A method and system for secure isolation and information exchange

Abstract

The present application relates to a method and system for secure isolation and information exchange, which belongs to the field of network security technology. The method includes: receiving an interaction request sent by a source terminal device, the source terminal device and the destination terminal device are located in different local area networks; judging whether the interaction request contains an identifier, the identifier indicates that the source terminal device has interacted with the same destination terminal device for the same data; if so, updating the terminal device number in the access control list and outputting a trigger instruction, the access control list stores multiple terminal devices and the corresponding numbers of each terminal device; if not, outputting a verification instruction; receiving the authentication number returned by the destination terminal device after receiving the trigger instruction or the verification instruction; when the authentication number is the same as the standard number, establishing a communication link between the source terminal device and the destination terminal device. The present application has the effect of improving the security of multiple local area networks when conducting cross-network communication.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a method and system for security isolation and information exchange. Background Art

[0002] At present, multiple terminal devices in a single local area network can confirm the identity of the source terminal device and the destination terminal device based on the internal access control algorithm, thereby achieving secure communication. However, when multiple local area networks are connected across networks, the commonly used communication method is to configure an access control list for each local area network, and the access control list is used to limit the source terminal devices that access it. Therefore, when a source terminal device in a local area network sends interactive information to multiple local area networks at the same time, each local area network that receives the interactive information of the source terminal device needs to verify the authority of the source terminal device. The verification process is complicated and the interaction efficiency is low, which limits the number of local area networks that can achieve cross-network interaction and makes cross-network interaction between multiple local area networks difficult.

[0003] Of course, there is also a communication method for direct information exchange between multiple local area networks, that is, when a source terminal device in one of the local area networks has a need for cross-network communication, the source terminal device sends the interactive information to the local area network where the destination terminal device is located, and it is received by multiple terminal devices in the local area network where the destination terminal device is located. If there are dangerous terminal devices in the local area network, the interactive information sent by the source terminal device may be leaked, and even the dangerous terminal device may attack the local area network where the source terminal device is located through the source terminal device, causing sensitive information leakage.

[0004] Therefore, how to improve the secure cross-network interaction of multiple local area networks has become a hot topic in current research. Summary of the invention

[0005] In order to solve the problem of low security when information is exchanged between multiple local area networks, the present application provides a security isolation and information exchange method and system.

[0006] In a first aspect of the present application, a method for security isolation and information exchange is provided. The method comprises:

[0007] Receiving an interaction request sent by a source terminal device, the interaction request being used to request information interaction with a destination terminal device, the source terminal device and the destination terminal device being located in different local area networks;

[0008] Determining whether the interaction request includes an identifier, wherein the identifier indicates that the source terminal device has interacted with the same destination terminal device for the same data;

[0009] If yes, then update the terminal device number in the access control list and output a trigger instruction, wherein the access control list stores a plurality of terminal devices and a number corresponding to each terminal device;

[0010] If not, output the verification instruction;

[0011] Receiving the authentication number returned by the destination terminal device after receiving the trigger instruction or the verification instruction;

[0012] When the authentication number is the same as the standard number, a communication link is established between the source terminal device and the destination terminal device. The standard number is an encrypted number corresponding to the destination terminal device in the access control list. The source terminal device and the destination terminal device exchange information through the communication link.

[0013] By adopting the above technical solution, after receiving the interaction request sent by the source terminal device, it is determined whether the interaction request contains an identifier. When the result of the determination is that the interaction request contains an identifier, it means that the source terminal device has interacted with the same destination terminal device for the same data. In order to prevent the intruding terminal device from cracking the number used to verify the identity of the source terminal device and the destination terminal device during the interaction process, the number of the terminal device in the access control list is updated at this time, and then a trigger instruction is output to trigger the destination terminal device to synchronously update its corresponding number; when the result of the determination is that the interaction request does not contain an identifier, it means that the source terminal device is communicating with the destination terminal device for the first time or the interactive information is used for the first time, and a verification instruction is output at this time. Whether the destination terminal device receives a trigger instruction or a verification instruction, it will return an authentication number used to verify its own identity. This application determines whether to establish a communication link between the source terminal device and the destination terminal device based on the authentication number and the standard number obtained after encryption, that is, when the authentication number is the same as the standard number, a communication link is established, thereby achieving the purpose of securely isolating multiple local area networks that interact across networks, and improving the security of multiple local area networks when communicating across networks.

[0014] In a possible implementation, updating the terminal device number in the access control list includes selecting a random number, adding the initial number of the terminal device to the random number to obtain a secondary number, wherein the initial number refers to the number corresponding to the terminal device before updating the access control list.

[0015] In a possible implementation, the updating of the numbers of the terminal devices in the access control list includes:

[0016] Increasing the value added to the initial number of the terminal device in sequence according to the order in which the terminal device is located in the access control list, wherein the initial number refers to the number corresponding to the terminal device before the access control list is updated;

[0017] Add the initial number of the terminal device to the value to get the secondary number.

[0018] In one possible implementation, the updating of the terminal device number in the access control list includes: shifting the initial number corresponding to the terminal device clockwise or counterclockwise according to the order of the terminal device in the access control list to obtain a secondary number of the terminal device, wherein the initial number refers to the number corresponding to the terminal device before the access control list is updated.

[0019] By adopting the above technical solution, the present application provides three methods for updating the numbers of terminal devices in the access control list, so that an update method suitable for the interactive scenario can be selected from the three update methods; the update method used can also be periodically replaced to increase the difficulty for an intruding terminal device to crack the source of the terminal device's number, thereby providing technical support for improving the security of cross-network communications among multiple local area networks.

[0020] In a possible implementation manner: after the terminal device number in the access control list is updated, the method further includes: inputting the secondary number of the target terminal device into the encryption model to obtain a standard number.

[0021] In a possible implementation, the encryption process of the encryption model is:

[0022] Extracting the serial number of the source terminal device and the secondary serial number of the destination terminal device;

[0023] The standard number is obtained by adding the number of the source terminal device to the secondary number.

[0024] By adopting the above technical solution, the present application encrypts the secondary number of the target terminal device to obtain a standard number, so as to subsequently verify whether the identity of the target terminal device is safe through the standard number. This is because even if the invading terminal device replaces its own IP address with the IP address of the target terminal device, it also replaces its own MAC address with the MAC address of the target terminal device, thereby obtaining an opportunity to receive a trigger instruction or a verification instruction. However, the invading terminal device does not know the rule that the target terminal device needs to encrypt the secondary number before returning it, and it is even more difficult to know the production source of the secondary number. Therefore, either the invading terminal device does not return the authentication number, or the returned authentication number is inconsistent with the standard number, thereby locating the invading terminal device and stopping the establishment of a communication link between the source terminal device and the destination terminal device, thereby ensuring the security of multiple local area networks during cross-network communication.

[0025] In a possible implementation manner: the interaction request includes the number of the source terminal device and the number of the destination terminal device;

[0026] Before outputting the verification instruction, the method further includes:

[0027] Determine whether the interaction request is satisfied:

[0028] n>N∪p>P, where n is the number of destination terminal devices in the interaction request, N is the threshold value of the number of destination terminal devices, p is the ratio of the number of destination terminal devices in the local area network containing the largest number of destination terminal devices to the number of destination terminal devices in the interaction request, and P is the ratio threshold;

[0029] If yes, the verification instruction is outputted by broadcasting;

[0030] If not, the verification instruction is output in a unicast or multicast manner.

[0031] By adopting the above technical solution, when outputting the verification instruction, if the number of destination terminal devices in the interaction request exceeds the quantity threshold, in order to avoid too many destination terminal devices interacting with the source terminal device and causing data leakage, the verification instruction is output by broadcasting; or when the ratio of the number of destination terminal devices to the data of destination terminal devices in the interaction request in the local area network containing the most destination terminal devices exceeds the ratio threshold, in order to avoid the intrusion terminal device from cracking the interaction rules through multiple destination terminal devices in the same local area network, when the interaction request meets any of the above conditions, the verification instruction is output by broadcasting to verify whether the identities of all terminal devices in the local area network where the destination terminal device is located are safe, thereby ensuring the security of multiple local area networks when communicating across networks.

[0032] In a possible implementation, when the verification instruction is output in a broadcasting manner, when the authentication number is the same as the standard number, establishing a communication link between the source terminal device and the destination terminal device includes:

[0033] A verification code returned by the receiving terminal device after receiving the verification instruction, wherein the verification code is the sum of the terminal device number and the source terminal device number;

[0034] When the authentication number is the same as the standard number and the verification code is verified, a communication link between the source terminal device and the destination terminal device is established.

[0035] In a possible implementation, the format of the interaction request is A-B1, ..., B n , n≥1, where A represents the number of the source terminal device, and B1, ..., B n The ID of the destination terminal device.

[0036] In a second aspect of the present application, a security isolation and information exchange system is provided. The system comprises:

[0037] A first receiving module, configured to receive an interaction request sent by a source terminal device, wherein the interaction request is used to request information interaction with a destination terminal device, wherein the source terminal device and the destination terminal device are located in different local area networks;

[0038] A data determination module, used to determine whether the interaction request contains an identifier, wherein the identifier indicates that the source terminal device has interacted with the same destination terminal device for the same data;

[0039] A data output module, used to update the number of the terminal device in the access control list and output a trigger instruction when the interactive request contains an identifier, wherein the access control list stores a plurality of terminal devices and the number corresponding to each terminal device; and to output a verification instruction when the interactive request does not contain an identifier;

[0040] A second receiving module is used to receive the authentication number returned by the destination terminal device after receiving the trigger instruction or the verification instruction;

[0041] A data processing module is used to establish a communication link between the source terminal device and the destination terminal device when the authentication number is the same as the standard number, the standard number is the number obtained by encrypting the number corresponding to the destination terminal device in the access control list, and the source terminal device and the destination terminal device exchange information through the communication link.

[0042] In summary, the present application includes the following beneficial technical effects:

[0043] After receiving the interaction request sent by the source terminal device, it is determined whether the interaction request contains an identifier. When the result of the determination is that the interaction request contains an identifier, it indicates that the source terminal device has interacted with the same destination terminal device for the same data. In order to prevent the intruding terminal device from cracking the number used by the source terminal device and the destination terminal device to verify the identity during the interaction, the number of the terminal device in the access control list is updated at this time, and then a trigger instruction is output to trigger the destination terminal device to synchronously update its corresponding number; when the result of the determination is that the interaction request does not contain an identifier, it indicates that the source terminal device is communicating with the destination terminal device for the first time or the interactive information is used for the first time, and a verification instruction is output at this time. Whether the destination terminal device receives a trigger instruction or a verification instruction, it will return an authentication number used to verify its own identity. This application determines whether to establish a communication link between the source terminal device and the destination terminal device based on the authentication number and the standard number obtained after encryption, that is, when the authentication number is the same as the standard number, a communication link is established, thereby achieving the purpose of securely isolating multiple local area networks that interact across networks, and improving the security of multiple local area networks when communicating across networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a schematic diagram of an exemplary operating environment of an embodiment of the present application.

[0045] Figure 2 It is a flow chart of the security isolation and information exchange method of an embodiment of the present application.

[0046] Figure 3 It is a block diagram of a security isolation and information exchange system of an embodiment of the present application.

[0047] Explanation of the accompanying drawings: 10. Interaction center; 11. First receiving module; 12. Data judgment module; 13. Data output module; 14. Second receiving module; 15. Data processing module; 20. Local area network. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0049] Figure 1A schematic diagram of an exemplary operating environment in which the embodiments of the present application can be implemented is shown, and the operating environment includes an interaction center 10 and multiple local area networks 20. The interaction center 10 is arranged between the multiple local area networks 20 and is mainly used to implement secure cross-network communication between the multiple local area networks 20. The local area network 20 includes multiple terminal devices, wherein the terminal device used to initiate an interaction request is called a source terminal device, and the terminal device that is not in the same local area network 20 as the source terminal device and is used to receive data sent by the source terminal device is called a destination terminal device.

[0050] The interactive center 10 is composed of various types of gateways, such as network devices such as routers, firewalls, and switches, and the terminal devices in the local area network 20 can be one type of smart device, such as a mobile phone, a tablet, or a computer, or a combination of multiple types of smart devices such as mobile phones, tablets, and computers.

[0051] It should be noted that Figure 1 The operating environment shown is only illustrative and is not intended to limit the application or use of the embodiments of the present application. For example, the operating environment may include multiple interaction centers 10, and multiple local area networks 20 may achieve secure cross-network communication through different interaction centers 10.

[0052] Figure 2 A flow chart of a method for security isolation and information exchange according to an embodiment of the present application is shown, and the method is applied to the above-mentioned interactive center 10. Specifically, the main process of the method for security isolation and information exchange is described as follows.

[0053] Step S1: receiving an interaction request sent by a source terminal device.

[0054] The interaction request is a request instruction sent by the source terminal device for information interaction with the destination terminal device. The request instructions sent by different source terminal devices are different. In this example, each terminal device has a unique corresponding number. When the source terminal device needs to communicate with the destination terminal device across the network, the source terminal device needs to send its corresponding number and the corresponding number of the destination terminal device to the interaction center 10, that is, the interaction center 10 receives the interaction request.

[0055] Since the interaction request includes not only the number of the source terminal device but also the number of the destination terminal device, and the number of the destination terminal device may be more than one, in order to avoid the interaction center 10 confusing the number of the source terminal device with the number of the destination terminal device, the format of the interaction request is set to A-B1,…, B n , n≥1, where A represents the number of the source terminal device, and B1, ..., B n Both are the IDs of the destination terminal devices.

[0056] Step S2: Determine whether the interaction request contains an identifier.

[0057] In order to improve the security of the source terminal device during cross-network communication, when the source terminal device interacts with the same destination terminal device for the same data, the source terminal device will be configured with an identifier in the uploaded interaction request. The identifier can reflect the same number of interactions. For example, in A3-B1, B1, A3 indicates that the source terminal device A interacted with the destination terminal devices B1 and B2 for the same data three times. Of course, the identifier may not reflect the same number of interactions. For example, in A0-B1, B1, the identifier in A0 is the subscript "0". When the source terminal device number has the subscript "0", it indicates that the source terminal device A interacted with the destination terminal devices B1 and B2 for the same data.

[0058] Step S3: If yes, update the terminal device number in the access control list and output a trigger instruction.

[0059] The interaction center 10 stores a plurality of access control lists, each of which corresponds to a local area network 20 , that is, one access control list stores a plurality of terminal devices located in the same local area network 20 and the serial numbers corresponding to the terminal devices.

[0060] When the interaction center 10 recognizes that the interaction request contains an identifier, it extracts the access control list of the local area network 20 where the destination terminal device is located, and updates the number of the terminal device in the access control list. The updating process is as follows:

[0061] First, obtain the initial number of the terminal device, which is the number corresponding to the terminal device before the update. Then, select the update method, and use the selected update method to update the number corresponding to the terminal device. There are three update methods provided in this application. The first is to select a random number, and then add the random number to the initial number to obtain a new number; the second is to increase the added value in sequence according to the order of the terminal device in the access control list on the basis of the initial number, that is, the value added by the terminal device on the basis of the initial number is an arithmetic progression; the third is to shift the corresponding numbers clockwise or counterclockwise according to the order of the terminal device in the access control list. For example, there are three terminal devices stored in the access control list, represented by A, B, and C respectively. Before the update, A, B, and C are ranked first, second, and third in the access control list and the corresponding numbers are 001, 010, and 100 respectively. After the clockwise update, the corresponding numbers of A, B, and C are 100, 001, and 010 respectively, and after the counterclockwise update, the corresponding numbers of A, B, and C are 010, 100, and 001 respectively.

[0062] In order to distinguish the numbers before and after replacement, the number after replacement is called a secondary number, that is, after the access control list is updated, the secondary number corresponding to the terminal device is obtained.

[0063] It should be noted that when selecting an update method from the above three update methods, it can be determined by the identifier in the interaction request. For example, when the identifier can reflect the same number of interactions, one update method can be periodically selected from the three update methods by the number of interactions. For example, when the same number of interactions is 1, 2, and 3, they correspond to the first update method, the second update method, and the third update method respectively. Therefore, when the same number of interactions is 4, 5, and 6, the above selection cycle is repeated, which corresponds to the first update method, the second update method, and the third update method respectively. Of course, when selecting an update method from the above three update methods, it can also be manually configured in advance.

[0064] The interaction center 10 is also provided with an encryption model in advance. When the access control list is updated, the secondary number of the destination terminal device is input into the encryption model to obtain a standard number. In a specific example, the encryption process of the encryption model is: extracting the number of the source terminal device and the secondary number of the destination terminal device, adding the number of the source terminal device to the secondary number to obtain the standard number. In other examples, the encryption process of the encryption model can also be: extracting the number of the source terminal device and the secondary number of the destination terminal device, multiplying the number of the source terminal device by the secondary number to obtain the standard number.

[0065] Step S4: If not, output a verification instruction.

[0066] When the interaction request does not contain an identifier, first determine whether the interaction request satisfies:

[0067] n>N∪p>P, wherein n is the number of destination terminal devices in the interaction request, N is the threshold value of the number of destination terminal devices, N is a preset value, and p is the ratio of the number of destination terminal devices in the local area network 20 containing the largest number of destination terminal devices to the number of destination terminal devices in the interaction request, and P is the ratio threshold, which is also a preset value.

[0068] When the interaction request meets the above conditions, the verification instruction is output in a broadcasting manner so that all the terminal devices in the local area network 20 where the target terminal device is located can receive the verification instruction. Otherwise, the interaction center 10 sends the verification instruction to the target terminal device in a unicast or multicast manner.

[0069] At the same time, the interaction center 10 also inputs the initial number of the destination terminal device into the encryption model to obtain a standard number. The encryption process here is similar to the encryption process in step S3, except that the sum of the initial number and the number of the source terminal device is calculated as the standard number.

[0070] Step S5: Receive the authentication number returned by the destination terminal device after receiving the trigger instruction or the verification instruction.

[0071] When the destination terminal device receives the trigger instruction, it updates the corresponding number. The specific update method is the same as the update method selected in step S3. This requires the administrator to set the update methods of both parties to be consistent in advance. Since each update method is described separately in step S3, the update method selected by the destination terminal device is not repeated here. Based on the destination terminal device after the update number, the number of the destination terminal device is encrypted using the same encryption method as the interaction center 10 to obtain the authentication number, that is, the authentication number is the sum of the number of the source terminal device and the number of the destination terminal device.

[0072] When the destination terminal device receives the verification instruction, it encrypts the number of the destination terminal device in the same encryption method as the interaction center 10 to obtain an authentication number, that is, the authentication number is the sum of the number of the source terminal device and the number of the destination terminal device.

[0073] In general, no matter whether the destination terminal device receives a trigger instruction or a verification instruction, an authentication number is ultimately generated and the generated authentication number is returned to the interaction center 10 .

[0074] It should be noted that when the interaction center 10 outputs the verification instruction in a broadcast manner, the terminal devices that receive the verification instruction need to use the same encryption method as the interaction center 10 to obtain the corresponding verification code (the verification code of the destination terminal device is called the authentication number), and return the verification code to the interaction center 10, so that the interaction center 10 can subsequently evaluate the security of the local area network 20.

[0075] Step S6: When the authentication number is the same as the standard number, a communication link between the source terminal device and the destination terminal device is established.

[0076] When the authentication number is the same as the standard number, it indicates that the destination terminal device is safe, and a communication link is established between the source terminal device and the destination terminal device. The source terminal device and the destination terminal device subsequently exchange information through the communication link.

[0077] It should be noted that when the interactive center 10 outputs the verification instruction in a broadcasting manner, the interactive center 10 needs to verify the verification code returned by each terminal device one by one, and the verification process is the same as the process of verifying the authentication number and the standard number. If the verification code of each terminal device is verified, the communication link between the source terminal device and the destination terminal device is established. Otherwise, it is considered that there is a dangerous terminal device in the local area network 20 where the destination terminal device is located. In order to prevent the dangerous terminal device from invading the local area network 20 where the source terminal device is located through the destination terminal device, the communication link between the source terminal device and the destination terminal device is stopped.

[0078] In summary, the present application sets a corresponding number for each terminal device because when establishing a communication link between terminal devices, it is also necessary to use an encryption model to encrypt the number corresponding to the terminal device, and then use the encrypted number to verify the identity of the target terminal device. However, in the local area network 20, when the intrusion device attacks the terminal device, it usually replaces the IP address of the terminal device with its own IP address, and replaces its own MAC address with the MAC address of the terminal device, so that it can receive the instruction that should be sent to the terminal device, but because it cannot know the encryption logic of the encryption model, it cannot return the corresponding authentication number. When the intrusion device tries to find the encryption logic of the encryption model through a rule, since the access control list dynamically updates the number of the terminal device, it is difficult to crack the production process of the authentication number of the terminal device it invades, which makes it difficult to return the correct authentication number and causes identity exposure, so that it is convenient for the interaction center 10 to accurately track the dangerous terminal device to improve the security of information interaction between multiple local area networks 20.

[0079] Figure 3 A block diagram of a security isolation and information exchange system according to an embodiment of the present application is shown. The system includes a first receiving module 11, a data judgment module 12, a data output module 13, a second receiving module 14, and a data processing module 15.

[0080] The first receiving module 11 is used to receive an interaction request sent by a source terminal device, where the interaction request is used to request information interaction with a destination terminal device. The source terminal device and the destination terminal device are located in different local area networks 20 .

[0081] The data determination module 12 is used to determine whether the interaction request contains an identifier, where the identifier indicates that the source terminal device has interacted with the same destination terminal device for the same data.

[0082] The data output module 13 is used to update the terminal device number in the access control list and output a trigger instruction when the interaction request contains an identifier. The access control list stores multiple terminal devices and the numbers corresponding to each terminal device; it is also used to output a verification instruction when the interaction request does not contain an identifier.

[0083] The second receiving module 14 is used to receive the authentication number returned by the destination terminal device after receiving the trigger instruction or the verification instruction.

[0084] The data processing module 15 is used to establish a communication link between the source terminal device and the destination terminal device when the authentication number is the same as the standard number. The standard number is the number obtained by encrypting the number corresponding to the destination terminal device in the access control list. The source terminal device and the destination terminal device exchange information through the communication link.

[0085] The modules involved in the embodiments described in the present application may be implemented by software or hardware. The modules described may also be set in a processor, for example, it may be described as: a processor includes a first receiving module 11, a data judgment module 12, a data output module 13, a second receiving module 14 and a data processing module 15. The names of these modules do not constitute a limitation on the modules themselves in some cases. For example, the first receiving module 11 may also be described as a "module for receiving an interaction request sent by a source terminal device".

[0086] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0087] In order to better execute the program of the above method, the present application also provides a security isolation and information exchange device, which includes a memory and a processor.

[0088] The memory may be used to store instructions, programs, codes, code sets or instruction sets. The memory may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function, and instructions for implementing the above-mentioned security isolation and information exchange method, etc.; the data storage area may store data involved in the above-mentioned security isolation and information exchange method, etc.

[0089] The processor may include one or more processing cores. The processor calls the data stored in the memory by running or executing the instructions, programs, code sets or instruction sets stored in the memory, performs various functions of the present application and processes data. The processor may be at least one of a special purpose integrated circuit, a digital signal processor, a digital signal processing device, a programmable logic device, a field programmable gate array, a central processing unit, a controller, a microcontroller and a microprocessor. It is understandable that for different devices, the electronic device used to implement the above-mentioned processor function can also be other, and the embodiments of the present application are not specifically limited.

[0090] The present application also provides a computer-readable storage medium, for example, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store program codes. The computer-readable storage medium stores a computer program that can be loaded by a processor and execute the above-mentioned security isolation and information exchange method.

[0091] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the aforementioned disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present application (but not limited to) by each other to form a technical solution.

Claims

1. A method for secure isolation and information exchange, characterized in that: include: Receiving an interaction request sent by a source terminal device, the interaction request being used to request information interaction with a destination terminal device, the source terminal device and the destination terminal device being located in different local area networks (20); Determining whether the interaction request includes an identifier, wherein the identifier indicates that the source terminal device has interacted with the same destination terminal device for the same data; If yes, then update the terminal device number in the access control list and output a trigger instruction, wherein the access control list stores a plurality of terminal devices and a number corresponding to each terminal device; If not, output the verification instruction; Receiving the authentication number returned by the destination terminal device after receiving the trigger instruction or the verification instruction; When the authentication number is the same as the standard number, a communication link is established between the source terminal device and the destination terminal device. The standard number is an encrypted number corresponding to the destination terminal device in the access control list. The source terminal device and the destination terminal device exchange information through the communication link.

2. The method for secure isolation and information exchange according to claim 1, characterized in that: The updating of the terminal device number in the access control list includes: selecting a random number, adding the initial number of the terminal device to the random number to obtain a secondary number, wherein the initial number refers to the number corresponding to the terminal device before updating the access control list.

3. The method for secure isolation and information exchange according to claim 1, characterized in that: The updating of the terminal device number in the access control list includes: Increasing the value added to the initial number of the terminal device in sequence according to the order in which the terminal device is located in the access control list, wherein the initial number refers to the number corresponding to the terminal device before the access control list is updated; The initial number of the terminal device is added to the value to obtain a secondary number.

4. The method for secure isolation and information exchange according to claim 1, characterized in that: The updating of the numbering of the terminal devices in the access control list includes: shifting the initial number corresponding to the terminal device clockwise or counterclockwise according to the order of the terminal devices in the access control list to obtain the secondary number of the terminal device, wherein the initial number refers to the number corresponding to the terminal device before updating the access control list.

5. The method for secure isolation and information exchange according to any one of claims 2 to 4, characterized in that: After the terminal device number in the access control list is updated, the method further includes: inputting the secondary number of the target terminal device into the encryption model to obtain a standard number.

6. The method for secure isolation and information exchange according to claim 5, characterized in that: The encryption process of the encryption model is: Extracting the number of the source terminal device and the secondary number of the destination terminal device; The standard number is obtained by adding the number of the source terminal device to the secondary number.

7. The method for secure isolation and information exchange according to claim 1, characterized in that: The interaction request includes the number of the source terminal device and the number of the destination terminal device; Before outputting the verification instruction, the method further includes: Determine whether the interaction request is satisfied: n>N, where n is the number of destination terminal devices in the interactive request and N is a threshold value for the number of destination terminal devices; or p>P, where p is the ratio of the number of destination terminal devices in the local area network (20) containing the largest number of destination terminal devices to the number of destination terminal devices in the interactive request and P is a threshold value for the ratio; If yes, the verification instruction is outputted by broadcasting; If not, the verification instruction is output in a unicast or multicast manner.

8. The method for secure isolation and information exchange according to claim 7, characterized in that: When the verification instruction is output in a broadcasting manner, when the authentication number is the same as the standard number, establishing a communication link between the source terminal device and the destination terminal device includes: A verification code returned by the receiving terminal device after receiving the verification instruction, wherein the verification code is the sum of the terminal device number and the source terminal device number; When the authentication number is the same as the standard number and the verification code is verified, a communication link between the source terminal device and the destination terminal device is established.

9. The method for secure isolation and information exchange according to claim 7, characterized in that: The format of the interaction request is A-B1,..., B n , n≥1, where A represents the number of the source terminal device, and B1, ..., B n The ID of the destination terminal device.

10. A security isolation and information exchange system, characterized in that: include: A first receiving module (11) is used to receive an interaction request sent by a source terminal device, wherein the interaction request is used to request information interaction with a destination terminal device, wherein the source terminal device and the destination terminal device are located in different local area networks (20); A data determination module (12) is used to determine whether the interaction request contains an identifier, wherein the identifier indicates that the source terminal device has interacted with the same destination terminal device for the same data; A data output module (13) is used to update the number of the terminal device in the access control list and output a trigger instruction when the interactive request contains an identifier, wherein the access control list stores a plurality of terminal devices and the number corresponding to each terminal device; and is also used to output a verification instruction when the interactive request does not contain an identifier; A second receiving module (14) is used to receive the authentication number returned by the destination terminal device after receiving the trigger instruction or the verification instruction; A data processing module (15) is used to establish a communication link between the source terminal device and the destination terminal device when the authentication number is the same as the standard number, the standard number being a number obtained by encrypting the number corresponding to the destination terminal device in the access control list, and the source terminal device and the destination terminal device exchange information via the communication link.

Images