A demonstration terminal system based on policy verification

Abstract

The present application relates to a kind of demonstration terminal systems based on policy verification, it includes display terminal without the ability to configure internal security program;With the ability to configure internal security program, the data interface of each display terminal and zone control terminal is accessed to ip firewall unit, ip firewall unit is based on the data of preset policy verification through terminal, wherein, when display terminal transmits data to another display terminal, ip firewall unit is based on the data type history and data emergency label recorded by itself, and determines the transmission path of data to the display terminal as receiver, transmission path changes in the mode associated with the check result, when the display terminal of the system transmits data to the rest of the terminal, directly use optimization judgment strategy, allow part of data to be able to run in the receiving end with poison on the basis of considering information emergency degree, to realize information security while allowing part of data to be able to run in the receiving end with poison, to guarantee the timeliness and effectiveness of data transmission.

Description

Technical Field

[0001] This invention relates to the field of terminal device security protection technology, and in particular to a demonstration terminal system based on policy verification. Background Technology

[0002] Display screens, as playback and output devices, are widely used in various fields. With urban development and the maturity of information technology, outdoor display screens, especially large ones, are becoming increasingly common. For example, in the securities trading sector, public display screens are typically used to display financial information, facilitating timely and accurate access to trading information for securities traders. In the transportation sector, display screens are commonly used to display train or flight information, including arrival and departure times, boarding status, destinations, and more. Furthermore, display screens play a significant role in public information display in stadiums, command centers, shopping malls, performances, and gatherings. However, because outdoor display screens are often installed outdoors in cities and reach a very wide audience, any issues with the displayed content, such as pornography or other sensitive topics, can have a wide-ranging impact. Outdoor display screens also face challenges such as wide distribution, difficulty in management, high management costs, and significant consequences from content security issues.

[0003] In the prior art, such as the patent document with publication number CN112040319A, a method and firewall system for intelligent pornography detection on advertising screens are proposed. The method for intelligent pornography detection on advertising screens includes dividing the information input by the edge module into first information and second information, receiving the second information; converting the second information from image information into text information; judging whether the text information involves sensitive information based on the text information. If so, the text information, image information and second information are sent to the cloud. If not, the program is broadcast normally; receiving the event information summary and action instructions sent by the cloud; and sending the action instructions to the edge module.

[0004] The aforementioned prior art provides a firewall system configured inside a display screen for information detection (including content moderation). First, this firewall system has a limited function, only capable of detecting content as inappropriate or offensive. It cannot verify whether information has been subjected to intrusion attacks. For example, in financial securities trading venues, attackers might display tampered and incorrect securities information on the screen, causing users to misjudge trading situations and suffer significant losses; this method cannot prevent such situations. Furthermore, placing the firewall system inside the display screen requires additional programming and compatibility testing with the system connected to the screen, making the installation process extremely cumbersome. Finally, as a firewall system installed inside the display screen, it needs to provide its own address to complete information exchange. With its own address, attackers can even launch attacks directly against the firewall system based on its own address, increasing the risk of being attacked.

[0005] Specifically, for example, in the display of disaster alarm information, if the disaster alarm information is not security checked, it may be infected by the terminal receiving the disaster alarm information because the sender of the disaster alarm information itself carries a virus. In more serious cases, the virus may spread to external devices through the receiving terminal, causing more serious losses. If the disaster alarm information is security checked in a conventional way, the detection speed is slow, which may lead to untimely information transmission and affect public safety.

[0006] For example, in hospital medical records, a virus might be introduced into a self-service terminal. Without information security checks, the virus could spread throughout the hospital's internal network along with the medical records, affecting the operation of the medical system. If routine security checks are performed on each type of medical record, the checks take time, and given the massive amount of medical data in the hospital system, each security check slows down the system, increasing the time it takes for patients to obtain test results and medical information, potentially delaying their treatment.

[0007] For example, if the advertising information displayed on the advertising screens in commercial streets is not subject to security checks, any inappropriate content will be directly seen by a large number of people once it is broadcast, and the inappropriate information will have a negative social impact. However, if the advertising information data is checked every time, the efficiency of the advertising will be slowed down, especially during prime advertising time, and the advertising effect will be greatly reduced if the advertising is not delivered in a timely manner.

[0008] Furthermore, on the one hand, there are differences in understanding among those skilled in the art; on the other hand, the inventors studied a large number of documents and patents when making this invention, but due to space limitations, not all details and contents were listed in detail. However, this does not mean that the present invention does not possess the features of these prior art. On the contrary, the present invention already possesses all the features of the prior art, and the applicant reserves the right to add relevant prior art to the background art. Summary of the Invention

[0009] To address the shortcomings of existing technical solutions, this application proposes a policy-based verification demonstration terminal system, comprising: a display terminal incapable of configuring internal security programs, and a zone control terminal capable of configuring internal security programs. Each display terminal and the zone control terminal's data access point is connected to a no-IP firewall unit. The no-IP firewall unit verifies data passing through the terminal based on a preset policy. When a display terminal transmits data to another display terminal, the no-IP firewall unit performs verification based on its own recorded data type history and data urgency tags, and determines the data transmission path to the receiving display terminal. The transmission path changes in a manner associated with the verification result.

[0010] This application proposes an IP-free firewall unit that can be physically connected to the data input and output ports of a display terminal. The IP-free firewall unit is directly connected in series in front of the data interface of the display terminal, without the need for IP allocation or network modification. It enables centralized management, saves management costs, and allows enterprises to manage protected devices more conveniently.

[0011] Preferably, when the display terminal transmits data to another display terminal, the transmission path includes at least:

[0012] First path: Transmitted from the sending end to the first IP-free firewall unit, and from the first IP-free firewall unit to the receiving end;

[0013] Second path: Transmitted from the sending end to the first IP-free firewall unit, from the first IP-free firewall unit to the second IP-free firewall unit, and from the second IP-free firewall unit to the receiving end;

[0014] The third path: The data is transmitted from the sending end to the first IP-free firewall unit, from the first IP-free firewall unit to the second IP-free firewall unit, from the second IP-free firewall unit to the receiving end, but the receiving end isolates the data and backs it up to the area control terminal. After verification by the area control terminal, the data isolation of the receiving end is lifted.

[0015] Fourth path: The data is transmitted from the sending end to the first IP-free firewall unit, from the first IP-free firewall unit to the second IP-free firewall unit, from the second IP-free firewall unit to the receiving end, but the receiving end isolates the data and backs it up to the area control terminal. After verification by the area control terminal, the data at the receiving end is kept isolated and a warning message is sent to the central control terminal.

[0016] Fifth path: The data is transmitted from the sending end to the first IP-free firewall unit, from the first IP-free firewall unit to the second IP-free firewall unit, from the second IP-free firewall unit directly to the area control terminal, and from the area control terminal to the receiving end.

[0017] The sixth path: data is transmitted from the sending end to the first IP-free firewall unit, then from the first IP-free firewall unit to the second IP-free firewall unit, and finally directly from the second IP-free firewall unit to the area control terminal. The area control terminal intercepts and backs up the data to the central control terminal. Data isolation means that the IP-free firewall unit can only receive isolated data and cannot transmit it. Through the above scheme, different transmission paths are selected for data information with different attributes in different scenarios. While ensuring that urgent data is delivered to the corresponding display terminal for display in a timely manner, the security of display terminals in the system that do not have network security capabilities is also fully guaranteed. In many application scenarios, this ensures the smooth operation of the work and reduces the risk of network attacks. Preferably, the demonstration terminal system also includes a central control terminal that can perform security management of all display terminals and area control terminals. The IP-free firewall unit determines its own information transmission and reception permission range based on the terminals it accesses. The IP-free firewall unit can distinguish the terminal type corresponding to the source data and reject some data transmissions that are not within the scope of the reception permission.

[0018] Preferably, the first IP-free firewall unit dynamically adjusts the detection and allocation rules based on its own recorded data type history and the data type to be sent by the display terminal it accesses, thereby determining the transmission path of the data to be sent.

[0019] Preferably, if the first IP-free firewall unit determines that the data type to be sent belongs to its own recorded data type history, the first IP-free firewall unit further verifies the urgency of the data to be sent.

[0020] Preferably, if the first IP-free firewall unit determines that the data type to be sent does not belong to its own recorded data type history, the first IP-free firewall unit adds an extra mark to the data to be sent and further verifies the urgency of the data to be sent.

[0021] Preferably, the first IP-free firewall unit handles the urgency of data to be sent without additional tags as follows:

[0022] If the data is urgent, the first IP-free firewall unit will directly send the data to the receiving end;

[0023] If the data is not urgent, the first IP-free firewall unit will send the data to the second IP-free firewall unit for inspection, and only after passing the inspection will it be transmitted to the receiving end.

[0024] Preferably, the first IP-free firewall unit handles the urgency of data to be sent with additional tags as follows:

[0025] If it is urgent data, the first IP-free firewall unit directly sends the data to the receiving end. After the receiving end receives the data, the second IP-free firewall unit isolates the data and backs up the received data to the area control terminal.

[0026] If the data is not urgent, the first IP-free firewall unit will send the data to the area control terminal first, and then send it to the receiving end after the area control terminal detects it.

[0027] Preferably, the zone control terminal detects the data to be detected based on a protection network with a higher security level than the display terminal. The detection and processing method for urgent data to be detected is as follows:

[0028] If the urgent data to be detected contains a virus, the second IP-free firewall unit at the control terminal of the area control terminal continues to maintain data isolation and sends an alarm message to the central control terminal.

[0029] If the urgent data to be detected does not contain a virus, the area control terminal controls the second IP-free firewall unit of the receiving end to release the data isolation.

[0030] Preferably, the detection and processing method of the area control terminal for non-urgent data to be detected is as follows:

[0031] If the non-urgent data to be detected contains a virus, the area control terminal sends an alarm message to the central control terminal.

[0032] If the non-urgent data to be detected does not contain a virus, the area control terminal sends the data to the receiving end.

[0033] Preferably, based on the above logic, for each type of data, the different path selection methods of the display terminal system of this system include at least:

[0034] When the data to be sent is of historical data type and is urgent data, the data to be sent is transmitted through the first path;

[0035] When the data to be sent is historical data but not urgent data, the data to be sent is transmitted through the second path;

[0036] When the data to be sent is not part of the data type history but is urgent and does not contain viruses, the data to be sent is transmitted through a third path;

[0037] When the data to be sent is not part of the data type history but is urgent data, and contains a virus, the data to be sent is transmitted through the fourth path;

[0038] When the data to be sent is not part of the data type history, is non-urgent, and does not contain a virus, the data to be sent is transmitted through the fifth path;

[0039] When the data to be sent is not part of the data type history, is non-urgent, and contains a virus, the data to be sent is transmitted through the sixth path.

[0040] Preferably, when the IP-free firewall unit determines that the sent and / or received data is high-risk data, the IP-free firewall unit rejects the main data in the data from passing through, but allows the display terminal that the IP-free firewall unit intervenes in to generate a feedback instruction, which is returned to the sending end, and the sending end sends the data to the area control terminal for review.

[0041] This solution is based on an IP-free firewall unit configured before each terminal. It can record and save information sent by the terminal in a targeted manner. At the same time, when the terminal transmits data to other terminals, it can directly use automatically formed optimized judgment strategies to achieve information security while considering the urgency of the information. It allows some data to run on the receiving end with viruses, and while preventing the terminal from infecting other devices, the receiving end can still perform basic functions to ensure the timeliness and effectiveness of data transmission. Attached Figure Description

[0042] Figure 1 This is a simplified relational structure diagram of a preferred embodiment of the demonstration terminal system based on policy verification of the present invention;

[0043] Figure 2 This is a schematic diagram of the transmission path in a preferred embodiment of the demonstration terminal system based on policy verification of the present invention.

[0044] List of reference numerals

[0045] 100: Display terminal; 110: No IP firewall unit; 200: Area control terminal; 300: Central control terminal. Detailed Implementation

[0046] The following is in conjunction with the appendix Figure 1-2 The present invention will be described in detail below.

[0047] Example 1

[0048] Currently, common outdoor and indoor displays can play a wide variety of video types and have diverse upload methods. Therefore, it is necessary to classify and audit video content to avoid playing inappropriate content. Currently, most data transmission for displays (equivalent to the display terminal 100 in this application) is uploaded via the network, with some transmitted through peripheral devices. However, due to limitations in device models and manufacturing purposes, displays are difficult to install antivirus programs or have built-in firewalls. Therefore, if infected by a virus, it can easily be used as a springboard to attack other devices on the internal network. Existing technology uses a unified internal network firewall networking mode to prevent viruses in transmitted data content (such as video content, text content, etc.). This means that a unified internal network firewall checks whether the data content is infected before distributing it to the display. However, there are also cases where internal network devices send data to the display. In this case, if the data is infected, the display can be infected because it bypasses the internal network firewall.

[0049] according to Figure 1 The diagram shown is a simplified relational structure diagram of a preferred embodiment of the policy verification-based demonstration terminal system of this application. The connections between the terminal devices at each level of the demonstration terminal system of this application are distributed in a tree-like manner. Specifically, the central control terminal 300 with a security level of three of this application serves as the root node of the tree structure. It maintains indirect or direct connections with the lower-level terminals (several first-level display terminals 100 and several second-level zone control terminals 200) and is able to transmit control signals to the lower-level terminals.

[0050] Specifically, in a security protection network for a demonstration terminal system, a central control terminal 300 is preferably set up. The central control terminal 300 is essentially the management area with the highest management authority for the demonstration terminal system and the constructed security protection network. The central control terminal 300 can perform network data access control and content auditing for itself and all subordinate terminals. Network data access control refers to providing bidirectional network-based five-tuple access control and security auditing services for the electronic display screen (display terminal 100), achieving precise protection and micro-isolation at the network level; content auditing refers to real-time monitoring of inappropriate content and intervention and protection through automatic video stream blocking, alarms, and other methods.

[0051] Preferably, since there are a large number of display terminals 100, the display terminals 100 in several adjacent spaces can be divided into the same area according to the layout space of the display terminals 100 in the actual environment, and the display terminals 100 in the same area can be controlled by a zone control terminal 200, which is a device with first security protection capability.

[0052] Preferably, the area control terminal 200 is capable of performing preliminary auditing and detection of the transmitted content and has a certain level of security.

[0053] Preferably, several area control terminals 200 in several areas are then uniformly controlled by a central control terminal 300. When an area control terminal 200 is unable to effectively and accurately detect or process the data, it seeks assistance from the central control terminal 300 for processing.

[0054] Preferably, the central control terminal 300 can store data information flowing through terminals at all levels. Furthermore, the demonstration terminal system of this application connects with external, official, and standard regulatory departments through the central control terminal 300, providing analytical data to the regulatory departments. It can also send abnormal video warning information, network access log information, attack protection log information, and high traffic warnings to the regulatory departments based on geographical location, facilitating the regulatory departments to supervise and control the actual network environment.

[0055] Preferably, the advantage of the demonstration terminal system of this application is that an IP-free firewall unit 110 can be physically connected at the data access point of each terminal. That is, an IP-free firewall unit 110 is connected at the data inflow or outflow interface of each terminal. Whether data is input to the terminal through a wired network or a portable storage device, the data will preferentially pass through the IP-free firewall unit 110. Even when the data is transmitted according to the first path, from the sending end to the first IP-free firewall unit, and from the first IP-free firewall unit to the receiving end, the first IP-free firewall unit directly transmits the data to the receiving end, which also means that the second IP-free firewall unit at the receiving end will not detect or intercept the data, but the data flow will still pass through the second IP-free firewall unit and then flow into the receiving end.

[0056] Furthermore, existing electronic display screens currently face the following challenges: they can access the internet, cannot install antivirus software, and have security vulnerabilities. Moreover, the sheer number, variety, and dispersed nature of these screens, involving numerous tenants, makes them difficult to monitor and hinders their security protection. The main security vulnerabilities of electronic display screens include: content tampering: displaying inappropriate or non-standard information, causing adverse social impact; virus implantation: implanting viruses or Trojans, potentially causing cross-infection; and information leakage: using electronic screens as attack platforms to spread to internal networks, thereby stealing important data from related systems, resulting in data leaks and outflows.

[0057] Therefore, electronic displays require security protection. A common technical approach to this is to install an electronic firewall, which involves configuring a firewall internally as software. However, this solution is cumbersome to set up and maintain, requiring significant manpower and financial resources. Furthermore, the configuration process necessitates assigning an additional IP address to the firewall system, which could expose the firewall itself to network attacks, leading to security failure.

[0058] Based on the above problems, this application proposes an IP-free firewall unit 110 that can be physically connected to the data input and output ports of the display terminal 100. The IP-free firewall unit 110 is directly connected in series in front of the data interface of the display terminal 100, without the need for management and IP allocation, without changing the network, and can be centrally managed, thus saving management costs.

[0059] Preferably, the IP-free firewall unit 110 can add a special mark to the data packet when the terminal it accesses sends data. The data packet with the special mark can be intercepted, identified and processed by the IP-free firewall unit 110 at the receiving end when it flows to any other display terminal 100 or area control terminal 200.

[0060] Preferably, when a data packet with a special tag passes through the IP-free firewall unit 110, the IP-free firewall unit 110 first detects the special tag of the data packet. If the special tag matches the rules, it proceeds to the next step for further processing; otherwise, the data packet is sent to the central control terminal 300 and / or the regional control terminal 200 for virus detection.

[0061] Preferably, the IP-free firewall unit 110 at the receiving end analyzes the data packets with special tags, extracts the IP address and MAC address of the sending end (terminal) in the data packets, and saves them to the data type history of the IP-free firewall unit 110. The IP-free firewall unit 110 at the receiving end uses the IP address of the terminal it accesses as its own IP communication address.

[0062] Preferably, the special marker assigned to the data packet by the IP-free firewall unit 110 is that a probe data packet is sent together with the data packet. The probe data packet can only be sent, received, and identified by the IP-free firewall unit 110.

[0063] Preferably, the advantage of the IP-free firewall unit 110 of this application is that it can be applied to various installed and uninstalled demonstration terminal systems. When the IP-free firewall unit 110 of this application is required to protect the security of various display terminals 100, it is only necessary to connect the IP-free firewall unit 110 of this application to the front of the data interface of the display terminal 100 to be protected through physical bridging. There is no need to modify the network configuration or change the network topology, and the application can be quickly deployed and effectively adapted to different field environments.

[0064] It eliminates the need to install agent software on the protected devices or change the existing network architecture, thus solving the problems of centralized management of device security and low security capabilities of the terminals themselves in the context of the Internet of Things.

[0065] Example 2

[0066] This embodiment is an improvement and supplement to embodiment 1, and repeated content will not be repeated.

[0067] In real-world applications, there are situations where certain data requires urgent processing. For example, a display screen might be used to publish emergency information or as a queuing system in an emergency room. If it waits for review and processing by the internal network firewall, the screen's operation will be significantly delayed. Unlike conventional data transmission, there may be needs in this field where information with high threat risks can be provided directly to the display screen without going through the internal network firewall. Existing technologies do not address how to protect against such situations. Therefore, this application proposes a demonstration terminal system that uses a policy-based verification method to securely verify data flowing into and / or out of the display terminal 100 and to display the information in a timely manner.

[0068] Figure 1A simplified relational structure diagram of a preferred embodiment of the policy-based verification demonstration terminal system of this application is shown. The system includes at least several display terminals 100 that are not capable of configuring their own internal security programs. These display terminals 100 are divided into zones, and each zone is configured with a zone control terminal 200 capable of configuring its own internal security programs. The data access points of each display terminal 100 and the zone control terminal 200 are connected to an IP-free firewall unit 110. The IP-free firewall unit 110 verifies data passing through the terminals based on a preset policy. When a display terminal 100 transmits data to another display terminal 100, the IP-free firewall unit 110 verifies the data based on its own recorded data type history and data urgency tags, and determines the transmission path of the data to the receiving display terminal 100. The transmission path changes in a manner associated with the verification result. Data type history refers to the data that the IP-free firewall unit 110 can record for data packets passing through it. The recorded content includes at least the packet header information and the data content. By comparing the recorded header information and data content, it is determined whether the currently passing data packet belongs to the data type history.

[0069] Preferably, the demonstration terminal system also includes a central control terminal 300 capable of security management of all display terminals 100 and area control terminals 200. The IP-free firewall unit 110 determines its own information transmission and reception permission range based on the terminals it accesses. The IP-free firewall unit 110 can distinguish the terminal type corresponding to the source data and reject some data transmissions that do not belong to the reception permission range.

[0070] Specifically, the demonstration terminal system of this application includes at least one central control terminal 300, several zone control terminals 200, and several display terminals 100. The central control terminal 300 has the highest level of security protection, the zone control terminals 200 have lower security protection levels, and the display terminals 100 themselves do not possess any network security protection capabilities. Therefore, based on the terminal security protection levels, display terminals 100 are classified as Level 1 terminals, zone control terminals 200 as Level 2 terminals, and central control terminal 300 as Level 3 terminals. More specifically, Level 1 terminals mainly refer to terminals that lack the ability to configure internal security programs, including at least devices such as USB flash drives, displays, upload devices, etc. In this application, "secondary terminal" mainly refers to a display terminal 100 used for information demonstration, such as a hospital's queuing screen or a securities information display screen in a securities trading venue. The more timeliness and security requirements of the application scenario, the more significant the role of the demonstration terminal system in this application will be. Secondary terminals mainly refer to terminals capable of configuring internal security programs, such as work computers, server workstations, and security protection terminal equipment. Tertiary terminals refer to security terminals that manage the entire intranet, which are usually network security management center devices of an enterprise or venue.

[0071] Preferably, the first IP-free firewall unit dynamically adjusts the detection and allocation rules based on its own recorded data type history and the data type to be sent by the connected display terminal 100, thereby determining the transmission path of the data to be sent. For the IP-free firewall unit 110 connected to the front end of the data access point of each display terminal 100 and the area control terminal 200, when the connected terminal is the sending end, the IP-free firewall unit 110 is called the first IP-free firewall unit, and when the connected terminal is the receiving end, the IP-free firewall unit 110 is called the second IP-free firewall unit.

[0072] When information is input into existing or common demonstration systems, the control terminal itself has a certain information detection capability, which can, to some extent, cope with network attacks by attackers or identify whether the information contains viruses. Therefore, the terminal most vulnerable to attack or infection is the display device (equivalent to the display terminal 100 of this application). For example, if a virus is input from the outside to the display device, or if information sent from the display device is tampered with or infected, and the control terminal's trust in the display device is exploited to infect the entire system, or if one display device infects other connected display devices, it will cause certain interference to the existing demonstration system. However, the demonstration terminal system of this application can select different transmission paths and data processing methods according to the data type and urgency of the data when transmitting information between different display terminals 100 and another display terminal 100. Figure 2 The diagram shown illustrates a transmission path according to a preferred embodiment of this application. When display terminal 100 transmits data to another display terminal 100, the transmission path of the demonstration terminal system of this application includes at least the following:

[0073] First path: Transmitted from the sending end to the first IP-free firewall unit, and from the first IP-free firewall unit to the receiving end;

[0074] Second path: Transmitted from the sending end to the first IP-free firewall unit, from the first IP-free firewall unit to the second IP-free firewall unit, and from the second IP-free firewall unit to the receiving end;

[0075] The third path: The data is transmitted from the sending end to the first IP-free firewall unit, from the first IP-free firewall unit to the second IP-free firewall unit, from the second IP-free firewall unit to the receiving end, but the receiving end isolates the data and backs it up to the area control terminal 200. After verification by the area control terminal 200, the data isolation of the receiving end is lifted.

[0076] Fourth path: The data is transmitted from the sending end to the first IP-free firewall unit, from the first IP-free firewall unit to the second IP-free firewall unit, from the second IP-free firewall unit to the receiving end, but the receiving end isolates the data and backs it up to the area control terminal 200. After verification, the area control terminal 200 continues to maintain the data isolation at the receiving end and sends a warning message to the central control terminal 300.

[0077] Fifth path: The data is transmitted from the sending end to the first IP-free firewall unit, from the first IP-free firewall unit to the second IP-free firewall unit, from the second IP-free firewall unit directly to the area control terminal 200, and from the area control terminal 200 to the receiving end.

[0078] The sixth path: The data is transmitted from the sending end to the first IP-free firewall unit, then from the first IP-free firewall unit to the second IP-free firewall unit, and finally directly from the second IP-free firewall unit to the area control terminal 200. The area control terminal 200 intercepts the data and backs it up to the central control terminal 300.

[0079] Preferably, if the first IP-free firewall unit determines that the data type to be sent belongs to its own recorded data type history, the first IP-free firewall unit further verifies the urgency of the data to be sent.

[0080] Preferably, if the first IP-free firewall unit determines that the data type to be sent does not belong to its own recorded data type history, the first IP-free firewall unit adds an extra mark to the data to be sent and then further verifies the urgency of the data to be sent.

[0081] Preferably, the first IP-free firewall unit handles the urgency of data to be sent without additional tags as follows:

[0082] If the data is urgent, the first IP-free firewall unit will directly send the data to the receiving end;

[0083] If the data is not urgent, the first IP-free firewall unit will send the data to the second IP-free firewall unit for inspection, and only after passing the inspection will it be transmitted to the receiving end.

[0084] Preferably, the first IP-free firewall unit handles the urgency of pending data with additional tags as follows:

[0085] If it is urgent data, the first IP-free firewall unit directly sends the data to the receiving end. After the receiving end receives the data, the second IP-free firewall unit isolates the data and backs up the received data to the area control terminal 200.

[0086] If the data is not urgent, the first IP-free firewall unit will send the data to the area control terminal 200 first, and then send it to the receiving end after it is detected by the area control terminal 200.

[0087] Preferably, the zone control terminal 200 detects the data to be detected based on a protection network with a higher security level than the display terminal 100. The detection and processing method for urgent data to be detected is as follows:

[0088] If the urgent data to be detected contains a virus, the area control terminal 200 controls the second IP-free firewall unit at the receiving end to continue to isolate the data and sends an alarm message to the central control terminal 300.

[0089] If the urgent data to be tested is not virus-free, the second IP-free firewall unit of the control terminal 200 will release the data isolation.

[0090] Preferably, the detection and processing method of the area control terminal 200 for non-urgent data to be detected is as follows:

[0091] If the non-urgent data to be detected contains a virus, the area control terminal 200 sends an alarm message to the central control terminal 300;

[0092] If the non-urgent data to be tested is not virus-free, the district control terminal 200 sends the data to the receiving end.

[0093] Based on the above logic, in the case of one display terminal 100 sending information to another display terminal 100, the specific selection of the transmission path is as follows:

[0094] When the data to be sent is of historical data type and is urgent data, the data to be sent is transmitted through the first path;

[0095] When the data to be sent is historical data but not urgent data, the data to be sent is transmitted through the second path;

[0096] When the data to be sent is not part of the data type history but is urgent and does not contain viruses, the data to be sent is transmitted through a third path;

[0097] When the data to be sent is not part of the data type history but is urgent data, and contains a virus, the data to be sent is transmitted through the fourth path;

[0098] When the data to be sent is not part of the data type history, is non-urgent, and does not contain a virus, the data to be sent is transmitted through the fifth path;

[0099] When the data to be sent is not part of the data type history, is non-urgent, and contains a virus, the data to be sent is transmitted through the sixth path.

[0100] Specifically, the demonstration terminal system of this application achieves this by continuously verifying the data information flowing through each terminal. In emergency situations, it allows terminals to receive and process data that may contain viruses or actually contains viruses. For example, in a hospital data system, some data is highly urgent, such as medical records of emergency patients (similar issues exist in the display field, such as emergency evacuation display content). If a traditional network deployment scheme is followed, the information is uniformly verified for viruses by three levels of terminals before being transferred to the first-level terminal in the emergency room, which will result in a significant time delay. However, if the data is directly transmitted to the first-level terminal, if the data contains viruses, it cannot prevent the infected first-level terminal from infecting other terminals. If the data does not contain viruses, it can be confirmed that the first-level terminal cannot perform relevant detection. This solution is based on the last gateway configured before each terminal. It can record and save information sent by the terminal in a targeted manner. At the same time, when the terminal transmits data to other terminals, it can directly use the automatically formed optimized judgment strategy to achieve information security while considering the urgency of the information. It allows some data to run on the receiving end with viruses. While preventing the terminal from infecting other devices, the receiving end can still perform basic functions to ensure the timeliness and effectiveness of data transmission.

[0101] Preferably, when the IP-free firewall unit 110 determines that the sent and / or received data is high-risk data, the IP-free firewall unit 110 rejects the main data in the data from passing through, but allows the display terminal 100 that the IP-free firewall unit 110 intervenes in to generate a feedback instruction, which is returned to the sending end, and the sending end sends the data to the area control terminal 200 for review.

[0102] In the event of a potentially high-risk information transmission, the IP-free firewall unit 110 in front of the terminal rejects the main data but uses a data flow marker to enable the terminal to process and generate a feedback instruction. This instruction is sent to the sending terminal, and after processing by the IP-free firewall unit 110 of the sending terminal, the sending terminal is controlled to send the data to another zone control terminal 200. The zone control terminal 200 is a terminal with a higher level of network security. This terminal has relatively independent network protection, can receive some data containing viruses, and if it is infected with a virus or attacked, it will not affect the normal operation of other front-end devices. The zone control terminal 200 can perform more detailed review.

[0103] Example 3

[0104] This embodiment is an improvement and supplement to Embodiments 1 and 2, and repeated content will not be repeated.

[0105] Currently, a large number of display devices of various forms and functions can be found within a single area. The demonstration terminal system of this application can be directly added to the aforementioned fully functional and networked systems without altering their original network structure. At the same time, it can provide a certain level of security protection for the display terminal 100 by connecting the IP-free firewall unit 110 in series with the data access point of the existing display terminal 100. Furthermore, it can determine whether demonstration data containing viruses can be demonstrated and played on a certain display terminal 100 based on the urgency of the demonstration data.

[0106] Preferably, the demonstration terminal system of this application is at least able to determine the transmission path of the transmitted data based on the data type history of the verified transmitted data and the data emergency tag.

[0107] Preferably, data can be categorized into six types based on whether it belongs to the historical data type, whether it is urgent, and whether it contains viruses. Specifically, the historical data type refers to the type of historical data that has been verified as virus-free by the central control terminal 300 and / or the district control terminal 200. Therefore, when the data to be sent belongs to the historical data type, the IP-free firewall unit assumes that the data does not carry viruses.

[0108] Preferably, the first data type is data that belongs to the data type history and is urgent; the second data type is data that belongs to the data type history and is not urgent; the third data type is data that does not belong to the data type history, is not urgent, and is virus-free; the fourth data type is data that does not belong to the data type history, is not urgent, and contains viruses; the fifth data type is data that does not belong to the data type history, is not urgent, and is virus-free; and the sixth data type is data that does not belong to the data type history, is not urgent, and contains viruses.

[0109] Preferably, whether the data is urgent or not is determined by the user when the data is entered into the system. When the data enters the system, it will first pass through the IP-free firewall unit 110 or the central control terminal 300. At this time, the IP-free firewall unit 110 or the central control terminal 300 will label the data as urgent or non-urgent according to the user's selection.

[0110] Preferably, the presence of a virus in the data is determined by the district control terminal 200 and / or the central control terminal 300 after verification. For the IP-free firewall unit 110, it only verifies whether the data belongs to the data type history and whether it is urgent.

[0111] For example, in crowded shopping malls or train stations, in situations where a natural disaster such as an earthquake or a man-made disaster such as a fire is imminent, it is necessary to urgently transmit information about the impending earthquake or fire to the crowd through a display screen (i.e., display terminal 100) and show them escape routes. In such cases, the aforementioned demonstration information is marked as emergency data when it is input into the system. Furthermore, due to the need for fire drills and other operations, for the display terminal 100 in the shopping mall where this system is installed, this alarm information belongs to the data type history, that is, the disaster alarm information belongs to the first data type. At this time, when it is necessary to transmit the disaster alarm information to the display terminal 100 for timely display, the information can be directly transmitted from the sending end to the receiving end along the first path, and the disaster alarm information can be displayed in a timely manner.

[0112] Similarly, consider disaster alarm information. Suppose the original device sending the alarm has a faulty component, causing the alarm content to be altered to some extent. When this alarm is transmitted to a display terminal 100, it could lead to data theft or overload. In this case, because the alarm has been altered, it no longer belongs to the data type history. Furthermore, due to its potential for data theft and overload attacks, it can essentially be considered virus-infected data. However, its urgency label still exists. Therefore, this disaster alarm information changes from a first data type to a fourth data type. When it is necessary to transmit the disaster alarm information to the display terminal 100 for timely display, the information can also reach the receiving end for display through the IP-free protection device. However, at this time, the IP-free firewall unit 110 will isolate the data of the receiving end display terminal 100 because it verifies that the information does not belong to the data type history. That is, it can only receive the data but cannot transmit the data. The information is backed up to the area control terminal 200. After the area control terminal 200 performs security detection on the data, it finds that the information does indeed contain a virus. Therefore, it keeps the data of the display terminal 100 isolated and reports the situation to the central control terminal 300 for processing, that is, the information is transmitted and processed according to the fourth path.

[0113] For example, in a hospital setting, there are display devices such as queuing screens, medical record printers, and self-service terminals. When a patient visits the hospital for the first time, they need to create their own medical record data. When this medical record is created through a self-service terminal and transmitted to other service terminals or a doctor's computer, because the patient is visiting the hospital for the first time, this medical record information is not considered part of the data type history. However, this medical record information is not inherently virus-free, and since seeking medical treatment is an emergency, this medical record information is considered a third data type. When this medical record information is transmitted from the self-service terminal to the doctor's computer... When a patient is diagnosed with COVID-19, the information is transmitted via a third path, originating from the self-service terminal. The IP-free firewall unit 110 on the doctor's computer detects that the information does not belong to the historical data type. However, due to the urgency of the information, the IP-free firewall unit 110 still allows the information to pass through, but implements data isolation for the information. The data can still be displayed on the doctor's computer in a timely manner. While isolating the data, the IP-free firewall unit 110 transmits the data to the area control terminal 200 for verification. After verification, if the information is confirmed to be safe, the data isolation for the patient information on the doctor's computer is lifted, and the information is added to the data type history.

[0114] Similarly, regarding patient medical records, suppose a patient creates medical records and later needs to modify them. The patient goes to the self-service terminal to do so. Since the self-service terminal cannot store too much information, it essentially retrieves the patient's medical records from the server again. This time, because the medical records have been added to the data type history and have an emergency tag, the server should transmit the current medical records, which are the first data type, to the self-service terminal via the first path. That is, the server, as the sender, directly sends the medical records to the self-service terminal, which is the receiver.

[0115] For example, in advertising displays on commercial streets, there are often cases where the same advertisement is displayed multiple times. As for the advertisement itself, it is non-urgent data. In the case of multiple displays of the same advertisement, the advertisement information belongs to the data type history. Therefore, the data belongs to the second data type. Each time the advertisement is displayed, it is transmitted from the sending end to the display terminal 100 that plays the advertisement according to the second path. Specifically, it is first sent from the sending end to the IP-free firewall unit 110 at the receiving end. The IP-free firewall unit 110 finds that the information is a historical data type, but the data is not urgent. Therefore, after performing a simple security check, it is sent to the display terminal 100 for verification.

[0116] Similarly, when a new advertisement needs to be displayed on an advertising screen in a commercial street, since the advertisement is being received by the display terminal 100 for the first time, the advertisement information does not belong to the data type history. First, assuming that the advertisement information is safe and harmless and does not contain any illegal content, the advertisement information belongs to the fifth data type. When it is transmitted from the sending end to the display terminal 100, it should be transmitted according to the fifth path. Specifically, when the sending end sends the advertisement information to the display terminal 100, the IP-free firewall unit 110 at the display terminal 100 checks the data and finds that the advertisement information does not belong to the data type history and that the information is non-urgent data. Therefore, the advertisement information is transmitted to the area control terminal 200 for inspection. After inspection, the area control terminal 200 finds that the information is safe and harmless, adds the information to the data type history, and returns it to the receiving display terminal 100.

[0117] Suppose a new advertisement containing a virus needs to be displayed on an advertising screen. Since the advertisement itself contains a virus, the advertisement information belongs to the sixth data type. In this application's system, its transmission path is the sixth path. Specifically, the sending end sends the advertisement information to the receiving end, where a firewall unit 110 without IP addresses receives it. After verification, the firewall unit 110 finds that the advertisement information does not belong to the data type history and that the information is non-urgent data. Therefore, the firewall unit 110 sends the information to the area control terminal 200 for verification. After verification, the area control terminal 200 finds that the information does indeed contain a virus or inappropriate content. The area control terminal 200 then reports this situation to the central control terminal 300, which handles the situation, including disinfection or direct disposal.

[0118] By employing the above methods, different transmission paths are selected for data information with different attributes in different scenarios. This ensures that urgent data is delivered to the corresponding display terminal 100 for display in a timely manner, while also fully guaranteeing the security of display terminals 100 in the system that do not have network security capabilities. In numerous application scenarios, this not only ensures the smooth operation of work but also reduces the risk of network attacks.

[0119] It should be noted that the specific embodiments described above are exemplary, and those skilled in the art can devise various solutions inspired by the disclosure of this invention. These solutions all fall within the scope of this invention and its protection. Those skilled in the art should understand that this specification and its accompanying drawings are illustrative and not intended to limit the scope of the claims. The scope of protection of this invention is defined by the claims and their equivalents.

Claims

1. A demonstration terminal system based on policy verification, comprising: Display terminal (100) that is unable to configure internal security procedures. A zone control terminal (200) capable of configuring internal security procedures. A central control terminal (300) capable of security management of all display terminals (100) and zone control terminals (200); characterized in that, Each of the display terminals (100) and the area control terminal (200) has its data access point connected to a no-IP firewall unit (110). The no-IP firewall unit (110) verifies the data of the terminal based on a preset policy. Whether the data contains a virus is determined by the area control terminal (200) and / or the central control terminal (300) after inspection. The IP-free firewall unit (110) only checks whether the data belongs to the data type history and whether it is urgent. The data type history refers to the type of historical data that has been verified as virus-free by the central control terminal (300) and / or the district control terminal (200). The IP-free firewall unit (110) determines whether the currently passing data belongs to the data type history by recording and comparing the packet header information and the data content. When the display terminal (100) transmits data to another display terminal (100), the IP-free firewall unit (110) performs verification based on its own recorded data type history and data emergency tags, and determines the transmission path of the data to the receiving display terminal (100), the transmission path changing in a manner associated with the verification result; When the display terminal (100) acts as a transmitter, the IP-free firewall unit (110) connected to the front end of its data access point is the first IP-free firewall unit; when the display terminal (100) acts as a receiver, the IP-free firewall unit (110) connected to the front end of its data access point is the second IP-free firewall unit. The first IP-free firewall unit dynamically adjusts the detection allocation rules based on its own recorded data type history and the data type to be sent by the display terminal (100) it accesses, thereby determining the transmission path of the data to be sent; If the first IP-free firewall unit determines that the data type to be sent does not belong to its own recorded data type history, the first IP-free firewall unit adds an extra mark to the data to be sent and further verifies the urgency of the data to be sent. The first IP-free firewall unit handles the urgency of pending data with additional tags as follows: If it is urgent data, the first IP-free firewall unit directly sends the data to the receiving end. After the receiving end receives the data, the second IP-free firewall unit isolates the data and backs up the received data to the area control terminal (200). If the data is not urgent, the first IP-free firewall unit will send the data to the area control terminal (200) first, and then send it to the receiving end after it is detected by the area control terminal (200); The zone control terminal (200) detects the data to be detected based on a protection network with a higher security level than the display terminal (100). The detection and processing method for urgent data to be detected is as follows: If the emergency data to be detected contains a virus, the area control terminal (200) controls the second IP-free firewall unit of the receiving end to continue to maintain data isolation and sends an alarm message to the central control terminal (300); If the emergency data to be detected does not contain a virus, the area control terminal (200) controls the second IP-free firewall unit of the receiving end to release the data isolation.

2. The demonstration terminal system based on policy verification according to claim 1, characterized in that, The IP-free firewall unit (110) determines its own information transmission and reception permission range based on the terminals it accesses. The IP-free firewall unit (110) can distinguish the terminal type corresponding to the source data and reject some data transmissions that do not belong to the reception permission range.

3. The demonstration terminal system based on policy verification according to claim 1, characterized in that, If the first IP-free firewall unit determines that the data type to be sent belongs to its own recorded data type history, the first IP-free firewall unit further verifies the urgency of the data to be sent.

4. The demonstration terminal system based on policy verification according to claim 1, characterized in that, The first IP-free firewall unit handles the urgency of data to be sent without additional tags as follows: If the data is urgent, the first IP-free firewall unit will directly send the data to the receiving end; If the data is not urgent, the first IP-free firewall unit will send the data to the second IP-free firewall unit for inspection, and only after passing the inspection will it be transmitted to the receiving end.

5. The demonstration terminal system based on policy verification according to claim 1, characterized in that, The detection and processing method of the area control terminal (200) for non-urgent data to be detected is as follows: If the non-urgent data to be detected contains a virus, the area control terminal (200) sends an alarm message to the central control terminal (300); If the non-urgent data to be detected does not contain a virus, the area control terminal (200) sends the data to the receiving end.

6. The demonstration terminal system based on policy verification according to claim 1, characterized in that, If the data sent and / or received is determined to be high-risk data, the IP-free firewall unit (110) will refuse the main data in the data to pass through, but will allow the display terminal (100) connected to the IP-free firewall unit (110) to generate a feedback instruction, which will be returned to the sending end, and the sending end will send the data to the area control terminal (200) for review.

Images