; the CPU of the first processing unit or the second processing unit is used to establish a bidirectional data communication link through a communication protocol.

[0014] Furthermore, the CPU of the first processing unit or the second processing unit is also used to parse and split the data into data packets, or parse and reassemble the data packets into data.

[0015] Furthermore, the first processing unit or the second processing unit is respectively plugged into the first network machine or the second network machine in the form of a PCIe card.

[0016] In a second aspect of the present invention, a data ferrying method based on a data communication two-way ferrying isolation device is provided, using the above-mentioned two-way ferrying isolation device, comprising:

[0017] The first processing unit receives data from the first network machine, and the first processing unit parses and splits the data into a plurality of first data packets; the second processing unit receives data from the second network machine, and the second processing unit parses and splits the data into a plurality of second data packets;

[0018] The ferry unit is connected to the first processing unit and receives the first data packet A; the ferry unit disconnects the first processing unit and connects to the second processing unit, transmits the first data packet A and receives the second data packet A; the ferry unit disconnects the second processing unit and connects to the first processing unit, transmits the second data packet A and receives the first data packet B; one or more ferry units repeat the data packet transmission until all the first data packets and the second data packets are transmitted;

[0019] The second processing unit parses and reassembles the first data packets and transmits them to the second network machine; similarly, the first processing unit parses and reassembles the second data packets and transmits them to the first network machine, thereby realizing two-way data communication ferry isolation transmission.

[0020] Furthermore, before data transmission, the CPUs of the first processing unit and the second processing unit need to set the size of the parsed and split data packets according to the memory size of the ferry unit.

[0021] Furthermore, when there is no data transmission in either one direction or two directions, the ferry unit CPU will control the single-pole double-throw switch to switch between the first network machine and the second network machine in a time-rule polling manner.

[0022] The present invention provides a ferry component that can be physically connected and disconnected on demand, so as to ensure that the communication links formed by data in different security domains can be physically disconnected at any time, thereby ensuring that real-time, effective, and standard protocol-based communication links cannot be established between different security domains from a physical level.

[0023] It should be understood that the contents described in the summary of the invention are not intended to limit the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The above and other features, advantages and aspects of the embodiments of the present invention will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, wherein:

[0025] Figure 1 A connection diagram of a bidirectional ferry isolation device according to an embodiment of the present invention is shown;

[0026] Figure 2 A connection diagram of a conventional bidirectional ferry isolation device is shown. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] In addition, the term "and / or" in this article is only a description of the association relationship between the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0029] Refer to the following Figure 1 The first aspect of this embodiment is to provide a data communication bidirectional ferry isolation device, including: a first processing unit, a second processing unit, and a ferry unit; wherein:

[0030] The ferry unit includes a single-pole double-throw switch, a CPU, and a memory module; one or more ferry units are provided for bidirectional transmission of data packets; the single-pole double-throw switch is used to connect the transmission path between the first processing unit and the ferry unit or to connect the transmission path between the second processing unit and the ferry unit;

[0031] When the first processing unit is connected to the ferry unit, the first processing unit is used to receive data sent by the first network machine, parse and split it into data packets and send it to the ferry unit; at the same time, receive data packets sent by the ferry unit, parse and reassemble them into data and send them to the first network machine;

[0032] When the second processing unit is connected to the ferry unit, the second processing unit is used to receive data sent by the second network machine, parse and split it into data packets and send them to the ferry unit; at the same time, it receives data packets sent by the ferry unit, parses and reassembles them into data and sends them to the second network machine.

[0033] In the above embodiment, the ferry unit CPU is used to control the movement of the single-pole double-throw switch, establish a communication link, and monitor the transmission status of data.

[0034] In the above embodiment, the memory module in the ferry unit is used for caching data packets.

[0035] In the above embodiment, multiple ferry units transmit data in parallel at the same time. Multiple ferry units can be installed in a two-way ferry isolation device to achieve multi-channel transmission. The number of ferry units, data throughput speed, and switch switching speed play a decisive role in the data bandwidth of the entire system.

[0036] In the above embodiments, the first processing unit or the second processing unit includes: a CPU, a memory module, and a storage module; the CPU of the first processing unit or the second processing unit is used to establish a two-way data communication link through a communication protocol. The first processing unit and the second processing unit of this device are only artificially distinguished due to the setting of the data transmission function device. In fact, the working mode and logic of the first processing unit and the second processing unit are completely consistent. In order to better describe the working process of the data ferry device, the process is described in the order from the first processing unit to the second processing unit in the present invention. The first processing unit and the second processing unit can also be set as an intranet processing unit and an extranet processing unit according to the intranet and extranet data transmission.

[0037] In the above embodiment, the CPU of the first processing unit or the second processing unit is further used to parse and split the data into data packets, or parse and reassemble the data packets into data.

[0038] In the above embodiment, the first processing unit or the second processing unit is respectively plugged into the first network machine or the second network machine in the form of a PCIe card. The connection of the device here can be changed according to the requirements of the system hardware and connected in other forms.

[0039] In a second aspect of the present invention, a data ferrying method of a data communication two-way ferrying isolation device is provided, using the above-mentioned two-way ferrying isolation device, comprising:

[0040] The first processing unit receives data from the first network machine, and the first processing unit parses and splits the data into a plurality of first data packets; the second processing unit receives data from the second network machine, and the second processing unit parses and splits the data into a plurality of second data packets;

[0041] The ferry unit is connected to the first processing unit and receives the first data packet A; the ferry unit disconnects the first processing unit and connects to the second processing unit, transmits the first data packet A and receives the second data packet A; the ferry unit disconnects the second processing unit and connects to the first processing unit, transmits the second data packet A and receives the first data packet B; one or more ferry units repeat the data packet transmission at the same time until all the first data packets and the second data packets are transmitted;

[0042] The second processing unit parses and reassembles the first data packets and transmits them to the second network machine; similarly, the first processing unit parses and reassembles the second data packets and transmits them to the first network machine, thereby realizing two-way data communication ferry isolation transmission.

[0043] In the above embodiment, before data transmission, the CPUs of the first processing unit and the second processing unit need to set the size of the parsed and split data packets according to the memory size of the ferry unit.

[0044] In the above embodiment, when there is no data transmission in either one direction or two directions, the ferry unit CPU will control the single-pole double-throw switch to switch between the first network machine and the second network machine in a time-rule polling manner. This design avoids the problem that the ferry unit never responds when there is data transmission in one end processing unit.

[0045] The specific data ferrying method of the bidirectional ferry isolation device of the present invention is as follows:

[0046] The first data packet is formed: the first processing unit receives data from the first network machine, the first processing unit CPU parses the data according to the communication protocol to obtain data, and splits it into a number of first data packets and caches them in the memory module of the first processing unit, and the unsplit data is temporarily stored in the cache module;

[0047] Second data packet formation: the second processing unit receives data from the second network machine, the second processing unit CPU parses the data according to the communication protocol to obtain data, and splits it into a number of second data packets and caches them in the memory module of the second processing unit, and the unsplit data is temporarily stored in the cache module;

[0048] Data packet interaction: The ferry unit CPU controls the single-pole double-throw switch to connect to the first processing unit, and establishes a two-way communication link with the first processing unit through the communication protocol; the first processing unit transmits the first data packet A to the CPU of the ferry unit, and caches it in the memory module of the ferry unit. After the first data packet A is transmitted, the ferry unit CPU controls the single-pole double-throw switch to disconnect from the first processing unit, switch to connect to the second processing unit and establish a two-way communication link;

[0049] The ferry unit transmits the first data packet A to the CPU of the second processing unit and stores it in the memory module of the second processing unit; at the same time, the second processing unit transmits the second data packet A to the CPU of the ferry unit and stores it in the memory module of the ferry unit; after the CPU of the ferry unit detects that the first data packet A and the second data packet A have been transmitted, the single-pole double-throw switch is controlled to disconnect the connection of the second processing unit, switch to connect with the first processing unit and establish a two-way communication link;

[0050] The ferry unit transmits the second data packet A to the CPU of the first processing unit and stores it in the memory module of the first processing unit; at the same time, the first processing unit transmits the first data packet B to the CPU of the ferry unit and stores it in the memory module of the ferry unit; after the CPU of the ferry unit detects that the second data packet A and the first data packet B have been transmitted, the single-pole double-throw switch is controlled to disconnect the connection of the first processing unit, switch to connect with the second processing unit and establish a two-way communication link;

[0051] When the device contains a ferry unit: the ferry unit continues to transmit the first data packet B in the memory module of the ferry unit to the second processing unit according to the above data packet interaction process, and transmits the second data packet B of the second processing unit to the first processing unit, and repeats the process until all data packets in the first processing unit and the second processing unit are transmitted, the ferry unit CPU stops, and the data ferry transmission is completed;

[0052] When the device contains multiple ferry units: the multiple ferry units work simultaneously, and all transmit data packets according to the above data packet interaction process; the multiple ferry units are physically isolated from each other, and their working logic is also independent of each other; the first processing unit and the second processing unit can both transmit data packets with multiple ferry units at the same time;

[0053] The second processing unit parses and reassembles the first data packets into data, and transmits the data to the second network machine; similarly, the first processing unit parses and reassembles the second data packets into data, and transmits the data to the first network machine, thereby realizing two-way ferry isolation transmission of data communication.

[0054] On the physical level between the ferry unit provided by the present invention and the first and second processing units, at a certain moment, there is only a connection mode that is not connected to either party or is only connected to one of the parties. No matter which connection mode is used, the first and second network machines and their effective physical extension data paths will not form a direct or indirect physical path; when multiple ferry units work simultaneously on a system, regardless of whether their switching actions and switching times are synchronized, the first and second network machines and their effective physical extension data paths form a direct or indirect physical path due to their mutual physical isolation and independent characteristics; multiple ferry units have their own logical programs during operation, even if they have bugs or are hacked by viruses, they form a direct or indirect physical path in the first and second network machines and their effective physical extension data paths due to the single-pole double-throw switch. It can be seen that the ferry unit can physically connect and disconnect the communication link as needed, so as to ensure that the communication link formed by data in different security domains at any time can be physically disconnected, ensuring that real-time, effective, and standard protocol-based communication links cannot be established between different security domains from a physical level.

[0055] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described order of actions, because according to the present invention, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0056] In the description of this specification, the description of the terms "one embodiment", "some embodiments", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0057] The above are only preferred embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A data communication bidirectional ferry isolation device, characterized in that: include: A first processing unit, a second processing unit, and a ferry unit; wherein, The ferry unit includes a single-pole double-throw switch, a CPU, and a memory module; the ferry unit is provided with one or more for bidirectional transmission of data packets; the single-pole double-throw switch is used to connect the transmission path between the first processing unit and the ferry unit or to connect the transmission path between the second processing unit and the ferry unit; When the first processing unit is connected to the ferry unit, the first processing unit is used to receive data sent by the first network machine, parse and split it into data packets and send it to the ferry unit; at the same time, receive data packets sent by the ferry unit, parse and reassemble them into data and send them to the first network machine; When the second processing unit is connected to the ferry unit, the second processing unit is used to receive data sent by the second network machine, parse and split it into data packets and send it to the ferry unit; at the same time, receive data packets sent by the ferry unit, parse and reassemble them into data and send them to the second network machine; The ferry unit CPU is used to control the movement of the single-pole double-throw switch, establish a communication link, and monitor the transmission status of data; A plurality of the ferry units transmit data simultaneously and in parallel.

2. The two-way ferry isolation device according to claim 1 is characterized in that: The memory module in the ferry unit is used for caching data packets.

3. The two-way ferry isolation device according to claim 1 is characterized in that: The first processing unit or the second processing unit includes: a CPU, a memory module, and a storage module; the CPU of the first processing unit or the second processing unit is used to establish a bidirectional data communication link through a communication protocol.

4. The two-way ferry isolation device according to claim 3 is characterized in that: The CPU of the first processing unit or the second processing unit is further used to parse and split the data into data packets, or parse and reassemble the data packets into the data.

5. The two-way ferry isolation device according to claim 4 is characterized in that: The first processing unit or the second processing unit is respectively plugged into the first network machine or the second network machine in the form of a PCIe card.

6. A data ferrying method based on a data communication bidirectional ferrying isolation device, characterized in that: The bidirectional ferry isolation device according to any one of claims 1 to 5 comprises: The first processing unit receives data from the first network machine, and the first processing unit parses and splits the data into a plurality of first data packets; the second processing unit receives data from the second network machine, and the second processing unit parses and splits the data into a plurality of second data packets; The ferry unit is connected to the first processing unit and receives the first data packet A; the ferry unit disconnects the first processing unit and connects to the second processing unit, transmits the first data packet A and receives the second data packet C; the ferry unit disconnects the second processing unit and connects to the first processing unit, transmits the second data packet C and receives the first data packet B; one or more ferry units repeat the data packet transmission at the same time until all the first data packets and the second data packets are transmitted; The second processing unit parses and reassembles a number of first data packets and transmits them to the second network machine; similarly, the first processing unit parses and reassembles a number of second data packets and transmits them to the first network machine, thereby realizing two-way ferry isolation transmission of data communication.

7. The data ferrying method according to claim 6, characterized in that: Before data transmission, the CPUs of the first processing unit and the second processing unit need to parse and split the size of the data packet according to the memory size setting of the ferry unit.

8. The data ferrying method according to claim 6, characterized in that: When there is no data transmission in either one direction or two directions, the ferry unit CPU will control the single-pole double-throw switch to switch between the first network machine and the second network machine in a time-rule polling manner.

Images