Cross-network transmission integrated system supporting multi-protocol agents

Abstract

The present invention discloses a cross-network transmission integrated system supporting multi-protocol proxy, including forward and reverse proxy devices connected between a sending end device and a receiving end device, wherein the forward and reverse proxy devices respectively include a switching proxy board, a security processing board, a one-way transmission board, a data exchange board, and a configuration management board connected through a platform backplane; data sending or receiving software is respectively installed in the sending end device and the receiving end device to provide information exchange services for the forward and reverse proxy devices; the forward and reverse proxy devices realize identity authentication and data exchange through the connection of the data exchange board and the switching proxy board between the two. The system of the present invention integrates multiple functions such as virus detection and killing, application layer protocol proxy, data security inspection, and one-way isolated transmission, effectively ensuring the safe transmission of data, files, and application layer protocols between different networks, and can be widely used in the field of cross-network information exchange.

Description

Technical Field

[0001] The invention belongs to the field of cross-network information exchange and relates to a cross-network transmission integrated system supporting multi-protocol agents. Background Art

[0002] With the continuous growth of application requirements between business networks at different levels, business information exchange systems have put forward higher requirements for the security of cross-network data, exchange agent mode, and equipment deployment capabilities. Traditional exchange agents and one-way transmission serial connection modes cause equipment redundancy, complex deployment, and high pressure on operation and maintenance, which have certain limitations. In addition, common network gates or other one-way transmission devices can solve the one-way transmission of data and files, but cannot realize the transmission and interaction of common application layer protocols. At the same time, it is also difficult to ensure the security of data and file transmission, such as whether the transmitted files contain sensitive information, whether they are implanted with Trojans, and whether the file format is compliant. Summary of the invention

[0003] In view of the above-mentioned prior art, the present invention provides an integrated cross-network transmission system that supports multi-protocol proxies. The present invention supports common application layer protocol proxies such as Http, FTP, SMTP, Pop3, etc., realizes file virus detection and killing, data format and content inspection based on security policies, provides network isolation and data unidirectional transmission functions based on physical optical fiber, and is widely used in the field of cross-network information exchange.

[0004] In order to solve the above technical problems, the present invention proposes an integrated cross-network transmission system supporting multi-protocol proxy, including a sending end device and a receiving end device, between which a forward proxy device and a reverse proxy device are connected, and the forward proxy device and the reverse proxy device respectively include a switching proxy board connected through a platform backplane, a security processing board, a unidirectional transmission board, a data exchange board, and a configuration management board;

[0005] The sending end device is deployed with data sending software composed of a sending software API interface library, which is used for identity authentication and data transmission and reception between the reverse proxy device;

[0006] In the forward proxy device and reverse proxy device: the switching proxy board performs virus scanning on the protocol packets sent by the cross-network data sending software and the general application layer protocol, performs private protocol parsing and conversion after the scanning, and establishes a protocol policy table; the application layer protocol is subjected to payload data stripping, two-level destination address mapping, and then encapsulated into a private format data message and sent to the security processing board; at the same time, the reverse proxy is performed on the application protocol message transmitted in the reverse direction, the private application protocol packet is reorganized, and sent to the receiving network according to the corresponding destination address information and connection status; various configuration management instructions of the configuration management area are received; the security processing board performs two-way connection authentication based on digital certificates with the sending end device through a commercial asymmetric algorithm; and the integrity of the transmitted business message is verified Certificate, source legitimacy identification; based on the security policy, the message file type and format check, file content filtering, traffic monitoring, log management, the message that passes the check is sent to the one-way transmission board; the one-way transmission board is connected in series between the security processing board and the data exchange board, connecting the only optical transmission of the security processing board and the only optical reception of the data exchange board. The optical transmission and the optical reception are connected by a physical optical fiber, and an optical reverse inhibitor is installed on the optical fiber to achieve reliable one-way data transmission without feedback; the data exchange board receives the data message transmitted by the optical one-way transmission board, and realizes business data forwarding and configuration management through message analysis; realizes identity authentication and data security exchange with the reverse proxy device; the configuration management board adopts B / S architecture and deploys web server services. The administrator enters the user name and password through the management terminal device browser for identity authentication and enters the configuration management interface to realize system management, application management, security policy management, log auditing, and status query;

[0007] The data exchange board of the forward proxy device is connected to the exchange proxy board of the reverse proxy device, and the data exchange board of the reverse proxy device is connected to the exchange proxy board of the forward proxy device, so as to realize identity authentication and data security exchange between the forward proxy device and the reverse proxy device.

[0008] The reverse proxy device is connected to the receiving end device, and the receiving end device deploys data receiving software, which is composed of a receiving software API interface library and performs identity authentication and data transmission and reception with the reverse proxy device.

[0009] Furthermore, in the present invention, the switching agent board, security processing board and data switching board each include basic components, including a CPU processor, a bridge chip, a DDR4 memory, an SSD hard disk and a PHY chip; the CPU processor is respectively connected to the bridge chip, the DDR4 memory and the PHY chip, and the CPU processor is respectively connected to the SSD hard disk and the PCIe interface of the platform backplane through the bridge chip for data transmission; the bridge chip set is used to realize the external USB, VGA, PCIe, SATA interface expansion function of the CPU processor; the DDR4 memory is used for data message caching and operating system caching; the SSD hard disk is used for data storage and system storage.

[0010] In the security processing board, in addition to the basic components, the CPU processor is also connected to a network isolation FPGA through a bridge chip, and the network isolation FPGA is connected to a DDR3 memory, and the DDR3 memory is used for business data caching of the network isolation FPGA; the network isolation FPGA is respectively connected to the PCIe interface of the platform backplane and the SDIO interface of the platform backplane for data transmission; the network isolation FPGA communicates with the CPU processor through the PCIe interface of the bridge chip.

[0011] The unidirectional transmission board includes an optical unidirectional sending board and an optical unidirectional receiving board, and the optical unidirectional sending board and the optical unidirectional receiving board are connected by an optical fiber with an optical reverse inhibitor, so as to perform unidirectional data transmission; the optical unidirectional sending board includes an optical unidirectional sending FPGA and an optical sending module, and the optical unidirectional receiving board includes an optical receiving module and an optical unidirectional receiving FPGA, and the optical unidirectional receiving FPGA is connected to a DDR3 memory, and the DDR3 memory is used for caching the service data of the optical unidirectional receiving FPGA; the optical unidirectional sending FPGA is connected to the CPU processor of the security processing board through the PCIe interface of the platform backplane; the optical unidirectional receiving FPGA is connected to the CPU processor of the data exchange board through the PCIe interface of the platform backplane.

[0012] The configuration management board includes a CPU processor, a Flash chip and a PHY chip. In the configuration management board, the CPU processor is connected to the Flash chip and the PHY chip for data transmission; the Flash chip is used for data storage and system storage; the CPU processor is connected to the network isolation FPGA of the security processing board through the SDIO interface channel of the platform backplane; the configuration management board is connected to the gigabit network interface of the management terminal device through the gigabit network port.

[0013] The network isolation FPGA of the security processing board is connected to the CPU processor of the switching agent board through the PCIe interface of the platform backplane; the CPU processor of the security processing board is connected to the optical unidirectional sending FPGA of the unidirectional transmission board through the PCIe interface of the platform backplane; the security processing board is connected to the CPU processor of the configuration management board through the SDIO interface of the platform backplane; the CPU processor of the data exchange board is connected to the optical unidirectional receiving FPGA of the unidirectional transmission board through the PCIe interface of the platform backplane.

[0014] The connection relationship between the sending end device, the forward proxy device, the reverse proxy device and the receiving end device is: the CPU processor of the switching proxy board of the forward proxy device is connected to the sending end device through a gigabit network interface; the CPU processor of the data switching board of the forward proxy device is connected to the CPU processor of the switching proxy board of the reverse proxy device through a gigabit network interface; the CPU processor of the switching proxy board of the reverse proxy device is connected to the receiving end device through a gigabit network interface.

[0015] Furthermore, in the unidirectional transmission board, two sets of differential lines are used to connect the optical unidirectional transmission FPGA and the optical transmission module, and the optical unidirectional reception FPGA and the optical reception module respectively; the optical transmission module and the optical reception module are connected by the optical fiber with the optical reverse inhibitor, and the Faraday effect of the magneto-optical crystal is used to isolate light reflection and suppress the optical reverse signal.

[0016] Furthermore, the optical unidirectional sending board of the switching agent board, security processing board, and unidirectional transmission board is independently powered by one power supply, and the optical unidirectional receiving board and data exchange board of the unidirectional transmission board are independently powered by another power supply, and both power supplies adopt a redundant power supply design and are separated by optical fiber.

[0017] Compared with the prior art, the present invention has the following beneficial effects:

[0018] (1) In the unidirectional transmission board in the system of the present invention, an optical reverse inhibitor is connected in series on the optical fiber link between the optical transmitting module and the optical receiving module, and the Faraday light deflection effect is used to effectively shield the reflection light source loop from the physical characteristics, thereby realizing low insertion loss, high reliability and high stability of optical unidirectional transmission.

[0019] (2) A multi-layer in-depth security protection architecture is designed in the system of the present invention. A two-way security loop for proxying the application layer protocol is constructed through forward and reverse proxy devices. At the same time, a multi-level inspection and filtering mechanism based on security policies is designed, which has a high security defense capability.

[0020] (3) The system of the present invention integrates multiple functions such as virus detection, application layer protocol proxy, data security check, and one-way isolated transmission, which facilitates the rapid deployment and maintenance of the information exchange system, improves the intelligent operation and maintenance capabilities of the system, realizes the automation of information collection, transmission and processing, and effectively guarantees the secure transmission of data, files, and application layer protocols between different networks, meets the information exchange between different networks in specific scenarios, and can be widely used in the field of cross-network information exchange. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a connection diagram of the integrated system for cross-network transmission supporting multi-protocol proxy of the present invention;

[0022] Figure 2 It is a schematic diagram of power supply connection in the present invention;

[0023] Figure 3 A schematic diagram of the hardware connection between the boards in the present invention;

[0024] Figure 4 A schematic diagram of the hardware connection of the switching agent board in the present invention;

[0025] Figure 5 A schematic diagram of the hardware connection of the security processing board in the present invention;

[0026] Figure 6 A schematic diagram of the hardware connection of the one-way transmission board in the present invention;

[0027] Figure 7 A schematic diagram of the hardware connection of the data exchange board in the present invention;

[0028] Figure 8 A schematic diagram of the hardware connection of the configuration management board in the present invention;

[0029] Fig. 9 The present invention supports the cross-network transmission integrated system protocol proxy transmission flow chart of multi-protocol proxy;

[0030] Fig.10 It is a schematic diagram of the host software framework of the system of the present invention;

[0031] Fig.11 This is the data transmission process in the system of the present invention. DETAILED DESCRIPTION

[0032] The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments, but the following embodiments are by no means intended to limit the present invention in any way.

[0033] The present invention proposes a cross-network transmission integrated system supporting multi-protocol proxy, including a sending end device and a receiving end device, such as Figure 1 , Figure 2 and Figure 3 As shown, a forward proxy device and a reverse proxy device are connected between the sending end device and the receiving end device. The internal components of the forward proxy device and the reverse proxy device are the same, and both include a switching proxy board, a security processing board, a one-way transmission board, a data exchange board, and a configuration management board connected through a platform backplane. The sending end device is deployed with data sending software composed of a sending software API interface library, which is used for identity authentication and data transmission and reception with the reverse proxy device; the data exchange board of the forward proxy device is connected to the exchange proxy board of the reverse proxy device, and the data exchange board of the reverse proxy device is connected to the exchange proxy board of the forward proxy device, so as to realize identity authentication and data security exchange between the forward proxy device and the reverse proxy device; the data exchange board of the forward proxy device is connected to the exchange proxy board of the reverse proxy device, and the data exchange board of the reverse proxy device is connected to the exchange proxy board of the forward proxy device, so as to realize identity authentication and data security exchange between the forward proxy device and the reverse proxy device; the reverse proxy device is connected to the receiving end device, and the receiving end device deploys data receiving software, which is composed of a receiving software API interface library and performs identity authentication and data transmission and reception with the reverse proxy device.

[0034] like Figure 1 As shown, in order to facilitate installation and replacement, the switching proxy board and the data switching board are designed as the same hardware architecture in the present invention. The sending end device and the switching proxy board use the RGMII Gigabit network interface for communication; the switching proxy board, security processing board, unidirectional transmission board and data switching board inside the device all use the PCIe interface for communication, the security processing board and the configuration management board use the SDIO interface for communication, and the internal boards are all connected through the platform backplane; the data switching board and the reverse proxy device use the RGMII Gigabit network interface for communication; the optical unidirectional transmission board and the optical unidirectional receiving board of the unidirectional transmission board are connected through an optical fiber isolation device with a reverse inhibitor to achieve physical isolation within the system.

[0035] like Figure 3 As shown, the cross-network transmission integrated system supporting multi-protocol proxy of the present invention adopts a platform plus board architecture in hardware design, and each board is connected in a serial manner, wherein each level of board mainly includes a switching agent board, a security processing board, a unidirectional transmission board, a data exchange board and a configuration management board. The boards are connected through the platform backplane, and the optical unidirectional transmission board and the optical unidirectional receiving board of the unidirectional transmission board are connected only through an optical fiber isolation device for unidirectional data transmission, thereby realizing physical isolation within the system. The hardware connection diagram of the cross-network transmission integrated system supporting multi-protocol proxy is shown in FIG. Figure 2As shown in the figure, in terms of hardware and structural design, the switching agent board and the data switching board conform to the same physical electrical and structural design specifications. The two use completely identical hardware designs, which facilitates equipment maintenance and deployment.

[0036] like Figure 1 , Figure 2 , Figure 3 and Figure 4 As shown, the switching proxy board in the present invention realizes functions such as virus detection and killing, application protocol policy checking, forward and reverse proxy, etc. Figure 4 As shown, the hardware of the switching proxy board includes the switching proxy board CPU processor, the switching proxy board PHY chip, the switching proxy board bridge chip, the switching proxy board DDR4 memory, and the switching proxy board SSD hard disk. The switching proxy board CPU processor is connected to the switching proxy board DDR4 memory, the switching proxy board SSD hard disk, the PHY chip, and the PCIe interface with the platform backplane for data transmission. The bridge chip matching the CPU processor is selected to realize the external USB, VGA, PCIe, SATA and other interface expansion functions of the CPU processor; the DDR4 memory is used for data message cache and operating system cache; the SSD hard disk is used for data storage and system storage. The switching proxy board CPU processor is connected to the data message sending end device through the Gigabit network interface. The switching proxy board CPU processor is connected to the network isolation FPGA of the security processing board through the PCIe interface of the platform backplane. The switching proxy board performs virus scanning on the protocol packets sent by the cross-network data transmission software and the general application layer protocol, and performs private protocol parsing and conversion after the scanning, and establishes a protocol policy table; the application layer protocol is subjected to payload data stripping, two-level destination address mapping, and then encapsulated into a private format data message and sent to the security processing board; at the same time, reverse proxy is performed on the application protocol message transmitted in the reverse direction, and the private application protocol packet is reorganized and sent to the receiving network according to the corresponding destination address information and connection status; various configuration management instructions are received from the configuration management area;

[0037] like Figure 1 , Figure 2 , Figure 3 and Figure 5 As shown, in the present invention, the security processing board realizes the functions of network blocking, message integrity protection, data source legitimacy identification, message format inspection based on security inspection strategy, content filtering, file type inspection, flow monitoring, log auditing, etc. Figure 5As shown, the hardware of the security processing board includes the security processing board CPU processor, the security processing board network isolation FPGA, the security processing board bridge chip, the security processing board DDR3 memory, the security processing board DDR4 memory, and the security processing board SSD hard disk. The security processing board network isolation FPGA is connected to the security processing board DDR3 memory, the PCIe interface of the platform backplane, and the SDIO interface of the platform backplane for data transmission; the security processing board CPU processor is connected to the security processing board DDR4 memory, the security processing board SSD hard disk, and the PCIe interface of the platform backplane for data transmission; the network isolation FPGA and the CPU processor communicate through the PCIe interface of the bridge chip. The bridge chip matching the CPU processor is selected to realize the external USB, VGA, PCIe, SATA and other interface expansion functions of the CPU processor; the DDR3 memory is used for the business data cache of the network isolation FPGA; the DDR4 memory is used for the data message cache of the CPU processor and the operating system cache; the SSD hard disk is used for data storage and system storage. The network isolation FPGA of the security processing board is connected to the switching agent board through the PCIe interface of the platform backplane, and is connected to the configuration management board through the SDIO interface of the platform backplane; the CPU processor of the security processing board is connected to the one-way transmission board through the PCIe interface of the platform backplane. The security processing board performs a two-way connection authentication based on a digital certificate with the sending end device through a commercial asymmetric algorithm; performs integrity verification and source legitimacy authentication on the transmitted business message; performs file type and format inspection, file content filtering, traffic monitoring, and log management on the message based on the security policy, and sends the message that passes the inspection to the one-way transmission board.

[0038] like Figure 1 , Figure 2 , Figure 3 and Figure 6 As shown, in the system of the present invention, the unidirectional transmission board is connected in series between the security processing board and the data exchange board, connecting the only optical transmission of the security processing board and the only optical reception of the data exchange board. The optical transmission and the optical reception are connected by a physical optical fiber, and an optical reverse inhibitor is installed on the optical fiber to achieve reliable unidirectional transmission of data without feedback. The unidirectional transmission board is connected in series to the entire transmission link to achieve unidirectional transmission of data without feedback and ensure that the direction of data transmission is controllable. The unidirectional transmission board is composed of an optical unidirectional transmission board and an optical unidirectional reception board, which are two completely independent circuit boards and are powered by power board 1 and power board 2 respectively, so that the optical unidirectional transmission and the optical unidirectional reception are completely independent. The two circuit boards are connected by a physical optical fiber with a reverse inhibitor. As shown Figure 6As shown, the hardware of the unidirectional transmission board includes a unidirectional transmission board optical unidirectional transmission FPGA, a unidirectional transmission board optical transmission module, a unidirectional transmission board optical receiving FPGA, a unidirectional transmission board optical receiving module, a unidirectional transmission board optical reverse inhibitor, and a unidirectional transmission board DDR3 memory. The unidirectional transmission board optical unidirectional transmission FPGA and the optical transmission module are connected by two sets of differential lines; the unidirectional transmission board optical unidirectional receiving FPGA and the optical receiving module are connected by two sets of differential lines; the optical transmission module and the optical receiving module are connected by an optical fiber with an optical reverse inhibitor, and the Faraday effect of the magneto-optical crystal is used to isolate light reflection and suppress light reverse signals. The unidirectional transmission board DDR3 memory is used for caching the service data of the optical unidirectional receiving FPGA to solve the packet loss problem caused by the instantaneous rate mismatch of the interface caused by the real-time performance of the PCIe interface. The unidirectional transmission board optical unidirectional transmission FPGA is connected to the security processing board through the PCIe interface of the platform backplane; the optical unidirectional receiving FPGA is connected to the data exchange board through the PCIe interface of the platform backplane.

[0039] like Figure 1 , Figure 2 , Figure 3 and Figure 7 As shown, in the system of the present invention, the data exchange board receives the data message transmitted by the optical unidirectional transmission board, and realizes business data forwarding and configuration management through message analysis; and realizes identity authentication and data security exchange with the reverse proxy device. Figure 7 As shown, the data exchange board realizes the functions of business data forwarding, local area configuration management, etc. through message parsing and processing. The hardware design of the data exchange board is basically the same as that of the exchange agent board, mainly including the data exchange board CPU processor, the data exchange board PHY chip, the data exchange board bridge set, the data exchange board DDR4 memory, and the data exchange board SSD hard disk. The data exchange board CPU processor connects the data exchange board DDR4 memory, the data exchange board SSD hard disk, the PHY chip, and the PCIe interface with the platform backplane for data transmission. The bridge set matching the CPU processor is selected to realize the external USB, VGA, PCIe, SATA and other interface expansion functions of the CPU processor; the DDR4 memory is used for data message cache and operating system cache; the SSD hard disk is used for data storage and system storage. The data exchange board CPU processor is connected to the optical unidirectional receiving FPGA of the unidirectional transmission board through the PCIe interface of the platform backplane. The data exchange board CPU processor is connected to the reverse proxy device exchange agent board through the gigabit network interface.

[0040] like Figure 1 , Figure 2 , Figure 3 and Figure 8As shown, in the system of the present invention, the configuration management board adopts B / S architecture and deploys web server services. The administrator enters the user name and password through the browser of the management terminal device for identity authentication and enters the configuration management interface to realize system management, application management, security policy management, log audit, status query and other functions. Figure 8 As shown, the hardware of the configuration management board includes a configuration management board CPU processor, a configuration management board Flash chip, and a configuration management board PHY chip. The configuration management board CPU processor is connected to the configuration management board Flash chip and the configuration management board PHY chip for data transmission. The Flash chip is used for data storage and system storage. The configuration management board CPU processor is connected to the network isolation FPGA of the security processing board through the SDIO interface channel of the platform backplane; and is connected to the management terminal device through the configuration management network interface.

[0041] In order to improve the security of the transmission process and realize the physical isolation inside the equipment, the optical fiber is used as the boundary. The optical one-way sending board of the switching agent board, the security processing board, and the one-way transmission board is powered by the power board 1, and the optical one-way receiving board and the data exchange board of the one-way transmission board are powered by the power board 2. Both the power board 1 and the power board 2 are designed with independent redundant power supply mode. Figure 2 shown.

[0042] Through prototype testing, the present invention realizes high-speed, non-packet-loss, one-way, non-feedback transmission of formatted data, files, and common application layer protocols between different networks, and can promptly detect malicious viruses carried in sent files, meeting various functional requirements.

[0043] Example 1

[0044] In this embodiment, the data message sending end device is the sending host, and the data message receiving end device is the receiving host. Fig. 9 As shown, the protocol proxy transmission process is as follows:

[0045] (1) The administrator uses the management terminal to log in to the configuration management interface to set the application protocol filtering policy and security check policy. The application protocol filtering policy is the type of application protocol allowed to pass through the device. The present invention supports common application layer protocol agents such as HTTP, FTP, POP3, and SMTP; the security check policy includes virus detection, format checking, keyword filtering, and traffic monitoring. The application protocol filtering policy and security check policy are transmitted through the SDIO interface channel of the configuration management board and saved to the security processing board.

[0046] (2) The sending application establishes a connection with the switching agent card through the network interface and performs identity authentication. After the identity authentication is passed, the sending application calls the protocol sending interface of the data sending software to send the application layer protocol data to the switching agent card.

[0047] (3) The switching agent card parses the received protocol data, identifies the application layer protocol type, and filters the received protocol data based on the application protocol filtering policy, discarding the messages that do not comply with the application protocol policy and intercepting illegal requests.

[0048] (4) Perform virus and Trojan deep detection on the messages that pass the application protocol policy check. If a virus or Trojan is detected, an error message will be sent to the sending host, the session connection will be closed, and the virus or Trojan will be completely removed using the detection engine. At the same time, an audible and visual alarm will be issued. The switching agent board supports offline update of the virus database.

[0049] (5) The switching agent card collects common application layer protocol features, command types, and interaction rules, establishes a rule set for the corresponding protocol, performs the same processing on the messages that conform to the protocol rule set, parses the messages that conform to the protocol rule set, and strips out the protocol header and payload data. According to the security policy, the destination address mapping table is searched, the octet information is filled, and the secondary private protocol encapsulation is performed to realize the "ferrying" of the application layer protocol to the formatted data, and the encapsulated message is sent to the security processing card.

[0050] (6) The security processing board verifies the data integrity of each packet received. After verification, it compares the sending host application identifier to verify the legitimacy of the data source; based on the authorized security policy and format whitelist, it performs data format inspection, file type inspection, file content keyword filtering, transmission window time inspection, traffic monitoring and other security inspections on the transmitted business data, and only allows messages with compliant sources and no abnormalities to pass. If the inspection passes, the message will be transmitted to the one-way transmission board; otherwise, the error information will be alarmed through the audit log and the current message will be discarded. The security processing board provides log services for all units in the device, stores relevant log information including connection authentication, protocol identification, data transmission, abnormal status, etc., records various types of system inspection abnormalities and status abnormalities, and records the source, purpose, flow, time and other information of the successfully forwarded data and the rejected data for the administrator to audit and query.

[0051] (7) The unidirectional transmission board uses the optical unidirectional sending FPGA to check the data packets that pass through the optical fiber transmission, and the optical unidirectional receiving FPGA receives the data packets and forwards them to the data exchange board.

[0052] (8) The data exchange board receives the service data message from the unidirectional transmission board, parses and extracts the session ID of the message, and uses the session ID to retrieve the reverse proxy destination address information. The data exchange board establishes a connection with the exchange proxy board of the reverse proxy device according to the reverse proxy destination address information and performs identity authentication. After the identity authentication is passed, the service data message is sent to the matching reverse proxy device.

[0053] (9) The switching proxy card of the reverse proxy device receives the service data message and performs reverse proxy, parses and extracts the application protocol header and payload data according to the octet information, reassembles it into a standard format application layer protocol message, and extracts the session ID in the message, and uses the session ID to retrieve the destination address information of the receiving application. The switching proxy card of the reverse proxy device establishes a connection with the receiving host according to the destination address information of the receiving application and performs identity authentication. After the identity authentication is passed, the reassembled application layer protocol message is sent to the receiving host server.

[0054] (10) The receiving host server processes the application protocol request and generates an application protocol response packet. At this time, the receiving host server performs the above steps as the sending host and sends the response message in reverse to the other end.

[0055] At this point, the transmission of an application layer protocol request and response message is completed.

[0056] In summary, the present invention realizes safe and reliable one-way transmission and two-way proxy functions. The present invention designs a multi-layer in-depth security protection architecture, performs secure exchange proxy for common application layer protocols, performs virus detection on transmitted data, and effectively ensures the cross-network secure transmission of formatted data, files, and application layer protocols. At the same time, it integrates multiple functions such as virus detection, application layer protocol proxy, integrity protection, data security check, and one-way isolated transmission, which improves the deployment and operation and maintenance capabilities of the information exchange system, realizes the automation of information collection, transmission, and processing while being simple and fast to deploy, better guarantees data exchange between different networks, and greatly improves the efficiency of data exchange.

[0057] For the integrated system for cross-network transmission supporting multi-protocol agents proposed in the present invention, the software design belongs to the conventional technical means in this technical field. Based on the hardware framework structure of the system of the present invention, the cross-network transmission supporting multi-protocol agents mainly includes three parts: cross-network data sending software, system host software and cross-network data receiving software.

[0058] Example 2

[0059] The system host software includes the switching agent unit software, the security processing unit software, the data exchange unit software and the configuration management unit software. The software framework is as follows: Fig.10 shown.

[0060] (a) Cross-network data sending software. The cross-network data sending software consists of a cross-network data sending API interface library and sending configuration management software. The sending software interface API includes functions such as application registration, opening a session, data sending, file sending, closing a session, application logout, and two-way authentication, and provides users with cross-network data sending services in the form of an API interface. The application layer protocol needs to be customized, and the payload data in the application layer protocol is encapsulated by the sending plug-in using the sending software API interface.

[0061] (b) Cross-network data receiving software. The cross-network data receiving software consists of a cross-network data receiving API interface library and receiving configuration management software, and provides users with cross-network data receiving services in the form of API interfaces. The payload data in the application layer protocol is re-unpacked by the receiving plug-in using the receiving software API interface and restored to the initial payload data.

[0062] (c) Switching agent unit software. The switching agent unit collects common application layer protocol features, command types and interaction rules, establishes a protocol rule set, performs protocol identification and filtering on application messages based on the rule set and whitelist, intercepts illegal requests, establishes a connection policy table, and transfers application layer protocols to formatted data to achieve forward proxy for application layer protocols; achieves reverse proxy through application layer protocol reconstruction and real destination address conversion; achieves two-way authentication with the sending host or reverse proxy device based on commercial cryptographic services; achieves cross-network data exchange control based on security control policies; accepts configuration management system deployment, and completes configuration operations such as IP address, local time and application protocol filtering policies.

[0063] The exchange agent unit is also equipped with a virus detection engine that supports offline updates of the virus database. All files or data entering the exchange agent unit must pass virus detection before entering the system's security processing unit.

[0064] (d) Security processing unit software. The security processing unit mainly processes cross-network data transmission messages from cross-network application software, application layer protocol messages, and configuration management information from the configuration management unit, completes the registration of cross-network applications, source legitimacy authentication, and data integrity verification, and performs traffic monitoring and statistics based on security policies, format checks, type checks, and content filtering on cross-network business data, files, and application layer protocol payload data. Only messages that pass the inspection can enter the one-way transmission unit.

[0065] The security processing unit accepts the configuration management system's deployment and completes the host's application identification whitelist, application protocol whitelist, data exchange control strategy, data security inspection strategy and other related configuration management tasks. At the same time, the security processing unit provides log services to all units in the host, stores relevant log information including connection authentication, protocol identification, data transmission, abnormal status, records various system inspection abnormalities and abnormal status behaviors, and records the source, purpose, flow, time and other information of successfully forwarded data and rejected data for administrator audit query.

[0066] (e) Data exchange unit software. The data exchange unit receives data packets from the optical unidirectional transmission unit, parses and processes the management packets therein, completes the connection authentication with the reverse proxy device, the establishment and closing of the session link, and the setting of the unit's IP address, local time and other information. For service data, after destination address conversion and protocol encapsulation, the service data is sent to the reverse proxy device through the socket.

[0067] (f) Configuration management unit software. The configuration management unit adopts a B / S architecture and provides Web services on the operating system. It provides administrators with configuration management functions including system management, application management, security policy configuration, and information viewing in the form of a browser. In the log management of the information viewing function, users can filter logs according to the query content and obtain log information that meets the filtering requirements. The configuration management unit is based on the SDIO interface driver to realize the communication function with the security processing unit.

[0068] The cross-network transmission integrated system supporting multi-protocol proxy proposed by the present invention can realize the secure transmission of data, files, and application layer protocols from the sending host to the receiving host. The data transmission process is as follows: Fig.11 shown.

[0069] The present invention can be widely used in the field of cross-network information exchange. Compared with traditional information exchange equipment, the present invention designs a multi-layer in-depth security protection architecture, realizes the exchange agent of common application layer protocols, effectively guarantees the cross-network security transmission of data, files, and application layer protocols, and satisfies the information exchange between different networks in specific scenarios. At the same time, it integrates multiple functions such as virus detection and killing, application layer protocol agent, data security inspection, and one-way isolated transmission, improves the intelligent operation and maintenance capabilities of the system, realizes the automation of information collection, transmission and processing, and better guarantees the information exchange between different networks.

[0070] Although the present invention has been described above in conjunction with the accompanying drawings, the present invention is not limited to the above-mentioned specific embodiments, which are merely illustrative rather than restrictive. Under the guidance of the present invention, ordinary technicians in this field can make many modifications without departing from the purpose of the present invention, all of which are within the protection of the present invention.

Claims

1. A cross-network transmission integrated system supporting multi-protocol proxy, comprising a sending end device and a receiving end device, characterized in that: A forward proxy device and a reverse proxy device are connected between the sending end device and the receiving end device, and the forward proxy device and the reverse proxy device respectively include a switching proxy board, a security processing board, a one-way transmission board, a data exchange board, and a configuration management board connected through a platform backplane; The sending end device is deployed with data sending software composed of a sending software API interface library, which is used for identity authentication and data transmission and reception with the forward proxy device; In the forward proxy device and the reverse proxy device: The switching proxy board performs virus scanning on the protocol packets sent by the cross-network data transmission software and the general application layer protocol, and performs private protocol parsing and conversion after the scanning, and establishes a protocol policy table; the application layer protocol is subjected to payload data stripping, two-level destination address mapping, and then encapsulated into a data message in a private format and sent to the security processing board; at the same time, reverse proxy is performed on the application protocol message transmitted in the reverse direction, and the private application protocol packet is reorganized and sent to the receiving network according to the corresponding destination address information and connection status; Receive various configuration management instructions from the configuration management area; The security processing board performs a two-way connection authentication based on a digital certificate with the sending end device through a commercial asymmetric algorithm; performs integrity verification and source legitimacy authentication on the transmitted business message; performs file type and format inspection, file content filtering, traffic monitoring, and log management on the message based on the security policy, and sends the message that passes the inspection to the one-way transmission board; The one-way transmission board is connected in series between the security processing board and the data exchange board, connecting the only light transmission of the security processing board and the only light reception of the data exchange board. The light transmission and the light reception are connected through a physical optical fiber, and an optical reverse inhibitor is installed on the optical fiber to realize reliable one-way feedback-free transmission of data. The data exchange board receives the data message transmitted by the optical unidirectional transmission board, and implements service data forwarding and configuration management through message analysis; Realize identity authentication and secure data exchange with reverse proxy devices; The configuration management board adopts B / S architecture and deploys web server services. The administrator enters the user name and password through the browser of the management terminal device for identity authentication and enters the configuration management interface to realize system management, application management, security policy management, log auditing, and status query; The data exchange board of the forward proxy device is connected to the exchange proxy board of the reverse proxy device, and the data exchange board of the reverse proxy device is connected to the exchange proxy board of the forward proxy device, so as to realize identity authentication and data security exchange between the forward proxy device and the reverse proxy device; The reverse proxy device is connected to the receiving end device, and the receiving end device deploys data receiving software, which is composed of a receiving software API interface library and performs identity authentication and data transmission and reception with the reverse proxy device.

2. The cross-network transmission integrated system according to claim 1, characterized in that: The switching agent board, security processing board and data switching board each include basic components, including a CPU processor, a bridge chip, a DDR4 memory, an SSD hard disk and a PHY chip; the CPU processor is connected to the bridge chip, the DDR4 memory and the PHY chip respectively, and the CPU processor is connected to the SSD hard disk and the PCIe interface of the platform backplane through the bridge chip for data transmission; the bridge chip set is used to realize the external USB, VGA, PCIe, SATA interface expansion function of the CPU processor; the DDR4 memory is used for data message cache and operating system cache; the SSD hard disk is used for data storage and system storage; In the security processing board, the CPU processor is also connected to a network isolation FPGA through a bridge chip, the network isolation FPGA is connected to a DDR3 memory, and the DDR3 memory is used for business data cache of the network isolation FPGA; the network isolation FPGA is respectively connected to the PCIe interface of the platform backplane and the SDIO interface of the platform backplane for data transmission; the network isolation FPGA communicates with the CPU processor through the PCIe interface of the bridge chip; The unidirectional transmission board includes an optical unidirectional transmission board and an optical unidirectional receiving board, and the optical unidirectional transmission board and the optical unidirectional receiving board are connected by an optical fiber with an optical reverse inhibitor, so as to perform unidirectional data transmission; the optical unidirectional transmission board includes an optical unidirectional transmission FPGA and an optical transmission module, and the optical unidirectional receiving board includes an optical receiving module and an optical unidirectional receiving FPGA, and the optical unidirectional receiving FPGA is connected to a DDR3 memory, and the DDR3 memory is used for caching the service data of the optical unidirectional receiving FPGA; the optical unidirectional transmission FPGA is connected to the CPU processor of the security processing board through the PCIe interface of the platform backplane; the optical unidirectional receiving FPGA is connected to the CPU processor of the data exchange board through the PCIe interface of the platform backplane; The configuration management board includes a CPU processor, a Flash chip and a PHY chip. In the configuration management board, the CPU processor is connected to the Flash chip and the PHY chip for data transmission; the Flash chip is used for data storage and system storage; the CPU processor is connected to the network isolation FPGA of the security processing board through the SDIO interface channel of the platform backplane; the configuration management board is connected to the Gigabit network interface of the management terminal device through the Gigabit network port; The network isolation FPGA of the security processing board is connected to the CPU processor of the switching agent board through the PCIe interface of the platform backplane; the CPU processor of the security processing board is connected to the optical one-way transmission FPGA of the one-way transmission board through the PCIe interface of the platform backplane; the security processing board is connected to the CPU processor of the configuration management board through the SDIO interface of the platform backplane; the CPU processor of the data exchange board is connected to the optical one-way reception FPGA of the one-way transmission board through the PCIe interface of the platform backplane; The connection relationship between the sending end device, the forward proxy device, the reverse proxy device and the receiving end device is: the CPU processor of the switching proxy board of the forward proxy device is connected to the sending end device through a gigabit network interface; the CPU processor of the data switching board of the forward proxy device is connected to the CPU processor of the switching proxy board of the reverse proxy device through a gigabit network interface; the CPU processor of the switching proxy board of the reverse proxy device is connected to the receiving end device through a gigabit network interface.

3. The cross-network transmission integrated system according to claim 2, characterized in that: In the unidirectional transmission board, two sets of differential lines are used to connect the optical unidirectional transmission FPGA and the optical transmission module, and the optical unidirectional reception FPGA and the optical reception module respectively; the optical transmission module and the optical reception module are connected by the optical fiber with the optical reverse inhibitor, and the Faraday effect of the magneto-optical crystal is used to isolate light reflection and suppress the optical reverse signal.

4. The cross-network transmission integrated system according to claim 2, characterized in that: The optical unidirectional sending board of the switching agent board, security processing board, and unidirectional transmission board is independently powered by one power supply, and the optical unidirectional receiving board and data exchange board of the unidirectional transmission board are independently powered by another power supply. Both power supplies are designed as redundant power supplies and are separated by optical fiber.

Images