Methods, systems, equipment, and media for testing network gateway data isolation switching channels.

Abstract

This application discloses a method, system, device, and medium for detecting data isolation switching channels in network gateways (WANs). It primarily relates to the field of WAN switching channel detection technology, addressing the current problems of lacking a unified channel validity detection mechanism for WAN devices, the inability of WAN device proprietary protocol fault detection mechanisms to extend the detection starting point, and the absence of channel-level detection based on WAN application layer protocol data. The method includes: setting a BFD protocol to bind an application layer protocol channel as a BFD extended protocol field; adding a BFD extended protocol field to the BFD standard protocol data; transmitting BFD standard protocol data to the WAN receiving host based on the application layer protocol channel bound to the BFD protocol in the BFD extended protocol field; setting or migrating the BFD state of the WAN receiving host based on the BFD standard protocol data; and determining the validity of the application layer protocol channel based on the BFD state of the WAN receiving host.

Description

Technical Field

[0001] This application relates to the field of network gateway switching channel detection technology, and in particular to a method, system, equipment and medium for detecting network gateway data isolation switching channels. Background Technology

[0002] A network gateway is an information security device that uses a solid-state switch read / write medium with multiple control functions to connect two independent host systems. Because the two independent host systems are isolated by the gateway, there is no physical connection, logical connection, or information transmission protocol between the systems. There is no protocol-based information exchange; only protocol-free data file transfer occurs. Therefore, the gateway physically isolates and blocks all network connections that could potentially attack the internal network, preventing external attackers from directly intruding, attacking, or damaging the internal network, thus ensuring the security of the internal hosts. In existing technologies, fault detection in gateway devices is based on vendor-proprietary heartbeat detection mechanisms to check the effectiveness of the data isolation exchange channel between the sending and receiving host systems of the gateway.

[0003] However, current network isolation devices lack a unified channel validity detection mechanism; they are all implemented using proprietary methods by individual device manufacturers, lacking universality. Furthermore, the fault detection mechanisms of these proprietary protocols cannot extend the detection starting point; they are limited to the network isolation device itself and lack scalability. Currently, detection is based on the host-level channels of the network isolation's sending and receiving ends, without detection based on the application layer protocol data channel level.

[0004] Therefore, there is an urgent need for a method, system, equipment, and medium for detecting network gateway data isolation and exchange channels to solve the above problems. Summary of the Invention

[0005] To address the aforementioned shortcomings of existing technologies, this application provides a method, system, device, and medium for detecting data isolation and exchange channels of network gateways. This addresses the problems of current network gateway devices lacking a unified channel validity detection mechanism, lacking universality, having fault detection mechanisms based on proprietary protocols that cannot extend the detection starting point, lacking scalability, and currently relying on host-level channel detection at the sending and receiving ends of the network gateway, without addressing the issues of application-layer protocol-level data channel detection.

[0006] Firstly, this application provides a method for detecting the data isolation switching channel of a network gateway. The method includes: enabling the BFD detection function of the network gateway sending host and the network gateway receiving host based on the BFD protocol; setting the BFD protocol to bind an application layer protocol channel as a BFD extension protocol field; determining the BFD standard protocol data corresponding to the trigger command when the network gateway sending host receives a trigger command; adding a BFD extension protocol field to the BFD standard protocol data; transmitting the BFD standard protocol data to the network gateway receiving host based on the application layer protocol channel bound to the BFD protocol in the BFD extension protocol field; setting or migrating the BFD state of the network gateway receiving host based on the BFD standard protocol data; and determining the validity of the application layer protocol channel based on the BFD state of the network gateway receiving host.

[0007] Furthermore, the trigger command is divided into external BFD protocol data packets and internal trigger commands. When the network gateway sending host receives the trigger command, it determines the BFD standard protocol data corresponding to the trigger command. Specifically, when receiving an external BFD protocol data packet, it determines that the BFD standard protocol data in the external BFD protocol data packet is the BFD standard protocol data corresponding to the trigger command. When triggering an internal trigger command, it obtains the BFD standard protocol data corresponding to the internal trigger command.

[0008] Furthermore, the BFD extended protocol fields specifically include: the Extend Type field, which indicates the preset additional extended type, and defines Extend Type as 7 for transmission through the application layer protocol channel bound by the BFD protocol; the ExtendType Discriminator field, which marks the channel number of the application layer protocol channel bound by the BFD protocol; and Reserved, which is set to 0 when sending and ignored when receiving.

[0009] Furthermore, after transmitting the BFD standard protocol data to the gateway receiving host based on the application layer protocol channel bound to the BFD protocol in the BFD extension protocol field, the method further includes: the gateway receiving host returning the BFD standard protocol data to the gateway sending host according to the channel number in the BFD extension protocol field.

[0010] Secondly, this application provides a system for detecting the data isolation exchange channel of a network gateway. The system includes: a binding module, used to enable the BFD detection function of the network gateway sending host and the network gateway receiving host based on the BFD protocol; setting the BFD protocol to bind an application layer protocol channel as a BFD extension protocol field; a sending-end transmission module, used to determine the BFD standard protocol data corresponding to the trigger command when the network gateway sending host receives a trigger command; adding a BFD extension protocol field to the BFD standard protocol data; transmitting the BFD standard protocol data to the network gateway receiving host based on the application layer protocol channel bound to the BFD protocol in the BFD extension protocol field; and a receiving-end transmission module, used to set or migrate the BFD state of the network gateway receiving host based on the BFD standard protocol data; and determining the validity of the application layer protocol channel according to the BFD state of the network gateway receiving host.

[0011] Thirdly, this application provides an apparatus for detecting a network gateway data isolation switching channel. The apparatus includes: a processor; and a memory storing executable code thereon. When the executable code is executed, the processor performs a method for detecting a network gateway data isolation switching channel as described above.

[0012] Fourthly, this application provides a non-volatile computer storage medium storing computer instructions thereon, which, when executed, implement a method for detecting a network gateway data isolation exchange channel as described above.

[0013] Those skilled in the art will understand that this application has at least the following beneficial effects:

[0014] This application sets up a BFD protocol binding application layer protocol channel on the sending host and receiving host of the network gateway; subsequently, data is transmitted through the application layer protocol channel, realizing detection at the application layer protocol data channel level of the network gateway.

[0015] Furthermore, existing network gateways lack BFD protocol interoperability with other network devices. This application addresses this by converting standard BFD protocol data into BFD extended protocol data in the network gateway's transmission data block format. This extended protocol data is then transmitted via the application layer protocol channel corresponding to the BFD protocol to the network gateway's receiving host, enabling BFD protocol interoperability between the network gateway and other network devices. This allows for fault detection in network scenarios where BFD protocol can penetrate the network gateway. Moreover, this application utilizes the universal BFD protocol, solving the problem of current network gateway devices lacking a unified channel validity detection mechanism and thus lacking universality.

[0016] Furthermore, the trigger command received by the network gateway sending host of this application can be either an external command or an internal command. This application can convert the BFD standard protocol data corresponding to the external command into BFD extended protocol data for detection, thereby realizing the extension of the detection start point and improving scalability. Attached Figure Description

[0017] The following description refers to some embodiments of this disclosure, in which:

[0018] Figure 1 This is a flowchart of a method for detecting a network gateway data isolation and exchange channel provided in an embodiment of this application.

[0019] Figure 2 This is an example diagram of setting up an application layer protocol channel for BFD protocol binding, provided in an embodiment of this application.

[0020] Figure 3 This is an example diagram showing the addition of BFD extended protocol fields to BFD standard protocol data, as provided in an embodiment of this application.

[0021] Figure 4 This is a schematic diagram of the internal structure of a system for detecting a network gateway data isolation and exchange channel, provided in an embodiment of this application.

[0022] Figure 5 This is a schematic diagram of the internal structure of a device for detecting the data isolation and exchange channel of a network gateway, provided in an embodiment of this application. Detailed Implementation

[0023] Those skilled in the art should understand that the embodiments described below are merely preferred embodiments of this disclosure and do not imply that this disclosure can only be implemented through these preferred embodiments. These preferred embodiments are merely used to explain the technical principles of this disclosure and are not intended to limit the scope of protection of this disclosure. Based on the preferred embodiments provided by this disclosure, all other embodiments obtained by those skilled in the art without creative effort should still fall within the scope of protection of this disclosure.

[0024] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0025] The technical solutions proposed in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0026] This application provides a method for detecting a network gateway's data isolation and exchange channel, such as... Figure 1 As shown in the embodiments of this application, the method mainly includes the following steps:

[0027] Step 110: Based on the BFD protocol, enable the BFD detection function of the network gateway sending host and the network gateway receiving host; set the BFD protocol to bind the application layer protocol channel and use it as a BFD extended protocol field.

[0028] It should be noted that the sending host of the network gateway is the sending host system of the network gateway, which supports the BFD (Bidirectional Forwarding Detection) protocol and can be any feasible server that supports the BFD protocol. Similarly, the receiving host of the network gateway is the same.

[0029] As an example, such as Figure 2 As shown, setting the BFD protocol to bind the application layer protocol channel can be specifically done as follows:

[0030] The binding between the BFD protocol and the application layer protocol channel is achieved by using "BFD 'protocol name' bind http sub-discriminator 'application layer protocol channel number'". For example, Figure 2 The protocol name is 123, bind, http, sub-discriminator, and the application layer protocol channel number is 100. It should be noted that the protocol name and application layer protocol channel number can be determined by those skilled in the art based on the actual situation, and this application does not impose any restrictions on them.

[0031] Step 120: When the network gateway sending host receives the trigger command, determine the BFD standard protocol data corresponding to the trigger command; add a BFD extended protocol field to the BFD standard protocol data; and transmit the BFD standard protocol data to the network gateway receiving host based on the application layer protocol channel bound to the BFD protocol in the BFD extended protocol field.

[0032] It should be noted that triggering instructions are divided into external BFD protocol data packets and internal triggering instructions. Both external BFD protocol data packets and internal triggering instructions are BFD standard protocol data. BFD standard protocol data refers to the standard data corresponding to the BFD protocol. External BFD protocol data packets are instructions sent from other hosts connected to the gateway's sending host to the gateway's sending host; internal triggering instructions are instructions triggered after the BFD detection function of both the gateway's sending and receiving hosts is enabled. The specific triggering time can be cyclical, such as once every 100ms, and can be determined by those skilled in the art based on actual conditions. The gateway transmits data blocks in a format supported by the application layer protocol channel. This is achieved by adding BFD extended protocol fields (such as...) to the BFD standard protocol data. Figure 3 As shown in the figure, it realizes the transmission of BFD protocol through the application layer protocol channel.

[0033] like Figure 3 It should be noted that 7 is the Extend Type field, used to indicate a preset additional extension type. The last line is the BFD extension protocol field, and the rest is existing BFD standard protocol data, which is prior art and will not be described in detail here.

[0034] The last line is the BFD extension protocol field, which is explained as follows:

[0035] The Extend Type field indicates a preset additional extension type, and defines Extend Type as 7 for transmission via the application layer protocol channel bound to the BFD protocol; the Extend Type Discriminator field marks the channel number of the application layer protocol channel bound to the BFD protocol; Reserved is set to 0 when sending and ignored when receiving.

[0036] When the network gateway sending host receives the trigger command, it determines the BFD standard protocol data corresponding to the trigger command, which can be:

[0037] When an external BFD protocol data packet is received, the BFD standard protocol data in the external BFD protocol data packet is determined to be the BFD standard protocol data corresponding to the trigger instruction; when an internal trigger instruction is triggered, the BFD standard protocol data corresponding to the internal trigger instruction is obtained.

[0038] Step 130: Based on BFD standard protocol data, set or migrate the BFD state of the network gateway receiver host; determine the validity of the application layer protocol channel based on the BFD state of the network gateway receiver host.

[0039] It should be noted that the method for setting or migrating the BFD state of the network gateway receiver host based on BFD standard protocol data can be implemented by existing technology, and this application does not limit it.

[0040] Specifically, the validity of the application layer protocol channel is determined based on the BFD state of the network gateway receiver host. This is achieved by the network gateway receiver host switching the BFD state according to the existing BFD state switching mechanism when it receives BFD standard protocol data. Upon detecting that the network gateway receiver host has received BFD standard protocol data, the BFD state is determined according to the BFD protocol state mechanism, thereby determining the validity of the application layer protocol channel.

[0041] Furthermore, after transmitting BFD standard protocol data to the network gateway receiving host via the application layer protocol channel bound to the BFD protocol in the BFD extended protocol field, the method may also include:

[0042] The receiving host of the network gateway returns BFD standard protocol data to the sending host of the network gateway based on the channel number in the BFD extended protocol field.

[0043] besides, Figure 4 This application provides a system for detecting the data isolation and exchange channel of a network gateway. For example... Figure 4 As shown in the embodiments of this application, the system mainly includes:

[0044] Binding module 210 is used to enable BFD detection function of the network gateway sending host and network gateway receiving host based on the BFD protocol; set the BFD protocol binding application layer protocol channel and use it as a BFD extended protocol field.

[0045] It should be noted that the binding module 210 can be any feasible device or apparatus capable of enabling BFD detection functions of the gateway sending host and the gateway receiving host based on the BFD protocol; setting the BFD protocol binding application layer protocol channel and enabling the BFD detection functions of the gateway sending host and the gateway receiving host based on the BFD protocol as a BFD extended protocol field; and setting the application layer protocol channel bound to the BFD protocol.

[0046] The transmitting module 220 is used to determine the BFD standard protocol data corresponding to the trigger command when the transmitting host of the network gateway receives the trigger command; add a BFD extended protocol field to the BFD standard protocol data; and transmit the BFD standard protocol data to the receiving host of the network gateway based on the application layer protocol channel bound to the BFD protocol in the BFD extended protocol field.

[0047] It should be noted that the transmitting module 220 can be any feasible device or apparatus that, when the network gateway transmitting host receives the trigger command, determines the BFD standard protocol data corresponding to the trigger command; adds a BFD extended protocol field to the BFD standard protocol data; and transmits the BFD standard protocol data to the network gateway receiving host based on the application layer protocol channel bound to the BFD protocol in the BFD extended protocol field.

[0048] The receiving end transmission module 230 is used to set or migrate the BFD state of the network gateway receiving end host based on BFD standard protocol data; and to determine the validity of the application layer protocol channel based on the BFD state of the network gateway receiving end host.

[0049] It should be noted that the receiving end transmission module 230 can be any feasible device or apparatus capable of setting or migrating the BFD state of the network gateway receiving end host based on BFD standard protocol data, and determining the validity of the application layer protocol channel based on the BFD state of the network gateway receiving end host.

[0050] The above are method embodiments of this application. Based on the same inventive concept, embodiments of this application also provide a device for detecting network gateway data isolation exchange channels. Figure 5 As shown, the device includes: a processor; and a memory storing executable code thereon, which, when executed, causes the processor to perform a method for detecting a network gateway data isolation switching channel as described in the above embodiment.

[0051] Specifically, the server-side, based on the BFD protocol, enables BFD detection on both the sending and receiving hosts of the network gateway; it sets the BFD protocol to bind to an application layer protocol channel, which is then used as a BFD extension protocol field; when the sending host receives a trigger command, it determines the corresponding BFD standard protocol data; it adds a BFD extension protocol field to the BFD standard protocol data; based on the application layer protocol channel bound to the BFD protocol in the BFD extension protocol field, it transmits the BFD standard protocol data to the receiving host; based on the BFD standard protocol data, it sets or migrates the BFD state of the receiving host; and based on the BFD state of the receiving host, it determines the validity of the application layer protocol channel.

[0052] In addition, this application embodiment also provides a non-volatile computer storage medium storing executable instructions, which, when executed, implement the method described above for detecting a network gateway data isolation exchange channel.

[0053] The technical solutions of this disclosure have been described in conjunction with the preceding embodiments. However, it will be readily understood by those skilled in the art that the scope of protection of this disclosure is not limited to these specific embodiments. Without departing from the technical principles of this disclosure, those skilled in the art can disassemble and combine the technical solutions in the above embodiments, and can also make equivalent changes or substitutions to the relevant technical features. Any changes, equivalent substitutions, improvements, etc., made within the technical concept and / or technical principles of this disclosure will fall within the scope of protection of this disclosure.

Claims

1. A method for detecting a network gateway data isolation switching channel, characterized in that, The method includes: Based on the BFD protocol, enable BFD detection function for both the sending and receiving hosts of the network gateway; set the BFD protocol to bind to the application layer protocol channel and use it as a BFD extended protocol field; When the network gateway sending host receives the trigger command, it determines the BFD standard protocol data corresponding to the trigger command; adds a BFD extended protocol field to the BFD standard protocol data; and transmits the BFD standard protocol data to the network gateway receiving host based on the application layer protocol channel bound to the BFD protocol in the BFD extended protocol field. Based on BFD standard protocol data, the BFD state of the network gateway receiver host is set or migrated; based on the BFD state of the network gateway receiver host, the validity of the application layer protocol channel is determined. BFD extended protocol fields, specifically including: The Extend Type field is used to indicate the preset additional extension type, and it is defined that an Extend Type value of 7 indicates transmission through the application layer protocol channel bound by the BFD protocol. The Extend Type Discriminator field is used to identify the channel number of the application layer protocol channel bound to the BFD protocol; Reserved, set to 0 when sending, and ignored when receiving; After transmitting BFD standard protocol data to the network gateway receiving host via the application layer protocol channel bound to the BFD protocol in the BFD extended protocol field, the method further includes: The receiving host of the network gateway returns BFD standard protocol data to the sending host of the network gateway based on the channel number in the BFD extended protocol field.

2. The method for detecting the data isolation and exchange channel of a network gateway according to claim 1, characterized in that, Trigger commands are divided into external BFD protocol data packets and internal trigger commands; When the network gateway sending host receives the trigger command, it determines the BFD standard protocol data corresponding to the trigger command, specifically including: Upon receiving an external BFD protocol data packet, determine that the BFD standard protocol data in the external BFD protocol data packet is the BFD standard protocol data corresponding to the trigger command; When an internal trigger command is triggered, the BFD standard protocol data corresponding to the internal trigger command is obtained.

3. A system for detecting data isolation switching channels of a network gateway, characterized in that, The system includes: The binding module is used to enable BFD detection functions for both the sending and receiving hosts of the network gateway based on the BFD protocol; it sets the BFD protocol binding to the application layer protocol channel and uses it as a BFD extended protocol field. The transmitting module is used to determine the BFD standard protocol data corresponding to the trigger command when the transmitting host of the network gateway receives the trigger command; add a BFD extended protocol field to the BFD standard protocol data; and transmit the BFD standard protocol data to the receiving host of the network gateway based on the application layer protocol channel bound to the BFD protocol in the BFD extended protocol field. The receiving end transmission module is used to set or migrate the BFD state of the network gateway receiving end host based on BFD standard protocol data; and to determine the validity of the application layer protocol channel based on the BFD state of the network gateway receiving end host. BFD extended protocol fields, specifically including: The Extend Type field is used to indicate the preset additional extension type, and it is defined that an Extend Type value of 7 indicates transmission through the application layer protocol channel bound by the BFD protocol. The Extend Type Discriminator field is used to identify the channel number of the application layer protocol channel bound to the BFD protocol; Reserved, set to 0 when sending, and ignored when receiving; After transmitting the BFD standard protocol data to the receiving host of the network gateway via the application layer protocol channel bound to the BFD protocol in the BFD extended protocol field, it also includes: The receiving host of the network gateway returns BFD standard protocol data to the sending host of the network gateway based on the channel number in the BFD extended protocol field.

4. A device for detecting the data isolation and switching channel of a network gateway, characterized in that, The device includes: processor; And a memory having executable code stored thereon, which, when executed, causes the processor to perform a method for detecting a network gateway data isolation switching channel as described in any one of claims 1-2.

5. A non-volatile computer storage medium, characterized in that, It stores computer instructions, which, when executed, implement a method for detecting a network gateway data isolation exchange channel as described in any one of claims 1-2.

Images