A communication system and method based on a non-network layer

Abstract

This invention discloses a non-network layer-based communication system and method. The system includes a Layer 2 switch supporting Layer 2 forwarding capabilities, a first intranet machine, a second intranet machine, a first extranet machine, and a second extranet machine. Both the first and second intranet machines are connected to the Layer 2 switch via MAC interfaces. The first and second extranet machines are connected via an IP network. The first extranet machine connects to the first intranet machine via a MAC interface, and the second extranet machine connects to the second intranet machine via a MAC interface. In this invention, data between hosts in the intranet environment and between hosts in the intranet and extranet environments are processed using RAW Sockets combined with a custom data structure. This eliminates the need for network layer protocol forwarding, preventing the risk of network layer communication information leakage. Furthermore, the custom data structure allows users to define their own data filtering rules, increasing customization to adapt to different business or scenario operational requirements.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and specifically to a communication system and method based on a non-network layer. Background Technology

[0002] With the rapid development of mobile office, 5G and IoT, network data is endless and people's demand for data sharing is constantly increasing. Regardless of location or network environment, more and more business data needs to communicate between the external network and the internal network. However, the existing data filtering methods based on database access filtering can no longer meet the needs of rapid business expansion.

[0003] Currently, both internal and external network applications rely on conventional IP / MASK filtering combined with routing gateway blocking. Theoretically, these are software-level strategies implemented to regulate the expected traffic flow.

[0004] Because this is a software-level strategy implementation, current technologies can transmit internal network information to the external network through network layer protocol data operations, such as VPN tunneling and port-based pass-through technologies. While there are differences in application level and technical aspects, the software layer cannot completely prevent the passive leakage of internal network information. Once data is leaked, it means that the company or individual possessing that data has complete knowledge of you, leaving you completely vulnerable.

[0005] Meanwhile, as the demand for simultaneous operation of internal and external networks continues to increase, the transmission of internal network information to the external network based on network layer protocol data operations can lead to insufficient IPv4 resources in the internal network environment. Of course, IPv6 can greatly alleviate this, but IPv6 is not enough to completely replace it in terms of system compatibility, software support, and user configuration habits. Summary of the Invention

[0006] Purpose of the Invention: The purpose of this invention is to provide a communication system and method based on a non-network layer approach. This solves the problem of passive leakage of internal network information caused by current technologies that rely on network layer protocol data operations to transmit internal network information to the external network. It also addresses the issue of insufficient IPv4 resources in the internal network environment caused by network layer protocol data operations. In this invention, data between hosts in the internal network environment and between hosts in both internal and external network environments are transmitted using RAW Sockets combined with a custom data structure. This eliminates the need for network layer protocol forwarding, preventing the risk of leakage of communication information based on the network layer. Furthermore, the custom data structure allows users to define their own data filtering rules, increasing customization to adapt to different business or scenario operational requirements.

[0007] Technical Solution: The present invention provides a non-network layer-based communication system, the system comprising a Layer 2 switch supporting Layer 2 forwarding capability, a first internal network machine, a second internal network machine, a first external network machine, and a second external network machine; the first internal network machine and the second internal network machine are both connected to the Layer 2 switch via MAC interfaces, the first external network machine and the second external network machine are connected to each other via an IP network, the first external network machine is connected to the first internal network machine via a MAC interface, and the second external network machine is connected to the second internal network machine via a MAC interface.

[0008] Furthermore, the first intranet machine, the second intranet machine, the first extranet machine, and the second extranet machine all include a data receiving unit and a data sending unit;

[0009] The data sending unit includes a first filtering module, a data splitting module, and a sending module; the first filtering module is used to filter the data to be sent according to a preset filtering rule; the data splitting module is used to split the filtered data to be sent; and the sending module sends out the split data frames.

[0010] The data receiving unit includes a receiving module, a data reconstruction module, a second filtering module, and a display module; the receiving module is used to receive data frames transmitted from outside; the data reconstruction module is used to reconstruct the received data frames; the second filtering module is used to filter the reconstructed data according to preset filtering rules; and the display module is used to display the filtered and allowed data.

[0011] Furthermore, the preset filtering rules in the first and second filtering modules are data type filtering, content filtering, or a combination of data type filtering and content filtering.

[0012] The data type filtering refers to judging the message type of the data, discarding data of the type that meets the conditions, and allowing data that does not meet the conditions to pass directly.

[0013] The content filtering refers to defining sending and receiving behaviors as Input / Output, corresponding to the keyword Flow, judging whether the Flow keyword of the sender and receiver is equal to Input / Output, discarding data of the type that meets the condition, and allowing data that does not meet the condition directly.

[0014] Furthermore, the specific operation of the splitting process is as follows: Add a preset frame header and a preset common header to the header of the filtered and allowed data to be sent to obtain an initial data frame. Judge the initial data frame: if the byte length of the initial data frame is less than or equal to the preset maximum transmission byte length, output the initial data frame; if the byte length of the initial data frame is greater than the preset maximum transmission byte length, split the header of the initial data frame to obtain a first data frame with the same preset maximum transmission byte length. Add a preset frame header to the header of the remaining data frame and record it as the first remaining data frame. Judge the first remaining data frame: if the byte length of the first remaining data frame is less than or equal to the preset maximum transmission byte length, output the first data frame and the first remaining data frame; if the byte length of the first remaining data frame is greater than the preset maximum transmission byte length, split the header of the first remaining data frame to obtain a first data frame with the same preset maximum transmission byte length. The system splits the first remaining data frame into a second data frame with the same length as the preset maximum transmission byte length. A preset frame header is added to the header of the remaining first remaining data frame, and this second remaining data frame is then used for judgment. If the byte length of the second remaining data frame is less than or equal to the preset maximum transmission byte length, the first data frame, the second data frame, and the second remaining data frame are output. If the byte length of the second remaining data frame is greater than the preset maximum transmission byte length, a third data frame with the same length as the preset maximum transmission byte length is split from the header of the second remaining data frame. A preset frame header is added to the header of the remaining second remaining data frame, and this third remaining data frame is then used for judgment. This process continues until the byte length of the Nth remaining data frame is less than or equal to the preset maximum transmission byte length. Then, the first to Nth data frames and the Nth remaining data frame are output, where N is a positive integer.

[0015] Furthermore, the structure of the preset frame header includes at least the receiver's MAC address, the sender's MAC address, the data number, the sequence number of the data frame, and the total number of frames split.

[0016] Furthermore, the specific operation of reassembling the data frames is as follows: after receiving the data frame, the data frames are grouped according to the MAC address of the sender. The grouping satisfies that the data numbers in the data frames are the same and the total number of split frames is equal to the sum of the cumulative number of data frames. Then, the data frames are arranged in ascending order according to the numerical value of the data frame sequence number, and the data frames are spliced ​​together. The preset frame header and preset common header are removed to obtain the reassembled data.

[0017] The present invention also includes a non-network layer-based communication method, the method comprising bidirectional communication between a first intranet machine and a second intranet machine within an intranet, and bidirectional communication between a first intranet machine and a first extranet machine between an intranet and an extranet.

[0018] Furthermore, the specific process of bidirectional communication between the first intranet machine and the second intranet machine is as follows:

[0019] (1) After the first intranet machine obtains the MAC address of the second intranet machine as the sender, it filters the data to be sent according to the preset filtering rules. The data to be sent after filtering is split to obtain the split data frame. The data frame is sent to the Layer 2 switch through the MAC layer communication method. The data that cannot be sent is directly discarded locally.

[0020] (2) The Layer 2 switch forwards the data frame to the second internal network machine through the MAC address of the second internal network machine in the received data frame;

[0021] (3) The second intranet machine receives the data frame as the receiver, and then reassembles the data frame. The reassembled data is filtered according to the preset filtering rules. The filtered data is displayed, and the data that cannot be passed is discarded.

[0022] Furthermore, the specific process of bidirectional communication between the first intranet machine and the first extranet machine between the intranet and extranet is as follows:

[0023] (1) After the first internal network machine obtains the MAC address of the first external network machine as the sender, it filters the data to be sent according to the preset filtering rules. The data to be sent after filtering is split to obtain the split data frame. The data frame is sent to the first external network machine through MAC layer communication. The data that cannot be sent is directly discarded locally.

[0024] (2) The first external network machine receives the data frame as the receiver, and then reassembles the data frame. The reassembled data is filtered according to the preset filtering rules. The data that is allowed after filtering is displayed, and the data that cannot be allowed is discarded directly.

[0025] Furthermore, the preset filtering rules are data type filtering, content filtering, or a combination of data type filtering and content filtering;

[0026] The data type filtering refers to judging the message type of the data, discarding data of the type that meets the conditions, and allowing data that does not meet the conditions to pass directly.

[0027] The content filtering refers to defining sending and receiving behaviors as Input / Output, corresponding to the keyword Flow, judging whether the Flow keyword of the sender and receiver is equal to Input / Output, discarding data of the type that meets the condition, and allowing data that does not meet the condition directly.

[0028] Furthermore, the specific operation of the splitting process is as follows: Add a preset frame header and a preset common header to the header of the filtered and allowed data to be sent to obtain an initial data frame. Judge the initial data frame: if the byte length of the initial data frame is less than or equal to the preset maximum transmission byte length, output the initial data frame; if the byte length of the initial data frame is greater than the preset maximum transmission byte length, split the header of the initial data frame to obtain a first data frame with the same preset maximum transmission byte length. Add a preset frame header to the header of the remaining data frame and record it as the first remaining data frame. Judge the first remaining data frame: if the byte length of the first remaining data frame is less than or equal to the preset maximum transmission byte length, output the first data frame and the first remaining data frame; if the byte length of the first remaining data frame is greater than the preset maximum transmission byte length, split the header of the first remaining data frame to obtain a first data frame with the same preset maximum transmission byte length. The system splits the first remaining data frame into a second data frame with the same length as the preset maximum transmission byte length. A preset frame header is added to the header of the remaining first remaining data frame, and this second remaining data frame is then used for judgment. If the byte length of the second remaining data frame is less than or equal to the preset maximum transmission byte length, the first data frame, the second data frame, and the second remaining data frame are output. If the byte length of the second remaining data frame is greater than the preset maximum transmission byte length, a third data frame with the same length as the preset maximum transmission byte length is split from the header of the second remaining data frame. A preset frame header is added to the header of the remaining second remaining data frame, and this third remaining data frame is then used for judgment. This process continues until the byte length of the Nth remaining data frame is less than or equal to the preset maximum transmission byte length. Then, the first to Nth data frames and the Nth remaining data frame are output, where N is a positive integer.

[0029] Furthermore, the structure of the preset frame header includes at least the receiver's MAC address, the sender's MAC address, the data number, the sequence number of the data frame, and the total number of frames split.

[0030] Furthermore, the specific operation of reassembling the data frames is as follows: after receiving the data frame, the data frames are grouped according to the MAC address of the sender. The grouping satisfies that the data numbers in the data frames are the same and the total number of split frames is equal to the sum of the cumulative number of data frames. Then, the data frames are arranged in ascending order according to the numerical value of the data frame sequence number, and the data frames are spliced ​​together. The preset frame header and preset common header are removed to obtain the reassembled data.

[0031] The beneficial effects of this invention are:

[0032] (1) Data transmission between hosts in the intranet environment and between hosts in the intranet and extranet environments is not affected by the network protocol layer configuration, especially not by the limitations of IPv4 resources;

[0033] (2) Data transmission between hosts in the intranet environment and between hosts in the intranet and extranet environments adopts RAW Socket combined with custom data structure, which can avoid the impact of known software or network layer protocol-based threatening behaviors in the public network;

[0034] (3) Custom data structures can be customized to filter data according to user-selected rules, increasing customization to adapt to different business or scenario operation requirements. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of the system structure of the present invention;

[0036] Figure 2 This is a schematic diagram of the first intranet machine structure;

[0037] Figure 3 This is a schematic diagram of the first data frame format;

[0038] Figure 4 This is a schematic diagram of the format of the first remaining data frame;

[0039] Figure 5 This is a schematic diagram of the reorganized data format. Detailed Implementation

[0040] The present invention will be further described below with reference to the accompanying drawings and embodiments:

[0041] like Figure 1 As shown, this invention proposes a non-network layer-based communication system. This system includes a Layer 2 switch 1 supporting Layer 2 forwarding capabilities, a first internal network machine 2, a second internal network machine 3, a first external network machine 4, and a second external network machine 5. Both the first internal network machine 2 and the second internal network machine 3 are connected to the Layer 2 switch 1 via MAC interfaces. The MAC addresses of the first internal network machine 2 and the second internal network machine 3 are broadcast to obtain the target MAC address, and data transmission is performed through MAC layer communication. The first external network machine 4 and the second external network machine 5 are connected via an IP network, also performing data transmission through existing network protocol layers. The first external network machine 4 is connected to the first internal network machine 2 via a MAC interface, and the second external network machine 5 is connected to the second internal network machine 3 via a MAC interface; that is, data transmission between the external and internal network machines is performed through MAC layer communication. As can be seen from this system structure, the data of the internal network machines is not transmitted through the network protocol layer, meaning that network attacks cannot reach the internal network machines, ensuring data security.

[0042] like Figure 2 As shown, the first intranet machine 2, the second intranet machine 3, the first extranet machine 4, and the second extranet machine 5 all include a data sending unit 21 and a data receiving unit 22;

[0043] The data sending unit 21 includes a first filtering module 211, a data splitting module 212, and a sending module 213; the first filtering module 211 is used to filter the data to be sent according to a preset filtering rule; the data splitting module 212 is used to split the filtered data to be sent; and the sending module 213 sends out the split data frames.

[0044] The preset filtering rules can be data type filtering, content filtering, or a combination of data type filtering and content filtering.

[0045] Data type filtering refers to judging the message type of data, discarding data of the type that meets the criteria, and allowing data of the type that does not meet the criteria to pass through directly; as shown in Table 1, message type enumeration:

[0046] Enumeration type definition value Enumeration type definition value description 0 reserve 1 Broadcast message 2 Character messages

[0047] Table 1 Message Type Enumeration

[0048] For example: Set the data type filter condition to [MsgType! = 1], which means check if the data type matches 1 = broadcast message. If it matches, the data is discarded; otherwise, it is allowed.

[0049] Content filtering refers to defining sending and receiving behaviors as Input / Output, corresponding to the keyword Flow. It then checks whether the Flow keyword of the sender and receiver equals Input / Output, discarding data that meets the criteria and allowing data that does not. If no Flow is defined in the rule filtering conditions, the default rule applies to both sending and receiving behaviors.

[0050] For example: Set the content filtering condition to [Flow=Input], which means that the key characters of the receiver's Flow are not equal to Input. If they are equal, the data is discarded; otherwise, it is allowed.

[0051] The combination of data type filtering and content filtering refers to the simultaneous use of data type filtering and content filtering.

[0052] Example: The rule filtering condition is:

Flow=Output&&MsgType!=1&&Content==Hello

[0053] Define whether the Flow key character of the receiver is equal to the Output, check whether MsgType meets the requirements. If it does, iterate through the message content to see if the Hello keyword exists. If both conditions are met, the message is discarded and the sending action fails.

[0054] The specific steps of the splitting process are as follows: First, a preset frame header and a preset common header are added to the header of the filtered and allowed data to be sent to obtain an initial data frame. The initial data frame is then judged. If the byte length of the initial data frame is less than or equal to the preset maximum transmission byte length, the initial data frame is output. If the byte length of the initial data frame is greater than the preset maximum transmission byte length, a first data frame with the same preset maximum transmission byte length is split from the header of the initial data frame. The remaining data frame header is then added to a preset frame header and recorded as the first remaining data frame. If the byte length of the first remaining data frame is less than or equal to the preset maximum transmission byte length, both the first data frame and the first remaining data frame are output. If the byte length of the first remaining data frame is greater than the preset maximum transmission byte length, the header of the first remaining data frame is split... A second data frame with the same length as the preset maximum transmission byte length is extracted. The remaining first residual data frame is then appended with a preset frame header and recorded as the second residual data frame. If the byte length of the second residual data frame is less than or equal to the preset maximum transmission byte length, the first data frame, the second data frame, and the second residual data frame are output. If the byte length of the second residual data frame is greater than the preset maximum transmission byte length, a third data frame with the same length as the preset maximum transmission byte length is extracted from the header of the second residual data frame. The remaining second residual data frame is then appended with a preset frame header and recorded as the third residual data frame. This process continues until the byte length of the Nth residual data frame is less than or equal to the preset maximum transmission byte length. Then, the first to Nth data frames and the Nth residual data frame are output, where N is a positive integer.

[0055] The pre-defined frame header structure includes at least the receiver's MAC address, the sender's MAC address, the data number, the data frame sequence number, and the total number of frames to be split. This splitting operation and the specific frame header structure divide the data to be sent into multiple data frames, each with its own format, facilitating later reassembly.

[0056] The data receiving unit 22 includes a receiving module 221, a data reconstruction module 222, a second filtering module 223, and a display module 224. The receiving module 221 is used to receive data frames transmitted from outside. The data reconstruction module 222 is used to reconstruct the received data frames. The second filtering module 223 is used to filter the reconstructed data according to a preset filtering rule. The preset filtering rule can be the same as or different from the preset filtering rule in the first filtering module 211. The display module 224 is used to display the filtered and allowed data.

[0057] The specific operation for data frame reassembly is as follows: After receiving a data frame, it is reassembled according to the sender's MAC address. Reassembly ensures that the data frames have the same data number and the total number of split frames equals the sum of the original data frames. Then, the data frames are arranged in ascending order of their sequence numbers, and the frames are concatenated. The preset frame header and preset common header are removed to obtain the reassembled data. Because the data frames have the same data number, other data frames will not be reassembled. This reassembly operation ensures data integrity and consistency.

[0058] The present invention also includes a non-network layer-based communication method, which includes bidirectional communication between the first intranet machine 2 and the second intranet machine 3 within the intranet and bidirectional communication between the first intranet machine 2 and the first extranet machine 4 within the intranet and extranet.

[0059] Among them, the first intranet machine 2 and the second intranet machine 3 communicate bidirectionally within the intranet, which is bidirectional communication between hosts in the intranet environment. The specific process is as follows:

[0060] (1) The first intranet machine 2, as the sender, obtains the MAC address of the second intranet machine 3. This process is the existing broadcast MAC address process, so it will not be described in detail. The first intranet machine 2 filters the data to be sent according to the preset filtering rules. The data to be sent after filtering is split to obtain the split data frame. The data frame is sent to the Layer 2 switch 1 through the MAC layer communication method. The data that cannot be sent is directly discarded locally.

[0061] The preset filtering rules are the same as those mentioned above, and can be data type filtering, content filtering, or a combination of data type filtering and content filtering.

[0062] Data type filtering refers to judging the message type of data, discarding data of the type that meets the conditions, and allowing data of the type that does not meet the conditions to pass through directly;

[0063] Content filtering refers to defining sending and receiving behaviors as Input / Output, corresponding to the keyword Flow. It then checks whether the Flow keyword of the sender and receiver equals Input / Output, discarding data that meets the criteria and allowing data that does not. If no Flow is defined in the rule filtering conditions, the default rule applies to both sending and receiving behaviors.

[0064] Overlaying data type filtering and carrying content filtering refers to using data type filtering and carrying content filtering simultaneously; here, the first intranet machine 2, as the sender, sets up two overlay filtering rules as an example:

[0065] The filter criteria are:

Flow = Output && MsgType! = 1 && Content == Hello

[0066] Before splitting the data, define whether the sender's Flow key character is equal to Output, check whether the MsgType data type meets the requirements, if it does, then iterate through the data content to see if the Hello keyword exists. If both conditions are met, the data is discarded and the sending action fails.

[0067] The filtered and approved data to be sent is split into smaller parts. Specifically, a preset frame header and a preset common header are added to the header of the filtered and approved data to obtain an initial data frame. The initial data frame is then evaluated. If the byte length of the initial data frame is less than or equal to the preset maximum transmission byte length, the initial data frame is output. If the byte length of the initial data frame is greater than the preset maximum transmission byte length, a first data frame with the same preset maximum transmission byte length is split from the header of the initial data frame. The remaining data frame is then split by adding a preset frame header, and this is recorded as the first remaining data frame. If the byte length of the first remaining data frame is less than or equal to the preset maximum transmission byte length, both the first data frame and the first remaining data frame are output. If the byte length of the first remaining data frame is greater than the preset maximum transmission byte length, the first remaining data frame is split from the header of the initial data frame. The first remaining data frame is split from the header to form a second data frame with the same preset maximum transmission byte length. The remaining first remaining data frame is then split from the header to form a second remaining data frame. If the byte length of the second remaining data frame is less than or equal to the preset maximum transmission byte length, the first data frame, the second data frame, and the second remaining data frame are output. If the byte length of the second remaining data frame is greater than the preset maximum transmission byte length, the second remaining data frame is split from the header to form a third data frame with the same preset maximum transmission byte length. The remaining second remaining data frame is then split from the header to form a third remaining data frame. This process continues until the byte length of the Nth remaining data frame is less than or equal to the preset maximum transmission byte length. Then, the first to Nth data frames and the Nth remaining data frame are output, where N is a positive integer.

[0068] The pre-defined frame header structure includes at least the receiver's MAC address, the sender's MAC address, the data number, the data frame sequence number, and the total number of frames to be split. This splitting operation and the specific frame header structure divide the data to be sent into multiple data frames, each with its own format, facilitating later reassembly.

[0069] For example, let's take sending 2000 bytes of data as an example to illustrate the splitting of communication data at the sender, where the MTU (Maximum Transmission Unit) is set to 1500 bytes; at this time, the first intranet machine 2 has obtained the MAC address of the second intranet machine 3, such as the MAC address of the first intranet machine 2 being 1111111111111, and the MAC address of the second intranet machine 3 being 222222222222;

[0070] Splitting: 2000 bytes of data to be sent, plus a 28-byte preset frame header. The preset frame header includes the receiver's MAC address (Dest-MAC), the sender's MAC address (Src-MAC), the data number (MsgId), the data frame sequence number (Seq), and the total number of frames to be split (TotalNum). Then, a 16-byte preset common header is added. The preset common header includes the data version (Version), the payload header length (HeadLen), the number of sub-data items (SubMsgNum), and the payload length (MsgLen). The final result is... The initial data frame needs to be transmitted in lengths of 2000 + 28 + 16 = 2044 bytes. Further analysis reveals that the initial data frame's length of 2044 bytes exceeds the preset maximum transmission length of 1500 bytes. Therefore, the initial data frame needs to be decompressed. A first data frame with the same preset maximum transmission length is extracted from the 2044-byte header of the initial data frame. This first data frame has 1500 bytes. After removing the preset frame header and preset common header, only 1456 bytes are actually the data content. Figure 3 As shown;

[0071] The remaining 544 bytes of data frame header, after adding the preset frame header, is denoted as the first remaining data frame. The first remaining data frame has 572 bytes. Upon evaluation, the byte length of the first remaining data frame (572 bytes) is found to be less than or equal to the preset maximum transmission byte length of 1500 bytes. The structure of the first remaining data frame is as follows: Figure 4 As shown;

[0072] Finally, the first data frame and the first remaining data frame are output. The first data frame and the first remaining data frame are the split data frames. Then, they are sent to Layer 2 switch 1 through MAC layer communication. Data that cannot be allowed after filtering is directly discarded locally.

[0073] (2) Layer 2 switch 1 forwards the data frame to the second internal network machine 3 through the MAC address of the second internal network machine in the received data frame;

[0074] (3) The second intranet machine 3 receives the data frame as the receiver, and then reassembles the data frame. The reassembled data is filtered according to the preset filtering rules. The filtered data is displayed, and the data that cannot be passed is discarded.

[0075] The specific operation of the second intranet machine 3 as the receiver to reassemble data frames is as follows: After receiving the data frame, it assembles packets according to the MAC address of the sender. The packet assembly satisfies that the data numbers in the data frames are the same and the total number of split frames is equal to the sum of the cumulative number of data frames. Then, the data frames are arranged in ascending order according to the numerical value of the data frame sequence number, and the data frames are spliced ​​together. The preset frame header and preset common header are removed to obtain the reassembled data.

[0076] For example: Corresponding to the first data frame and the first remaining data frame after the above splitting, when the receiver receives the two frames, it reassembles them according to the sender's MAC address Src-MAC in the data frames. Packet assembly is based on three conditions: data ID MsgId + data frame sequence number Seq + total number of split frames TotalNum. The data frames must have the same MsgId to prevent other data frames from participating in the reassembly. The total number of split frames TotalNum equals the sum of the number of data frames. Then, the data frames are arranged in ascending order according to their sequence numbers Seq, and concatenated. This ensures data integrity, consistency, and accuracy even if the order of data frames during network transmission is affected. Finally, removing the preset frame header and preset common header yields the reassembled data. Figure 5 As shown;

[0077] Here, the second intranet machine 3, acting as the receiver, is configured with two overlay filtering rules as an example:

[0078] The filtering condition is:

Flow=Input&&MsgType!=1&&Content==Hello

[0079] After the receiver completes the data reassembly, the receiver's Flow key characters are defined to be equal to Input. The MsgType data type is checked to see if it meets the requirements. If it does, the data content is iterated to see if it contains the Hello keyword. If both conditions are met, the data is discarded and not displayed. Otherwise, it is displayed.

[0080] Therefore, it can be seen that bidirectional communication between hosts in an intranet environment is not affected by network protocol layer configuration. Its data transmission adopts RAW Socket combined with custom data structure, which can avoid the impact of threatening behaviors based on network layer protocol methods and eliminate the risk of leakage of network layer communication information.

[0081] Among them, the first internal network machine 2 and the first external network machine 4 communicate bidirectionally between the internal and external networks, that is, bidirectional communication between hosts in the internal and external network environments. The specific process is as follows:

[0082] (1) After the first internal network machine obtains the MAC address of the first external network machine as the sender, it filters the data to be sent according to the preset filtering rules. The data to be sent after filtering is split to obtain the split data frame. The data frame is sent to the first external network machine through MAC layer communication. The data that cannot be sent is directly discarded locally.

[0083] (2) The first external network machine receives the data frame as the receiver, and then reassembles the data frame. The reassembled data is filtered according to the preset filtering rules. The data that is allowed after filtering is displayed, and the data that cannot be allowed is discarded directly.

[0084] The filtering, data splitting, and data frame reassembly processes generated by the preset filtering rules during bidirectional communication between the first intranet machine 2 and the first extranet machine 4 are consistent with the filtering, data splitting, and data frame reassembly processes generated by the preset filtering rules during bidirectional communication between the first intranet machine 2 and the second intranet machine 3, and therefore will not be described further.

[0085] Therefore, it can be seen that the data between hosts in the intranet environment and between hosts in the intranet and extranet environments in this invention adopts the RAWSocket combined with a custom data structure. Of course, DPDK and Netfilt combined with a custom data structure can also be used. This eliminates the need for network layer protocol forwarding, thus eliminating the risk of leakage of network layer communication information. Moreover, the custom data structure can be customized according to the user's choice to formulate data filtering rules, thereby increasing customization to adapt to different business or scenario operation requirements.

Claims

1. A non-network layer based communication system, characterized by The system includes a Layer 2 switch supporting Layer 2 forwarding capabilities, a first internal network machine, a second internal network machine, a first external network machine, and a second external network machine; the first internal network machine and the second internal network machine are both connected to the Layer 2 switch via MAC interfaces, the first external network machine and the second external network machine are connected to each other via an IP network, the first external network machine is connected to the first internal network machine via a MAC interface, and the second external network machine is connected to the second internal network machine via a MAC interface. Each of the first intranet machine, the second intranet machine, the first extranet machine, and the second extranet machine includes a data receiving unit and a data sending unit. The data sending unit includes a first filtering module, a data splitting module, and a sending module; the first filtering module is used to filter the data to be sent according to a preset filtering rule; the data splitting module is used to split the filtered data to be sent; and the sending module sends out the split data frames. The data receiving unit includes a receiving module, a data reconstruction module, a second filtering module, and a display module; the receiving module is used to receive data frames transmitted from outside; the data reconstruction module is used to reconstruct the received data frames; the second filtering module is used to filter the reconstructed data according to preset filtering rules; and the display module is used to display the filtered and allowed data. The specific operation of the splitting process is as follows: Add a preset frame header and a preset common header to the header of the filtered and allowed data to be sent to obtain an initial data frame. Judge the initial data frame: if the byte length of the initial data frame is less than or equal to the preset maximum transmission byte length, output the initial data frame; if the byte length of the initial data frame is greater than the preset maximum transmission byte length, split the header of the initial data frame to obtain a first data frame with the same preset maximum transmission byte length. Add a preset frame header to the header of the remaining data frame and record it as the first remaining data frame. Judge the first remaining data frame: if the byte length of the first remaining data frame is less than or equal to the preset maximum transmission byte length, output the first data frame and the first remaining data frame; if the byte length of the first remaining data frame is greater than the preset maximum transmission byte length, split the header of the first remaining data frame... A second data frame with the same length as the preset maximum transmission byte length is output. The remaining first residual data frame is appended with a preset frame header and recorded as the second residual data frame. If the byte length of the second residual data frame is less than or equal to the preset maximum transmission byte length, the first data frame, the second data frame, and the second residual data frame are output. If the byte length of the second residual data frame is greater than the preset maximum transmission byte length, a third data frame with the same length as the preset maximum transmission byte length is split from the header of the second residual data frame. The remaining second residual data frame is appended with a preset frame header and recorded as the third residual data frame. This process continues until the byte length of the Nth residual data frame is less than or equal to the preset maximum transmission byte length. Then, the first to Nth data frames and the Nth residual data frame are output, where N is a positive integer.

2. A non-network layer based communication system as claimed in claim 1, wherein: The preset filtering rules in the first and second filtering modules are data type filtering, content filtering, or a combination of data type filtering and content filtering. The data type filtering refers to judging the message type of the data, discarding data of the type that meets the conditions, and allowing data that does not meet the conditions to pass directly. The content filtering refers to defining sending and receiving behaviors as Input / Output, corresponding to the keyword Flow, judging whether the Flow keyword of the sender and receiver is equal to Input / Output, discarding data of the type that meets the condition, and allowing data that does not meet the condition directly.

3. A communication system based on a non-network layer according to claim 1, characterized in that: The structure of the preset frame header includes at least the receiver's MAC address, the sender's MAC address, the data number, the data frame sequence number, and the total number of frames split.

4. A communication system based on a non-network layer according to claim 3, characterized in that, The specific operation for reassembling the data frames is as follows: after receiving the data frame, the data frames are grouped according to the MAC address of the sender. The grouping satisfies that the data numbers in the data frames are the same and the total number of split frames is equal to the sum of the cumulative number of data frames. Then, the data frames are arranged in ascending order according to the numerical value of the data frame sequence number, and the data frames are spliced ​​together. The preset frame header and preset common header are removed to obtain the reassembled data.

5. A communication method based on a non-network layer, characterized in that, The method includes bidirectional communication between the first intranet machine and the second intranet machine within the intranet, and bidirectional communication between the first intranet machine and the first external network machine between the intranet and external networks; The specific process of bidirectional communication between the first intranet machine and the second intranet machine is as follows: (1) After the first intranet machine obtains the MAC address of the second intranet machine as the sender, it filters the data to be sent according to the preset filtering rules. The data to be sent after filtering is split to obtain the split data frame. The data frame is sent to the Layer 2 switch through the MAC layer communication method. The data that cannot be sent is directly discarded locally. (2) The Layer 2 switch forwards the data frame to the second internal network machine through the MAC address of the second internal network machine in the received data frame; (3) The second intranet machine receives the data frame as the receiver, and then reassembles the data frame. The reassembled data is filtered according to the preset filtering rules. The data that is allowed after filtering is displayed, and the data that cannot be allowed is discarded directly. The specific process of bidirectional communication between the first intranet machine and the first extranet machine is as follows: (1) After the first intranet machine obtains the MAC address of the first extranet machine as the sender, it filters the data to be sent according to the preset filtering rules. The data to be sent after filtering is split to obtain the split data frame. The data frame is sent to the first extranet machine through MAC layer communication. The data that cannot be sent is directly discarded locally. (2) The first external network machine receives the data frame as the receiver, and then reassembles the data frame. The reassembled data is filtered according to the preset filtering rules. The filtered data that can be passed is displayed, and the data that cannot be passed is discarded directly. The specific operation of the splitting process is as follows: Add a preset frame header and a preset common header to the header of the filtered and allowed data to be sent to obtain an initial data frame. Judge the initial data frame: if the byte length of the initial data frame is less than or equal to the preset maximum transmission byte length, output the initial data frame; if the byte length of the initial data frame is greater than the preset maximum transmission byte length, split the header of the initial data frame to obtain a first data frame with the same preset maximum transmission byte length. Add a preset frame header to the header of the remaining data frame and record it as the first remaining data frame. Judge the first remaining data frame: if the byte length of the first remaining data frame is less than or equal to the preset maximum transmission byte length, output the first data frame and the first remaining data frame; if the byte length of the first remaining data frame is greater than the preset maximum transmission byte length, split the header of the first remaining data frame... A second data frame with the same length as the preset maximum transmission byte length is output. The remaining first residual data frame is appended with a preset frame header and recorded as the second residual data frame. If the byte length of the second residual data frame is less than or equal to the preset maximum transmission byte length, the first data frame, the second data frame, and the second residual data frame are output. If the byte length of the second residual data frame is greater than the preset maximum transmission byte length, a third data frame with the same length as the preset maximum transmission byte length is split from the header of the second residual data frame. The remaining second residual data frame is appended with a preset frame header and recorded as the third residual data frame. This process continues until the byte length of the Nth residual data frame is less than or equal to the preset maximum transmission byte length. Then, the first to Nth data frames and the Nth residual data frame are output, where N is a positive integer.

6. A communication method based on a non-network layer according to claim 5, characterized in that: The preset filtering rules are data type filtering, content filtering, or a combination of data type filtering and content filtering. The data type filtering refers to judging the message type of the data, discarding data of the type that meets the conditions, and allowing data that does not meet the conditions to pass directly. The content filtering refers to defining sending and receiving behaviors as Input / Output, corresponding to the keyword Flow, judging whether the Flow keyword of the sender and receiver is equal to Input / Output, discarding data of the type that meets the condition, and allowing data that does not meet the condition directly.

7. A communication method based on a non-network layer according to claim 5, characterized in that: The structure of the preset frame header includes at least the receiver's MAC address, the sender's MAC address, the data number, the data frame sequence number, and the total number of frames split.

8. A communication method based on a non-network layer according to claim 7, characterized in that: The specific operation for reassembling the data frames is as follows: after receiving the data frame, the data frames are grouped according to the MAC address of the sender. The grouping satisfies that the data numbers in the data frames are the same and the total number of split frames is equal to the sum of the cumulative number of data frames. Then, the data frames are arranged in ascending order according to the numerical value of the data frame sequence number, and the data frames are spliced ​​together. The preset frame header and preset common header are removed to obtain the reassembled data.

Images