An environmental management system based on secure isolated communication

Abstract

This invention discloses an environmental management system based on secure isolated communication, relating to the field of data environmental protection technology. It solves the technical problem that, during management, data is not encrypted, making it easy for external personnel to find the designated transmission channel via the HTTP protocol, leading to data theft. The system divides the transmitted data into several micro-segment data streams, marks these streams using a marking unit, and generates logical terminals. Different micro-segment data streams and logical terminals are transmitted in batches to a second isolated communication terminal. By segmenting the data and simultaneously hiding and replacing the memory index, the system ensures that the transmitted data cannot be stolen by external personnel, providing comprehensive protection for the transmitted data. This protection method effectively safeguards the data environment and achieves an overall environmentally friendly data processing effect.

Description

Technical Field

[0001] This invention belongs to the field of data environmental protection technology, specifically an environmental management system based on secure isolated communication. Background Technology

[0002] Secure communication isolation primarily includes physical isolation and logical isolation. Physical isolation typically involves configuring a network between two DMZs, ensuring that communication within this network can only occur through a single security device. Within this security device, firewalls and IDS / IPS rules monitor packets to determine whether to accept or deny them from entering the internal network. This technology is the most secure but also the most expensive because it requires numerous physical devices to divide the network into multiple segments. Logical isolation primarily uses virtual / logical devices, rather than physical devices, to isolate communication between different network segments. Common technologies used include VLANs, virtual routers, and virtual switches.

[0003] Application CN105007165A discloses a slope safety protection monitoring system with anti-illegal data tampering capabilities. This system includes a slope safety protection monitoring terminal and a remote server. The slope safety protection monitoring terminal includes a verification device, a decryption device, and a wireless device. The remote server includes an encryption device and a wireless device. The embodiments of this application employ a hardware mechanism to obtain random numbers and an image mechanism for encryption, thus achieving both high security and fast processing speed, while also tolerating a certain degree of error.

[0004] In big data environments, data that requires encrypted transmission typically needs to be transmitted using secure, isolated communication methods. To ensure a safe transmission environment and prevent interference from external sources, a designated data management system is required to manage the transmission of such data. However, if this management process fails to encrypt the data, it becomes easy for external personnel to find the designated transmission channel via the HTTP protocol, resulting in the theft of the transmitted data. Summary of the Invention

[0005] This invention aims to solve at least one of the technical problems existing in the prior art; to this end, this invention proposes an environmental protection management system based on secure isolation communication to solve the technical problem that, during the management process, such data is not encrypted and managed, making it easy for external personnel to find the designated transmission channel through the HTTP transmission protocol, resulting in the theft of transmitted data.

[0006] To achieve the above objectives, an environmental management system based on secure isolated communication is proposed according to an embodiment of the first aspect of the present invention, including a first isolated communication terminal, a second isolated communication terminal, an HTTP protocol processing unit, and a data-isolated environmental protection center;

[0007] The data isolation and environmental protection center includes a data acquisition unit, a data processing unit, a marking unit, a network channel identification unit, and a storage database;

[0008] The HTTP protocol processing unit is used to process the HTTP protocol between the first isolated communication terminal and the second isolated communication terminal, to segment and arrange the original HTTP protocol in a fragmented manner, and to transmit the scrambled HTTP protocol to the data isolation and environmental protection center. The data isolation and environmental protection center then uses this HTTP protocol to identify the corresponding network channel.

[0009] The network channel identification unit is used to receive scrambled HTTP protocol data packets, extract the corresponding identification code from the storage database, reorganize the scrambled HTTP protocol according to the identification code, and select the corresponding network channel through the HTTP protocol.

[0010] The data acquisition unit is used to acquire the data to be transmitted and directly send the acquired data to the data processing unit.

[0011] The data transmission processing unit is used to segment the data transmission into several groups of micro-segment data streams, then mark the micro-segment data streams through a marking unit, generate logic terminals, and transmit the different micro-segment data streams and logic terminals to the second isolated communication terminal in batches.

[0012] Preferably, the HTTP protocol processing unit processes the HTTP protocol in the following specific manner:

[0013] The HTTP data is divided into 5 data streams, each with equal capacity. The 5 data streams are labeled A, B, C, D, and E according to their order. The letter A represents the first data stream and the letter E represents the last data stream.

[0014] Based on the data stream labels, the five data streams are sorted alphabetically as C, D, A, B, and E. After sorting, an HTTP protocol data packet is generated and transmitted to the data isolation and environmental protection center.

[0015] Preferably, the specific method by which the network channel identification unit organizes the HTTP protocol according to the identification code is as follows:

[0016] After receiving the corresponding HTTP protocol data packet, the network channel identification unit extracts the corresponding identification code from the storage database. The identification code is represented by E, B, A, D, and C.

[0017] Based on the identification code, the corresponding sorted data stream is extracted from the HTTP protocol data packet. The reverse comparison method is used to check whether it matches the identification code. If it matches, it means that the HTTP protocol is correct. If it does not match, it means that the HTTP protocol is not accurate.

[0018] After identification, the five data streams are reordered according to their letter markings to obtain the original HTTP protocol. Based on the HTTP protocol, the corresponding network channel is selected and marked as the channel to be transmitted.

[0019] Preferably, the specific method by which the transmission data processing unit performs segmentation processing on the transmission data is as follows:

[0020] S1. Receive the transmitted data and segment the received transmitted data into n data streams, where n≥9;

[0021] S2. Extract the initial data stream and the final data stream, and mark them. Use the number 1 to mark the initial data stream and the number n to mark the final data stream. Remove the initial data stream and the final data stream, and perform subscript marking on the n-2 sets of data streams. The main form of the subscript marking is as follows: n-2 n-1 n , where n-2 is the preceding data stream labeled n-1, and n is the following data stream labeled n-1;

[0022] S3. Replace the index identifiers at the back end of the n-2 data streams with the letter Y. The resulting representation is as follows: n-2 n-1 Y And generate the corresponding logic terminals. The calculation form of the logic terminals is as follows: The n-1 groups of data streams, after being replaced with the letter Y, along with logic terminals, initial data streams, and final data streams, will be sent to the transmission channel in batches.

[0023] S4. The transmission channel transmits several sets of data streams to the second isolated communication terminal.

[0024] Preferably, after the second isolated communication terminal has received several sets of data streams, the logic terminal is activated according to... The index identifier of the back end of each data stream is calculated separately, and the calculated index identifier is replaced with the letter Y. Then, based on the index identifiers between several data streams, the several data streams are combined to obtain the original transmission data.

[0025] Compared with the prior art, the beneficial effects of the present invention are: the original HTTP protocol is segmented and arranged in layers, and the scrambled HTTP protocol is transmitted to the data isolation and environmental protection center. The data isolation and environmental protection center then identifies the corresponding network channel through this HTTP protocol. The network channel identification unit is used to receive HTTP protocol data packets, extract the corresponding identification code from the storage database, organize the HTTP protocol according to the identification code, and select the corresponding network channel through the HTTP protocol.

[0026] The data transmission processing unit segments the transmitted data into several micro-segment data streams. The marking unit then marks these micro-segment data streams and generates logic terminals. Different micro-segment data streams and logic terminals are transmitted in batches to the second isolated communication terminal. By segmenting the data and simultaneously hiding and replacing the memory index identifiers, the transmitted data is ensured to be protected from being stolen by external personnel. This comprehensive protection method effectively safeguards the data environment and achieves an overall environmentally friendly data processing effect. Attached Figure Description

[0027] Figure 1 This is a schematic diagram of the principle framework of the present invention;

[0028] Figure 2 This is a schematic diagram of data stream segmentation according to the present invention. Detailed Implementation

[0029] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] Example 1

[0031] Please see Figure 1 This application provides an environmental protection management system based on secure isolated communication, including a first isolated communication terminal, a second isolated communication terminal, an HTTP protocol processing unit, and a data-isolated environmental protection center;

[0032] The first isolated communication terminal and the second isolated communication terminal are bidirectionally connected to the data isolation environmental protection center, and the first isolated communication terminal and the second isolated communication terminal are bidirectionally connected to the HTTP protocol processing unit.

[0033] The data isolation and environmental protection center includes a data acquisition unit, a data processing unit, a marking unit, a network channel identification unit, and a storage database;

[0034] The output of the data acquisition unit is electrically connected to the input of the data processing unit; the data processing unit is electrically connected to the input of the tagging unit; the data processing unit is bidirectionally connected to the network channel identification unit; the tagging unit is bidirectionally connected to the storage database; and the output of the storage database is electrically connected to the input of the network channel identification unit.

[0035] Both the first isolated communication terminal and the second isolated communication terminal are devices that use corresponding transmission devices for isolated communication. The transmission devices are fixed communication devices. When the first isolated communication terminal and the second isolated communication terminal perform isolated communication, they generally do not use regular network channels for data transmission, but generally use fixed communication devices, such as signal transmission chips.

[0036] The HTTP protocol processing unit is used to process the HTTP protocol between the first isolated communication terminal and the second isolated communication terminal, segmenting and shuffling the original HTTP protocol, and transmitting the shuffled HTTP protocol to the data isolation and environmental protection center. The data isolation and environmental protection center then uses this HTTP protocol to identify the corresponding network channel. The specific method of processing the HTTP protocol is as follows:

[0037] The HTTP data is divided into 5 data streams, each with equal capacity. The 5 data streams are labeled A, B, C, D, and E according to their order. The letter A represents the first data stream and the letter E represents the last data stream.

[0038] Based on the data stream labels, the five data streams are sorted alphabetically as C, D, A, B, and E. After sorting, an HTTP protocol data packet is generated and transmitted to the data isolation and environmental protection center.

[0039] The network channel identification unit inside the data isolation environmental protection center receives scrambled HTTP protocol data packets, extracts the corresponding identification code from the storage database, reorganizes the scrambled HTTP protocol data packets according to the identification code, and selects the corresponding network channel through the HTTP protocol. The specific method of reorganization is as follows:

[0040] After receiving the corresponding HTTP protocol data packet, the network channel identification unit extracts the corresponding identification code from the storage database. The identification code is represented by E, B, A, D, and C.

[0041] Based on the identification code, the corresponding sorted data stream is extracted from the HTTP protocol data packet. By comparing it in reverse, it is checked whether it matches the identification code. If they match, it means that the HTTP protocol is correct. If they do not match, it means that the HTTP protocol is inaccurate. (First, the HTTP protocol is segmented and reordered before identification. This prevents external personnel from finding the corresponding network channel based on the intercepted HTTP protocol and extracting the corresponding transmission data from the network channel, thus polluting the transmission environment. This method can, to a certain extent, prevent external malicious personnel from finding the corresponding network transmission channel based on the HTTP protocol.)

[0042] After identification, the five data streams are reordered according to their alphabetical order (the reordering method is to arrange them in alphabetical order of AE) to obtain the original HTTP protocol. Based on the HTTP protocol, the corresponding network channel is selected and marked as the channel to be transmitted.

[0043] The data acquisition unit is used to acquire the data to be transmitted and directly send the acquired data to the data processing unit.

[0044] The transmission data processing unit is used to segment the transmission data into several groups of micro-segment data streams, then mark the micro-segment data streams using a marking unit, and generate logic terminals. The different micro-segment data streams and logic terminals are then transmitted in batches to the second isolated communication terminal. The specific method for segmenting the transmission data is as follows:

[0045] S1. Receive the transmitted data and segment the received data into n data streams, where n ≥ 9 (e.g., ...). Figure 2 (as shown)

[0046] S2. Extract the initial data stream and the final data stream, and mark them. Use the number 1 to mark the initial data stream and the number n to mark the final data stream. Remove the initial data stream and the final data stream, and perform subscript marking on the n-2 sets of data streams. The main form of the subscript marking is as follows: n-2 n-1 nWhere n-2 is the data stream preceding the data stream labeled n-1, and n is the data stream following the data stream labeled n-1 (e.g., if n=9, then the 9 data streams are represented as: 1, 2, 3, 4, 5, 6, 7, 8, 9, and after being processed with subscript identifiers, they are represented as: 1, 123, 234, 345, 456, 567, 678, 789, 9).

[0047] S3. Replace the index identifiers at the back end of the n-2 data streams with the letter Y. The resulting representation is as follows: n-2 n-1 Y And generate the corresponding logic terminals. The calculation form of the logic terminals is as follows: The n-1 groups of data streams, after being replaced with the letter Y, along with logic terminals, initial data streams, and final data streams, will be sent to the transmission channel in batches.

[0048] S4. The transmission channel transmits several sets of data streams to the second isolated communication terminal.

[0049] After the second isolated communication terminal has received several sets of data streams, the logic terminal is activated, according to... The index identifier of the back end of each data stream is calculated separately, and the calculated index identifier is replaced with the letter Y. Then, based on the index identifiers between several data streams, the several data streams are combined to obtain the original transmitted data. The reason for dividing the data and hiding and replacing the memory index identifier is to ensure that the transmitted data cannot be stolen by external personnel, thus fully protecting the transmitted data. Through this protection method, the data environment is fully protected, achieving the overall environmentally friendly data processing effect.

[0050] Example 2

[0051] In the specific implementation of this real-time example, the difference from Example 1 is as follows:

[0052] The transmission data processing unit is used to segment the transmission data into several groups of micro-segment data streams, then mark the micro-segment data streams using a marking unit, and generate logic terminals. The different micro-segment data streams and logic terminals are then transmitted in batches to the second isolated communication terminal. The specific method for segmenting the transmission data is as follows:

[0053] S1. Receive the transmitted data and segment the received transmitted data into n data streams, where n≥7.

[0054] S2. Extract the initial data stream and the final data stream, and mark them. Use the number 1 to mark the initial data stream and the number n to mark the final data stream. Remove the initial data stream and the final data stream, and perform subscript marking on the n-2 sets of data streams. The main form of the subscript marking is as follows: n-2 n-1 n Where n-2 is the data stream preceding the data stream labeled n-1, and n is the data stream following the data stream labeled n-1 (e.g., if n=7, then the 7 data streams are represented as: 1, 2, 3, 4, 5, 6, 7, and after being processed with subscript identifiers, they are represented as: 1, 123, 234, 345, 456, 567, 7).

[0055] S3. Replace the index identifiers at the back end of the n-2 data streams with the letter Y. The resulting representation is as follows: n-2 n-1 Y And generate the corresponding logic terminals. The calculation form of the logic terminals is as follows: The n-1 groups of data streams, after being replaced with the letter Y, along with logic terminals, initial data streams, and final data streams, will be sent to the transmission channel in batches.

[0056] S4. The transmission channel transmits several sets of data streams to the second isolated communication terminal.

[0057] The data in the above formula are all calculated by removing the dimensions and taking the numerical values. The formula is the closest to the real situation obtained by software simulation of a large amount of collected data. The preset parameters and preset thresholds in the formula are set by those skilled in the art according to the actual situation or obtained through simulation of a large amount of data.

[0058] The working principle of this invention is as follows: First, the original HTTP protocol is segmented and arranged in layers, and the scrambled HTTP protocol is transmitted to the data isolation and environmental protection center. The data isolation and environmental protection center then identifies the corresponding network channel through this HTTP protocol. The network channel identification unit is used to receive HTTP protocol data packets, extract the corresponding identification code from the storage database, organize the HTTP protocol according to the identification code, and select the corresponding network channel through the HTTP protocol.

[0059] The data transmission processing unit segments the transmitted data into several micro-segment data streams. The marking unit then marks these micro-segment data streams and generates logic terminals. Different micro-segment data streams and logic terminals are transmitted in batches to the second isolated communication terminal. By segmenting the data and simultaneously hiding and replacing the memory index identifiers, the transmitted data is ensured to be protected from being stolen by external personnel. This comprehensive protection method effectively safeguards the data environment and achieves an overall environmentally friendly data processing effect.

[0060] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. An environmental management system based on secure isolated communication, characterized in that, It includes a first isolated communication terminal, a second isolated communication terminal, an HTTP protocol processing unit, and a data isolation and environmental protection center; The data isolation and environmental protection center includes a data acquisition unit, a data processing unit, a marking unit, a network channel identification unit, and a storage database; The HTTP protocol processing unit is used to process the HTTP protocol between the first isolated communication terminal and the second isolated communication terminal, to segment and arrange the original HTTP protocol in a fragmented manner, and to transmit the scrambled HTTP protocol to the data isolation and environmental protection center. The data isolation and environmental protection center then uses this HTTP protocol to identify the corresponding network channel. The network channel identification unit is used to receive the scrambled HTTP protocol data packets, extract the corresponding identification code from the storage database, organize the scrambled HTTP protocol according to the identification code, and select the corresponding network channel through the HTTP protocol. The data acquisition unit is used to acquire the data to be transmitted and directly send the acquired data to the data processing unit. The data transmission processing unit is used to segment the data transmission into several groups of micro-segment data streams, then mark the micro-segment data streams through a marking unit, and generate logic terminals, and transmit the different micro-segment data streams and logic terminals to the second isolated communication terminal in batches. The specific method by which the network channel identification unit organizes the HTTP protocol according to the identification code is as follows: After receiving the corresponding HTTP protocol data packet, the network channel identification unit extracts the corresponding identification code from the storage database. The identification code is represented by E, B, A, D, and C. Based on the identification code, the corresponding sorted data stream is extracted from the HTTP protocol data packet. The reverse comparison method is used to check whether it matches the identification code. If it matches, it means that the HTTP protocol is correct. If it does not match, it means that the HTTP protocol is not accurate. After identification, the five data streams are reordered according to their letter markings to obtain the original HTTP protocol. Based on the HTTP protocol, the corresponding network channel is selected and marked as the channel to be transmitted. The specific method by which the transmission data processing unit segments the transmission data is as follows: S1. Receive the transmitted data and segment the received transmitted data into n data streams, where n≥9; S2. Extract the initial data stream and the final data stream, and mark them. Use the number 1 to mark the initial data stream and the number n to mark the final data stream. Remove the initial data stream and the final data stream, and perform subscript marking on the n-2 sets of data streams. The main form of the subscript marking is as follows: , where n-2 is the preceding data stream labeled n-1, and n is the following data stream labeled n-1; S3. Replace the index identifiers at the back end of the n-2 data streams with the letter Y. The resulting representation is as follows: And generate the corresponding logic terminals. The calculation form of the logic terminals is as follows: The n-1 groups of data streams, after being replaced with the letter Y, along with logic terminals, initial data streams, and final data streams, will be sent to the transmission channel in batches. S4. The transmission channel transmits several sets of data streams to the second isolated communication terminal.

2. The environmental management system based on secure isolated communication according to claim 1, characterized in that, The specific method by which the HTTP protocol processing unit processes the HTTP protocol is as follows: The HTTP data is divided into 5 data streams, each with equal capacity. The 5 data streams are labeled A, B, C, D, and E according to their order. The letter A represents the first data stream and the letter E represents the last data stream. Based on the data stream labels, the five data streams are sorted alphabetically as C, D, A, B, and E. After sorting, an HTTP protocol data packet is generated and transmitted to the data isolation and environmental protection center.

3. The environmental management system based on secure isolated communication according to claim 2, characterized in that, After the second isolated communication terminal has received several sets of data streams, the logic terminal is activated, according to... The index identifier of the back end of each data stream is calculated separately, and the calculated index identifier is replaced with the letter Y. Then, based on the index identifiers between several data streams, the several data streams are combined to obtain the original transmission data.

Images