Intranet-extranet transmission system

Abstract

The application discloses an internal and external network transmission system applied to the field of data transmission system, which comprises a core storage layer, an open storage layer and a communication terminal through an internal network end, the core storage layer is connected with the communication terminal through the open storage layer, and the communication terminal is connected with an external network end through an operator; the open storage layer comprises an open database, a temporary mirror database and a switching data processing unit; a plurality of permission data layers are arranged in the open database, and the temporary mirror database is matched with the temporary mirror database in the temporary mirror database; an intermediate data queue comprises an access permission filter, a real-time data queue and a non-real-time data queue. The permission filter of the external network access data is realized on the outside of the internal network end, so that the real-time data queue and the non-real-time queue are formed, the two queues are respectively interacted with different databases, the interaction results are interacted with the core database through a security mirror, and the security protection of the internal network data in the internal and external network data transmission process is effectively ensured.

Description

Technical Field

[0001] This application relates to the field of data transmission systems, and in particular to internal and external network transmission systems. Background Technology

[0002] With the continuous development of internet and computer technology, more and more government and enterprise organizations are turning to paperless office work via computer networks, resulting in a large amount of data entering dedicated data networks. For security reasons, many dedicated networks are required to be isolated from the internet to effectively ensure data security.

[0003] To ensure information security, internal and external networks are usually isolated. Due to the lack of internet access, the convenience brought by the internet cannot be utilized, and data that needs to be made public cannot be easily published on the internet. As a result, a large amount of data remains stuck in the private network and cannot be fully utilized. Consequently, the data between the internal and external networks can only be synchronized manually, which is very inefficient.

[0004] Therefore, a system for transmitting data between internal and external networks that is easy to ensure data security is needed. Summary of the Invention

[0005] The purpose of this application is to provide a secure interactive system for data exchange between internal and external networks. Compared with the existing technology, it provides an internal and external network transmission system, including an internal network end, an external network end, and an operator. The external network end includes a cloud server end and a client end. The internal network end includes a core storage layer, an open storage layer, and a communication terminal. The core storage layer is connected to the communication terminal through the open storage layer, and the communication terminal is connected to the external network end through the operator.

[0006] The open storage layer includes an open database, a temporary mirror database, and an exchange data processing unit;

[0007] The open database contains multiple permission data layers, and the temporary mirror database contains a temporary mirror database that matches the permission data layers.

[0008] The core storage layer includes a core database, a permission management module, and a data management module. The data management module contains a mirror management unit, a security detection module, and a mapping management unit; the permission management module contains a permission whitelist and a permission allocation unit.

[0009] The permission data layer is a one-way data mapping to the core storage layer, and the core storage layer has a mirror layer that matches the permission data layer.

[0010] The intermediate data queue includes access permission filters, real-time data queues, and non-real-time data queues.

[0011] This system enables permission filtering of external network access data on the internal network side, forming a real-time data queue and a non-real-time queue. The two queues interact with different databases, and the interaction results are exchanged with the core database through a secure mirror. This effectively ensures the security protection of internal network data during internal and external network data transmission and reduces the security threats from the external network to the internal network during internal and external network data interaction.

[0012] Optionally, the permission management module can manage temporary permissions. Temporary permissions can only access the temporary mirror database, and multiple temporary mirror databases can be set and matched with multiple permission data layers respectively. The temporary mirror database is a one-way mirror of its corresponding permission data layer.

[0013] Optionally, a threat assessment module and a trustworthiness assessment module can be set up within the permission management module. The permission management module can grant different levels of temporary permissions based on threat assessment and trustworthiness assessment of external network access parties.

[0014] Optionally, the permissions whitelist includes a list of IPs with access permissions and a list of security programs.

[0015] Optionally, the open storage tier can be set up in the cloud or locally, and the open storage tier is physically isolated from the core storage tier.

[0016] Optionally, the image management unit is used to manage temporary image databases and image layers.

[0017] Optionally, the open storage layer and the core storage layer transmit data via TCP / UDP protocol, while the internal network terminals transmit data via IP protocol.

[0018] Optionally, the exchange instruction management unit can intercept or allow data request packets sent by the accessing party based on the access permissions it possesses.

[0019] Optionally, a cache management module is provided in the image layer, temporary image database, and intermediate data layer.

[0020] Optionally, the access permission filter filters access requests to databases with different permissions, filters out data with mismatched permissions and arranges it into the corresponding non-real-time data queue according to its permissions, and arranges the queue with matching permissions into the real data queue of the corresponding access request.

[0021] Compared to existing technologies, the advantages of this application are:

[0022] (1) This solution filters access permissions for external network data by completing the external access data on the internal network side, forming a real-time data queue and a non-real-time queue. The two queues interact with different databases respectively, and the interaction results are interacted with the core database through a security mirror. This effectively ensures the security protection of internal network data during the data transmission between internal and external networks and reduces the security threat from the external network to the internal network when internal and external network data interact.

[0023] (2) The permission management module can perform temporary permission management. Temporary permissions can only access the temporary mirror database. Multiple temporary mirror databases are set and matched with multiple permission data layers respectively. The temporary mirror database is a one-way mirror of its corresponding permission data layer. The permission management module can set up a threat assessment module and a trust assessment module. The permission management module can grant different levels of temporary permissions through threat assessment and trust assessment of external network access parties.

[0024] (3) Access permission filters filter access requests for databases with different permissions, filter out data with mismatched permissions and arrange them into the corresponding non-real-time data queue according to their permissions, and arrange the queues with matching permissions into the corresponding access request's implementation data queue. Attached Figure Description

[0025] Figure 1 This is a schematic diagram of the system architecture of this application;

[0026] Figure 2 This is a flowchart of the workflow for this application;

[0027] Figure 3 This is a data architecture diagram for this application. Detailed Implementation

[0028] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0029] Example 1:

[0030] This application discloses an internal and external network transmission system; please refer to [link / reference]. Figure 1-2 Internal and external network transmission systems include internal network terminals, external network terminals, and operators. External network terminals include cloud service terminals and client terminals.

[0031] The intranet terminal includes a core storage layer, an open storage layer, and a communication terminal. The core storage layer is connected to the communication terminal through the open storage layer, and the communication terminal is connected to the external network terminal through the operator. The open storage layer can be set up in the cloud or locally, and the open storage layer is physically isolated from the core storage layer. The open storage layer and the core storage layer transmit data through the TCP / UDP protocol, while the intranet terminal transmits data through the IP protocol.

[0032] The core storage layer includes a core database, a permission management module, and a data management module;

[0033] The permission management module includes a permission whitelist and a permission allocation unit. The permission whitelist includes a list of IPs with access permissions and a list of security programs. The security programs are set on the cloud server, and the IPs are the IPs corresponding to local clients with access permissions.

[0034] The permission management module can manage temporary permissions through the permission allocation unit, which can perform permission hierarchical and permission classification management. The permission management module can set up a threat assessment module and a trustworthiness assessment module. The permission management module can grant different levels of temporary permissions based on the threat assessment and trustworthiness assessment of external network access parties. During the threat assessment and trustworthiness assessment, the assessment can be based on the association between the access party and the whitelisted programs or IPs in the permission whitelist.

[0035] Temporary permissions can only access temporary mirror databases, and multiple temporary mirror databases are set up and each is matched with a different permission data layer. A temporary mirror database is a one-way mirror of its corresponding permission data layer.

[0036] The data management module includes an image management unit, a security detection module, and a mapping management unit. The image management unit is used to manage temporary image databases and image layers, the mapping management unit is used to manage the mapping of the core database to the permission data layer, and the security detection module is used to scan and detect data security. The security detection module includes, but is not limited to, data security protection software such as firewalls and antivirus software.

[0037] The open storage layer includes an open database, a temporary mirror database, and an exchange data processing unit; the exchange instruction management unit can intercept or allow data request packets sent by the accessing party according to the access permissions it possesses;

[0038] The open database contains multiple permission data layers, and the temporary mirror database contains a temporary mirror database that matches the permission data layers. The permission data layer is a one-way data mapping of the core storage layer. The permission data layer stores core storage layer mapping data with different permission levels. The core storage layer contains a mirror layer that matches the permission data layer. The mirror layer, the temporary mirror database, and the intermediate data layer all contain cache management modules.

[0039] The intermediate data queue includes an access permission filter, a real-time data queue, and a non-real-time data queue. The access permission filter filters access requests to databases with different permissions, filters out data with mismatched permissions and arranges it into the corresponding non-real-time data queue according to its permissions, and arranges the queue with matching permissions into the real-time data queue corresponding to the access request.

[0040] When in use, data request packets sent from the external network to the internal network are first integrated through access permission filtering and intermediate data layer, and then arranged into real-time data queues and non-real-time data queues.

[0041] Among them, data requesters who meet the permissions access their corresponding permission database through a real-time data queue;

[0042] Data requesters with mismatched permissions are transferred to a non-real-time data queue and issue a permission authorization request. Data requesters authorized by the permission management module have temporary permissions, while requests from low-trust parties and high-threat parties are directly blocked.

[0043] Access users with temporary access rights can access the temporary mirror database of the corresponding permission database. They can interact with the temporary access through the temporary mirror database to avoid the temporary access affecting the internal network data. The data interaction results are backed up in the temporary mirror database. After the backup file passes the security test, it is entered into the corresponding permission database, and the cache is cleared at the same time.

[0044] Access-enabled users interact with the direct permission layer. The data interaction process and results are backed up in the permission database and a corresponding image file is generated in the image layer of the core data layer. After the image file is checked for security by security software, it can be loaded into the core database. After the file is loaded into the core database, the corresponding cache in the permission database and the image layer is cleared.

[0045] When an image file fails the security check, the image file is deleted and a full security check is performed on the corresponding permission database. At the same time, the backup file corresponding to the image file is tracked, the access party that generated the backup file is tracked, its trust level is reduced, and its subsequent access requests are blocked.

[0046] This solution sets up an intermediate layer outside the intranet layer that can access and integrate data. During the flow of data requests in the business layer, access permissions are filtered to filter out requests without permissions. Based on their different permissions, data requests are arranged into different non-real-time data queues, and data with matching permissions can be accessed in real time.

[0047] External network access does not directly interact with the internal core database. Temporarily authorized external access data interacts with a temporary mirror database. Since the temporary mirror database interacts securely with the permission data layer before interacting with the core database, and the temporarily accessed data is stored in the temporary mirror database without affecting the permission data layer, authorized external access interacts with different permission data layers within the open data layer according to access permissions, and then interacts with the core database through the secure mirror of the permission data layer. This effectively ensures the security protection of internal network data during the transmission of data between internal and external networks, and reduces the security threat from the external network to the internal network when data is exchanged between internal and external networks.

[0048] The above description is merely a preferred embodiment of this application, but the scope of protection of this application is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in this application, based on the technical solution and its improved concept, should be covered within the scope of protection of this application.

Claims

1. An intranet / extranet transmission system, comprising an intranet terminal, an extranet terminal, and an operator, wherein the extranet terminal includes a cloud server and a client, characterized in that, The intranet terminal includes a core storage layer, an open storage layer, and a communication terminal. The core storage layer is connected to the communication terminal through the open storage layer, and the communication terminal is connected to the external network terminal through the operator. The open storage layer includes an open database, a temporary mirror database, and an exchange data processing unit; The open database contains multiple permission data layers, and the temporary mirror database contains a temporary mirror database that matches the permission data layers. The core storage layer includes a core database, a permission management module, and a data management module. The data management module includes a mirror management unit, a security detection module, and a mapping management unit. The permission management module includes a permission whitelist and a permission allocation unit. The permission data layer is a one-way data mapping of the core storage layer, and the core storage layer has a mirror layer that matches the permission data layer. The intermediate data queue includes access permission filters, real-time data queues, and non-real-time data queues; Data request packets sent from the external network are first integrated through access permission filtering and the intermediate data layer. Requests with matching permissions are assigned to the real-time data queue, while requests with mismatched permissions are assigned to the non-real-time data queue and an authorization request is sent. Data requesters authorized through the permission management module have temporary permissions, while requests from low-trust and high-threat parties are directly blocked. Access users with temporary access rights can interact with the temporary mirror database of the corresponding permission database, and the data interaction results are backed up in the temporary mirror database. Access-enabled users interact with the direct permission layer. The data interaction process and results are backed up in the permission database, and a corresponding image file is generated in the mirror layer of the core data layer. After the image file is checked for security by security software, it is loaded into the core database.

2. The internal and external network transmission system according to claim 1, characterized in that, The permission management module can perform temporary permission management. The temporary permission can only access the temporary mirror database. The temporary mirror database is set to multiple databases and is matched with multiple permission data layers respectively. The temporary mirror database is a one-way mirror of its corresponding permission data layer.

3. The internal and external network transmission system according to claim 1, characterized in that, The permission management module can be configured with a threat assessment module and a trustworthiness assessment module. The permission management module can grant different levels of temporary permissions based on threat assessment and trustworthiness assessment of external network users.

4. The internal and external network transmission system according to claim 1, characterized in that, The permission whitelist includes a list of IPs with access permissions and a list of security programs.

5. The internal and external network transmission system according to claim 1, characterized in that, The open storage layer can be located in the cloud or locally, and the open storage layer is physically isolated from the core storage layer.

6. The internal and external network transmission system according to claim 1, characterized in that, The image management unit is used to manage the temporary image database and image layers.

7. The internal and external network transmission system according to claim 1, characterized in that, The open storage layer and the core storage layer transmit data via TCP / UDP protocol, while the intranet terminals transmit data via IP protocol.

8. The internal and external network transmission system according to claim 1, characterized in that, The exchange instruction management unit can intercept or allow data request packets sent by the accessing party based on the access permissions it possesses.

9. The internal and external network transmission system according to claim 1, characterized in that, The image layer, temporary image database, and intermediate data layer are all equipped with a cache management module.

Images