A data security interaction device and method for realizing physical isolation
By setting distance sensing modules in the external network module and the internal network module, the motor module is controlled to drive the docking module to move to the docking module, realizing the automatic switching and secure interaction of data between the internal and external networks. This solves the problem that physical isolation cannot be achieved in the existing technology, and improves efficiency and security.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- YGSOFT INC
- Filing Date
- 2023-12-26
- Publication Date
- 2026-08-04
AI Technical Summary
Existing technologies cannot achieve true physical isolation when realizing secure data interaction between internal and external networks, resulting in information security risks and work efficiency issues, and the devices are highly complex.
Distance sensing modules are set up in the external network module and the internal network module respectively. The main control module controls the motor module to drive the docking module to move to the docking module, realizing the automatic switching between the external network link and the internal network link. The device structure is simplified by using fewer sensors, and the data interaction security is enhanced by encryption and decryption verification.
It enables automated switching between internal and external network data, improves data interaction efficiency, reduces device complexity, and enhances data interaction security through encryption and decryption verification.
Smart Images
Figure CN118074949B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of information system data transmission / communication technology, specifically to a data security interaction device and method for achieving physical isolation. Background Technology
[0002] In today's information age, data security and privacy protection have become major challenges for enterprises. To address these challenges, many large corporations have implemented physical isolation measures between their internal and external networks to ensure that internal hardware entities such as routers, workstations, and network servers, as well as communication links, are protected from external internet attacks. This physical isolation effectively isolates the direct or indirect connection between the internal and external networks, thereby protecting the enterprise's data security to a certain extent.
[0003] However, in actual business operations, enterprises face the need to synchronize and exchange a large amount of business data between internal and external networks. For example, many enterprises have built information systems on both their internal and external networks, requiring data exchange between them. These situations necessitate that enterprises ensure secure data exchange between their internal and external networks while simultaneously guaranteeing data security.
[0004] Traditional data transmission methods rely on manual operation or cannot achieve true physical isolation, thus posing information security risks and inefficiency issues. Some solutions on the market propose using USB interface switching devices to switch internal and external network links on demand. However, these solutions primarily achieve this through two methods: First, manual judgment to switch internal and external network links based on actual conditions. This method involves high human intervention and affects work efficiency. Second, software control via integrated circuits for automatic switching. This method, because the internal and external networks are controlled by the same integrated circuit, cannot achieve true physical isolation, or rather, it is difficult to prove that the integrated circuit ensures physical isolation, thus making it unacceptable and unusable.
[0005] Chinese invention patent CN117201633A discloses a method and apparatus for automatic data transfer between internal and external networks. In this scheme, the external network connection module and the internal network connection module are physically isolated. The external network connection module determines whether to transfer data based on the position change of the internal network connection module, thus eliminating the need for a single software program to control the switching between the external and internal network connection modules. However, this scheme requires the use of numerous sensors, and the implemented apparatus is relatively complex. Summary of the Invention
[0006] The primary objective of this invention is to provide a data security interaction device with a simpler structure that achieves physical isolation.
[0007] The second objective of this invention is to provide a data security interaction method that achieves physical isolation with a simpler judgment method.
[0008] A third objective of this invention is to provide a simpler method for achieving physically isolated data security interaction.
[0009] To achieve the aforementioned first objective, the present invention provides a data security interaction device for achieving physical isolation, comprising: an external network module, an internal network module, and a docking module; the external network module includes a first main control module, a first motor module, a first distance sensing module, and a first docking module, wherein the first main control module is connected to the first motor module, the first distance sensing module, and the first docking module, and the first motor module is connected to the first distance sensing module and the first docking module; the internal network module includes a second main control module, a second motor module, a second distance sensing module, and a second docking module, wherein the second main control module is connected to the second motor module, the second distance sensing module, and the second docking module, and the second motor module is connected to the second distance sensing module and the second docking module; the first distance sensing module is used to acquire a first distance between the external network module and the internal network module, and the second distance sensing module is used to acquire a second distance between the internal network module and the external network module; the first main control module is used to control the first motor module to drive the first docking module to move to the docking module according to the change of the first distance; the second main control module is used to control the second motor module to drive the second docking module to move to the docking module according to the change of the second distance.
[0010] As can be seen from the above scheme, the external network module and the internal network module of the present invention are physically isolated. The first main control module determines whether it is necessary to control the first motor module to move the first docking module to the docking module based on the first distance sensing module. The second main control module determines whether it is necessary to control the second motor module to move the second docking module to the docking module based on the second distance sensing module. The present invention can realize the automatic switching between the external network link and the internal network link, realize the data transmission between the internal and external networks, improve the data interaction efficiency, and on this basis, use fewer sensors, requiring only two sensors, the first distance sensing module and the second distance sensing module, which is less complex and has a wider range of applications compared to the prior art.
[0011] A further proposed solution is to have the external network module, internal network module, and docking module set up on the same line, with the external network module and internal network module respectively located on both sides of the docking module.
[0012] This demonstrates that the complexity of moving external and internal network modules can be reduced, and docking can be achieved through horizontal movement, simplifying the complexity of the device.
[0013] A further embodiment includes an external network module that further includes a first transmission module, which is connected to a first motor module, a first distance sensing module, and a first docking module; and an internal network module that further includes a second transmission module, which is connected to a second motor module, a second distance sensing module, and a second docking module; the first motor module includes a first push rod motor, the drive rod of which is connected to the first transmission module; and the second motor module includes a second push rod motor, the drive rod of which is connected to the second transmission module.
[0014] It is evident that the transmission module connects the distance sensing module and the docking module, and the modular design makes the overall device structure more compact and easier to install.
[0015] A further proposed solution is that the external network module includes a first magnetic module, and the internal network module includes a second magnetic module. The first magnetic module is located at the first docking module and connected to the first main control module, and the second magnetic module is located at the second docking module and connected to the second main control module.
[0016] Therefore, it can be seen that collision prevention between the first docking module and the second docking module can be achieved.
[0017] To achieve the second objective mentioned above, this invention provides a data security interaction method for achieving physical isolation, applied to a first main control module, comprising the following steps: S11: Real-time acquisition of the first distance between the external network module and the internal network module via a first distance sensing module; S12: Updating the first connection operation count of the external network module and the second connection operation count of the internal network module based on changes in the first distance; wherein, the first connection operation count is the number of times the first docking module of the external network module moves from the first initial position to the connection position and returns from the connection position to the first initial position; the second connection operation count is the number of times the second docking module of the internal network module moves from the second initial position to the connection position and returns from the connection position to the second initial position; S13: Determining the following execution state based on the difference between the first operation count and the second operation count: when the difference between the first connection operation count and the second connection operation count is -1, executing the first... The data reading task is as follows: the first data reading task is to control the first motor module to move the first docking module from the first initial position to the connection position, perform a data reading operation on the docking module at the connection position, and then control the first motor module to return the first docking module from the connection position to the first initial position, returning to step S12; when the difference between the number of first connection operations and the number of second connection operations is 0, it is determined whether the first data writing task has been obtained. If not, return to step S12; if yes, execute the first data writing task, which is as follows: control the first motor module to move the first docking module from the first initial position to the connection position, perform a data writing operation on the docking module at the connection position, and then control the first motor module to return the first docking module from the connection position to the first initial position, returning to step S12; when the difference between the number of first connection operations and the number of second connection operations is +1, return to step S12.
[0018] As can be seen from the above scheme, this invention obtains the first distance between the external network module and the internal network module, and then determines the number of first connection operations and the number of second connection operations based on the first distance, thereby determining whether the first interface module needs to be moved to the docking module. The first distance can also be represented by the distance between the first interface module and the second interface module. This invention determines the number of first connection operations and the number of second connection operations by the change state of the first distance, making the determination method simpler.
[0019] A further solution involves updating the first connection operation count of the external network module and the second connection operation count of the internal network module based on the first distance, including the following steps: determining the first state change information according to the first distance and a preset first distance interval state correspondence table, and updating the first connection operation count of the external network module and the second connection operation count of the internal network module based on the first change state information.
[0020] Therefore, it can be seen that the method of determining state changes by comparing the first distance with a preset distance is more reliable than the method of determining state changes by comparing the first distance with a preset numerical range.
[0021] A further approach is that, when executing the first write data task or the first read data task, and after the first docking module moves from the first initial position to the connection position, the intranet module is determined to be in the second initial position based on the first distance, and then the first write data task or the first read data task continues to be executed.
[0022] This demonstrates that it can improve the security of data interaction.
[0023] A further solution is to update the first connection operation count of the external network module and the second connection operation count of the internal network module based on the first distance, including the following steps: when the internal network module moves from the second initial position to the connection position and returns from the connection position to the second initial position, if there is a situation where there is a pause for a predetermined time during the process of returning from the connection position to the second initial position, the difference between the first connection operation count and the second operation count is determined to be -1.
[0024] Therefore, it can be seen that by setting rules such as agreed stay time, even though the first main control module and the second main control module are physically isolated, the status information represented by the first main control module or the second main control module can still be determined by setting rules.
[0025] A further proposed solution is to decrypt the data read during the process of reading data from the docking module at the connection point during the execution of the first data reading task.
[0026] During the execution of the first data writing task, the data is encrypted while writing data to the docking module at the connection location.
[0027] Therefore, by introducing encryption, decryption, and verification of data during the interaction process, the security of data during the interaction process is further enhanced.
[0028] To achieve the third objective mentioned above, this invention provides a data security interaction method for achieving physical isolation, applied to a second main control module, comprising the following steps: S21: Real-time acquisition of the second distance between the external network module and the internal network module via a second distance sensing module; S22: Updating the first connection operation count of the external network module and the second connection operation count of the internal network module based on changes in the second distance; wherein, the first connection operation count is the number of times the first docking module of the external network module moves from the first initial position to the connection position and returns from the connection position to the first initial position; the second connection operation count is the number of times the second docking module of the internal network module moves from the second initial position to the connection position and returns from the connection position to the second initial position; S23: Determining the following execution state based on the difference between the first operation count and the second operation count: when the difference between the first connection operation count and the second connection operation count is +1, executing the second... The data reading task is as follows: the second data reading task is to control the second motor module to move the second docking module from the second initial position to the connection position, perform a data reading operation on the docking module at the connection position, and then control the second motor module to return the second docking module from the connection position to the second initial position, returning to step S22; when the difference between the number of first connection operations and the number of second connection operations is 0, it is determined whether a second data writing task has been obtained. If not, return to step S12; if yes, execute the second data writing task, which is as follows: control the second motor module to move the second docking module from the second initial position to the connection position, perform a data writing operation on the docking module at the connection position, and then control the second motor module to return the second docking module from the connection position to the second initial position, returning to step S22; when the difference between the number of first connection operations and the number of second connection operations is -1, return to step S22.
[0029] As can be seen from the above scheme, the present invention determines the number of first connection operations and the number of second connection operations by the change state of the second distance, and the determination method is simpler. Attached Figure Description
[0030] Figure 1 This is a schematic diagram of the structure of an embodiment of the data security interaction device for achieving physical isolation according to the present invention.
[0031] Figure 2 This is a flowchart of the execution of the first main control module in the embodiment of data security interaction with physical isolation of the present invention.
[0032] Figure 3 This is a flowchart illustrating the execution of the second main control module in a data security interaction embodiment that achieves physical isolation according to the present invention.
[0033] The present invention will be further described below with reference to the accompanying drawings and embodiments. Detailed Implementation
[0034] The data security interaction device for achieving physical isolation of the present invention sets up a first distance sensing module in the external network module and a second distance sensing module in the internal network module. The external network module determines whether to connect to the docking module based on a first distance obtained by the first distance sensing module, and the internal network module determines whether to connect to the docking module based on a second distance, thereby realizing the switching between internal and external network links. The present invention also provides a data security interaction method based on the above-described data security interaction device for achieving physical isolation.
[0035] Example of a data security interaction device that achieves physical isolation:
[0036] See Figure 1 The data security interaction device for achieving physical isolation in this embodiment includes an external network module 1, an internal network module 2, and a docking module 3.
[0037] The external network module 1 includes a first main control module 11, a first motor module 12, a first distance sensing module 13, a first docking module 14, and a first transmission module 15. The first main control module 11 is connected to the first motor module 12, the first distance sensing module 13, and the first docking module 14 respectively. The first motor module 12 is connected to the first transmission module 15. The first motor module 12 is connected to the first distance sensing module 13 and the first docking module 14 through the first transmission module 15.
[0038] The intranet module 2 includes a second main control module 21, a second motor module 22, a second distance sensing module 23, a second docking module 24, and a second transmission module 25. The second main control module 21 is connected to the second motor module 22, the second distance sensing module 23, and the second docking module 24. The second motor module 22 is connected to the second transmission module 25. The second motor module 22 is connected to the second distance sensing module 23 and the second docking module 24 through the second transmission module 25.
[0039] The docking module 3 includes a docking interface 31 and a USB interface 32, with the docking interface connected to the USB interface 32. The docking interface is used to connect the first docking module and the second docking module. The USB interface 32 can connect to external storage devices, such as a secure USB flash drive.
[0040] The first distance sensing module 13 is used to acquire a first distance between the external network module 1 and the internal network module 2. The first main control module 11 is used to control the first motor module 12 to drive the first docking module 14 to move to the docking module 3 according to the change of the first distance to realize data interaction with the docking module 3. The second distance sensing module 23 is used to acquire a second distance between the internal network module 2 and the external network module 1. The second main control module 21 is used to control the second motor module to drive the second docking module 24 to move to the docking module 3 according to the change of the second distance to realize data interaction with the docking module 3.
[0041] Continue to refer to Figure 1 In this embodiment, the outer network module 1, the inner network module 2, and the docking module 3 are arranged coaxially, with the outer network module 1 and the inner network module 2 respectively located on the left and right sides of the docking module 3. The first motor module 12 is a push rod motor, and its first drive rod 121 is connected to the first transmission module 15. The first transmission module 15 includes a first track 151 and a first sliding member 152, which connects to the first distance sensing module 13 and the first docking module 14. The second motor module 22 is a push rod motor, and its second drive rod 221 is connected to the second transmission module 25. The second transmission module 25 includes a second track 252 and a second sliding member 252, which connects to the second distance sensing module 23 and the second docking module 24.
[0042] In this embodiment, both the first distance sensing module 13 and the second distance sensing module 23 are distance sensors.
[0043] The first main control module 11 controls the first motor module 12 to move the first transmission rod left and right, thereby enabling the first distance sensing module 13 and the first docking module 14 to move from the first initial position to the connection position and back from the connection position to the first initial position. The second main control module 21 controls the second motor module 22 to move the second transmission rod left and right, thereby enabling the second distance sensing module 23 and the second docking module 24 to move from the second initial position to the connection position and back from the connection position to the second initial position.
[0044] The first docking module 14 and the second docking module 24 achieve different application effects in different positions. The "first initial position" refers to the first docking module 14 being in a specific position, i.e., the 0-point position. In this embodiment, this is the initial position when the first drive rod has not moved to the right, and the first docking module 14 and the docking interface 31 are disconnected. The "second initial position" refers to the second docking module 24 being in another specific position, also the 0-point position. In this embodiment, this is the initial position when the second drive rod has not moved to the left, and the second docking module 24 and the docking interface 31 are also disconnected. The "connection position" refers to the position where the first docking module 14 or the second docking module 24 is successfully docked with the docking interface 31.
[0045] The first main control module 11 determines the positions of the first docking module 14 and the second docking module 24 based on the state of the first distance sensing module 13. Among them, the following are: (1) When the first distance obtained by the first distance sensing module 13 is within the numerical range [a1, b1], the first docking module 14 is in the first initial position and the second docking module 24 is in the second initial position. This state is represented by ZT01A; (2) When the first distance obtained by the first distance sensing module 13 is within the numerical range [a2, b2], the first docking module 14 is in the connected position and the second docking module 24 is in the second initial position. This state is represented by ZT02A; (3) When the first distance obtained by the first distance sensing module 13 is within the range [a3, b3], the first docking module 14 is in the first initial position and the second docking module 24 is in the connected position. This state is represented by ZT03A; (4) When the first distance obtained by the first distance sensing module 13 is within the numerical range [a4, b4], the position between the first docking module 14 and the second docking module 24 is an abnormal position. This state is represented by ZT04A. When the first distance obtained by the first distance sensing module 13 is not within the above-mentioned numerical range, it can be determined that the second docking module 24 is in another position (e.g., the intranet module 2 is not installed). This state is represented by ZT05A. The above-mentioned numerical ranges can be set according to the actual distance and combined with possible errors. For example, when the first docking module 14 is in the first initial position and the second docking module 24 is in the second initial position, the distance between the first initial position and the second initial position is measured to be 80cm. Then the numerical range [78, 82] can be set. Thus, when the first distance measured by the first distance sensing module is 79cm in actual use, the first main control module 11 can obtain a state ZT01A.
[0046] Therefore, a first distance interval state correspondence table can be set to obtain the state corresponding to the first distance. For example, the first distance interval state correspondence table includes: the numerical interval [a1, b1] corresponds to ZT01A. Thus, when the first main control module 11 determines that the first numerical distance is within the interval [a1, b1], it obtains a state ZT01A.
[0047] The second main control module 21 determines the positions of the first docking module 14 and the second docking module 24 based on the state of the second distance sensing module 23. Among them, the following are: (1) When the second distance obtained by the second distance sensing module 23 is within the numerical range [c1, d1], the first docking module 14 is in the first initial position and the second docking module 24 is in the second initial position. This state is represented by ZT01 B; (2) When the second distance obtained by the second distance sensing module 23 is within the numerical range [c2, d2], the second docking module 24 is in the connected position and the first docking module 14 is in the first initial position. This state is represented by ZT02 B; (3) When the second distance obtained by the second distance sensing module 23 is within the range [c3, d3], the second docking module 24 is in the first initial position and the first docking module 14 is in the connected position. This state is represented by ZT03 B; (4) When the second distance obtained by the second distance sensing module 23 is within the numerical range [c4, d4], the position between the first docking module 14 and the second docking module 24 is an abnormal position. This state is represented by ZT04 B. When the second distance obtained by the second distance sensing module 23 is not within the above-mentioned numerical range, it can be determined that the first docking module 14 is in another location (e.g., the external network module 1 is not installed). This state is represented by ZT05B. Similarly, the above-mentioned numerical range can be set according to the pre-measured actual distance and in combination with possible errors.
[0048] Therefore, a second distance interval state correspondence table can be set up. For example, the numerical interval [c1,d1] corresponds to ZT01 B. Thus, when the second main control module 21 determines that the second numerical distance is within the numerical interval [c1,d1], it obtains a state ZT01 B.
[0049] In this embodiment, the first motor module and the second motor module are push rod motors, but this is merely an example and not intended to limit the specific use of the first and second motor modules. In other embodiments, the first motor module and / or the second motor module can be other types of motors, such as servo motors, stepper motors, DC motors, AC motors, hydraulic motors, or pneumatic motors, all of which should be covered within the scope of protection of this invention. When a servo motor is selected, the movement and position of the first and second docking modules can be controlled more precisely, and its accuracy, speed, and torque will be higher. Similarly, in this embodiment, both the first and second distance sensing modules are distance sensors, which does not constitute a specific limitation on the first and second distance sensing modules of the invention. In other embodiments, the first and / or second distance sensing modules can also be modules used to measure distance or position, such as laser displacement sensors, and these modules should also be covered within the scope of protection of this invention.
[0050] In another embodiment, more sensors can be added to meet the requirements of specific scenarios. For example, a first magnetic module can be placed next to the first docking module, and a second magnetic module can be placed next to the second docking module. These sensors detect changes in the magnetic field and trigger corresponding actions to prevent collisions. For instance, the first magnetic module can be a magnet, magnetic strip, or other magnetic material, while the second magnetic module can be a magnetic switch used to sense changes in the magnetic field. The second magnetic module is connected to a second main control module, allowing the second main control module to determine the proximity of the second docking module to the first docking module based on the magnetic field change information, and thus take measures to prevent collisions.
[0051] Example of a physically isolated data security interaction method:
[0052] The data security interaction device based on the above embodiments, which achieves physical isolation, can realize data exchange between clients running on different networks. This embodiment illustrates the data exchange between client A and client B, which run in two completely physically isolated networks, referred to as the external network and the internal network, respectively. Client A runs on the external network, and client B runs on the internal network.
[0053] Client A includes a first application unit, a first control unit, and a first data transfer unit.
[0054] The first application unit is an application program used to acquire and organize the required data files, store the data files in a preset location after organization, and issue a data interaction request to the first control unit. In this embodiment, the first application unit is an RPA automation program for "engineering settlement data organization", hereinafter referred to as: engineering settlement data organization robot.
[0055] The engineering settlement data processing robot can be executed manually as needed or run automatically on a scheduled basis; this embodiment prefers scheduled operation. The robot can simulate manual login to the engineering settlement information system, obtain settlement data and related attachments, and process the acquired information according to specific format requirements. The output data file is, but is not limited to:
[0056] (1) Settlement data: As shown in Table 1 below, the settlement data includes, but is not limited to: project number, project name, contract number, contract name, construction unit, contract amount, settlement amount, etc. Multiple settlement data can be obtained at the same time, and each data is distinguished by a unique ID.
[0057] Table 1: Settlement Data Table
[0058]
[0059] (2) Relevant settlement attachments: including but not limited to: contracts, project acceptance documents, construction drawings and as-built drawings, settlement statements from the construction unit, etc. For easier searching and archiving, settlement attachments corresponding to the same ID are stored in a separate folder. The filename includes the ID, used to establish the correspondence between the ID and the settlement data.
[0060] (3) Data Interaction Request Form: This form is mainly used to record descriptions, descriptions of the current file data, and work instructions that need to be processed in the next stage.
[0061] In this embodiment, the output data file is located at "D:\File Data Interaction Area\".
[0062] The first control unit is an application program used to receive instructions and control the first docking module to move horizontally left or right via the first motor module. In this embodiment, when the first control unit receives a data interaction request from the first application unit, it generates a task, which can be a first data read task or a first data write task. After receiving the task, the first control unit uses the first distance obtained by the first distance sensing module to determine whether the second docking module is in the second initial position, i.e., receiving the ZT01A state. If the received state is not ZT01A, the task continues to wait until the ZT01A state is received. If the received state is ZT01A, the first control unit controls the first motor module to move to the right, ultimately achieving docking and connection between the first docking module and the interface, thereby enabling the connection between client A and the USB interface.
[0063] The first data transfer unit is an application program whose main function is to retrieve a data file from a preset location (D:\File Data Interaction Area\ in this embodiment), encrypt the data file, and then upload the encrypted data file to an external storage device connected via a USB interface through the first docking module and the interface. After the data file upload is complete, it issues a command to the first control unit, which controls the first docking module to return from the connected position to the initial position via the first motor module, thus disconnecting the connection between the first docking module and the interface.
[0064] In this embodiment, client A runs in the first main control module. In different embodiments, only the first control unit runs in the first main control module, while the first application unit and the first data transfer unit run on the same or different devices, and the first application unit, the first control unit, and the first data transfer unit communicate with each other through any existing wired / wireless method.
[0065] Client B includes a second control unit, a second data transfer unit, and a second application unit.
[0066] The second control unit is an application program that receives commands to control the second docking module to move horizontally to the left or right via the second motor module. Commands can be issued by the second application unit or automatically triggered by the status corresponding to the second distance returned by the second distance sensing module.
[0067] For example, after the first motor module controls the first docking module and the docking interface to dock, the second control unit will receive a ZT03B status. When the first docking module returns to the first initial module, the second control unit will receive a ZT01B status. These two statuses indicate that the first docking module and the docking interface have successfully docked, and the first docking module has returned to the first initial position. Thus, the second control unit will receive a command for a second data reading task.
[0068] After receiving the task instruction to read data, the second control unit will, before executing the task instruction, use the second distance sensing module to determine again whether the first docking module is still in the first initial position. If it is in the first initial position, it will receive the ZT01B status again. If it does not receive the ZT01B status, the task will continue to wait until it receives the ZT01B status. If the ZT01B status is received, the second application unit will control the second motor module to move to the left, towards the interface, ultimately achieving docking and connection between the second docking module and the interface, that is, achieving connection between client B and the USB interface.
[0069] The second data transfer unit is an application program used to retrieve data files from an external storage device connected via a USB port, and then decrypt the data files at a designated location via the second docking module and the interface. After the data files are retrieved, an instruction is sent to the second application unit, which in turn controls the second motor module to return the second docking module from the connected position to the second initial position, disconnecting the second docking module from the interface.
[0070] The second application is a suite of applications used to retrieve data files from a specified location. It then parses and reads the information to complete subsequent operations. In this embodiment, the retrieved data files are settlement data tables, related settlement attachments, and data interaction request forms. Specifically, the second application parses the data interaction request form to determine the purpose of the current task. It then executes the relevant functions to complete the subsequent operations. In this embodiment, the second application is an engineering fund payment robot. This robot simulates a human automatically logging into the fund payment system, completing the payment application form, and uploading attachments.
[0071] In this embodiment, client B runs in the second main control module. In different embodiments, only the second control unit runs in the second main control module, while the second application unit and the second data transfer unit run on the same or different devices, and communication between the second application unit, the second control unit, and the second data transfer unit is achieved through any existing wired / wireless method.
[0072] Therefore, client A and client B can implement a secure data interaction method based on the above embodiments.
[0073] Specifically, to implement the data security interaction method of this embodiment, client A runs on the first main control unit, referring to... Figure 2 This includes the following steps:
[0074] S11: The first distance between the external network module and the internal network module is obtained in real time through the first distance sensing module, and the first write data task is obtained.
[0075] Specifically, the first write data task may originate from the first application unit, and the first control unit obtains the first write data task from the first application unit.
[0076] S12: Update the number of first connection operations of the external network module and the number of second connection operations of the internal network module based on the change of the first distance.
[0077] Specifically, the first connection operation count is the number of times the first docking module of the external network module moves from the first initial position to the connection position and returns from the connection position to the first initial position. The second connection operation count is the number of times the second docking module of the internal network module moves from the second initial position to the connection position and returns from the connection position to the second initial position. The first main control module determines the first state change information based on the first distance interval state correspondence table preset in the above embodiment to update the first connection operation count and the second connection operation count. For example, if the first main control module obtains the first state change information obtained according to the obtained first distance, from the numerical interval [a1,b1] to the numerical interval [a2,b2], and then from the numerical interval [a2,b2] back to the numerical interval [a1,b1], then when the first state change information obtained by the first module includes the change from ZT01A to ZT02A and from ZT02A to ZT01A, the number of the first connection operation count is incremented by 1.
[0078] When the second docking module moves from the second initial position to the connection position and then back to the second initial position based on the first distance, if it is determined that there is a predetermined dwell time during the process of the second docking module returning from the connection position to the second initial position, the first main control module determines that the difference between the number of first connection operations and the number of second operations is -1, that is, it increments the recorded number of second operations by 1, thus requiring the execution of the first data reading task. Through this predetermined dwell time, the first main control module can determine that after the second docking module returns to the second initial position, it needs to execute a first data reading task to obtain the data left behind by the second main control module in the interface module through the second docking module. At this time, because the second main control module actively controls the predetermined dwell time, it can correspondingly reduce its recorded number of first connection operations by one, ensuring that the execution of the first data reading task by the first main control module does not mistakenly trigger the execution of the second main control module.
[0079] S13: Determine if the difference between the number of first connection operations and the number of second connection operations is equal to -1. If not, continue to step S14; if yes, execute step S131, execute the first data reading task, and then return to step S12.
[0080] Specifically, the first data reading task is to control the first motor module to move the first docking module from the first initial position to the connection position, perform data reading operations on the docking module at the connection position, and then control the first motor module to return the first docking module from the connection position to the first initial position.
[0081] During the execution of the first data reading task, when the first docking module moves to the connection position, the first main control module again determines whether the second docking module is in the second initial position based on the first distance (after receiving the ZT02A status again). If the second docking module is determined to be in the second initial position, the first data reading task can continue, and the first data moving unit interacts with the external storage device in the docking module. If the second docking module is determined not to be in the second initial position, it indicates that there may be an anomaly. After waiting for a specific time, the first distance sensing module is called again to determine the position. If the ZT02A status is still not received, the task is abandoned, and the process jumps to step S16. In this embodiment, the second main control module can repeatedly determine the first docking module in the first initial position using similar steps when executing the second data reading task.
[0082] S14: Determine if the difference between the number of first connection operations and the number of second connection operations is equal to 0. If not, continue to step S15; if yes, execute step S141 to determine if a first write data task has been obtained. If a first write data task has been obtained, execute step S142 to execute the first write data task, and then return to step S12; if no first write data task has been obtained, return to step S12.
[0083] Specifically, the first data writing task involves controlling the first motor module to move the first docking module from the first initial position to the connection position, performing a data writing operation on the docking module at the connection position, and then controlling the first motor module to return the first docking module from the connection position to the first initial position.
[0084] S15: Determine if the difference between the number of first connection operations and the number of second connection operations is equal to 1. If not, continue to step S16; if yes, it means that we need to wait for the second main control module to execute the second data reading task, and then return to step S12.
[0085] S16: Display an error message and then end.
[0086] To implement the data security interaction method of this embodiment, a second control unit runs on the second main control unit, referring to... Figure 3 This includes the following steps:
[0087] S21: The second distance between the external network module and the internal network module is obtained in real time through the second distance sensing module, and the second write data task is obtained.
[0088] Specifically, the second write data task may originate from the second application unit mentioned above, and the second control unit obtains the second write data task from the second application unit.
[0089] S22: Update the number of first connection operations of the external network module and the number of second connection operations of the internal network module based on the change of the second distance.
[0090] Specifically, the second main control module determines the second state change information based on the second distance interval state correspondence table preset in the above embodiment to update the number of first connection operations and the number of second connection operations.
[0091] S23: Determine if the difference between the number of first connection operations and the number of second connection operations is equal to -1. If yes, it means that we need to wait for the first main control module to execute the first data reading task, and return to step S22; if no, continue to step S24.
[0092] S24: Determine if the difference between the number of first connection operations and the number of second connection operations is equal to 0. If not, continue to step S25; if yes, proceed to step S241 to determine if a second write data task has been obtained. If a second write data task has been obtained, continue to step S242 to execute the second write data task, and then return to step S22. If no second write data task has been obtained, return directly to step S22.
[0093] Specifically, the second data writing task involves controlling the second motor module to move the second docking module from the second initial position to the connection position, performing a data writing operation on the docking module at the connection position, and then controlling the second motor module to return the second docking module from the connection position to the second initial position.
[0094] S25: Determine if the difference between the number of first connection operations and the number of second connection operations is equal to 1. If not, continue to step S26; if yes, execute step S251 to execute the second data reading task, and then return to step S22.
[0095] Specifically, the second data reading task is to control the second motor module to move the second docking module from the second initial position to the connection position, perform data reading operations on the docking module at the connection position, and then control the second motor module to return the second docking module from the connection position to the second initial position.
[0096] S26: Display an error message and then end.
[0097] To further record the data flow, in this embodiment, the first main control module and the second main control module can also record the interaction process.
[0098] In another embodiment, no error message is displayed when the difference between the number of first connection operations and the number of second connection operations is not 1, -1, or 0. Another embodiment addresses a situation where an external network module or an internal network module needs to move to a docking module for data interaction, and one party is unable to move to the docking module in time due to a malfunction or other abnormal reason. In this case, the other party can execute the write data task multiple times. After the abnormal reason is resolved, the party experiencing the abnormality can read the data written by the other party in one go. For example, after the first main control module executes the first write data task, both the external network module and the internal network module determine that the difference between the number of first connection operations and the number of second connection operations is equal to 1. The second main control module needs to execute the second read data task. However, due to mechanical failure or other reasons, the second main control module cannot execute the second read data task. Meanwhile, the first main control module receives the first write data task again during the waiting period and can then execute the first write data task again. Specifically, the process can be as follows: After a certain period of time, if the difference between the number of first connection operations and the number of second connection operations remains unchanged at 1, the first main control module can determine that the intranet module may be malfunctioning and enters the exception handling process. In the exception handling process, it continues to determine whether a first write data task has been received. If so, it directly executes the first write data task until the number of second connection operations is recorded as incremented by 1 (i.e., the intranet module resolves the exception and executes a second read data task). Then, it clears the recorded number of first and second connection operations and exits the exception handling process, returning to step S12. Similarly, after determining that the difference between the number of first and second connection operations is greater than 1, the second main control module enters the exception handling process. In this process, it executes a second read data task, then clears the number of first and second connection operations, and returns to step S22.
[0099] In summary, this invention can achieve automated switching between external network links and internal network links, realize data transmission between internal and external networks, improve data interaction efficiency, and, on this basis, use fewer sensors, requiring only two sensors, a first distance sensing module and a second distance sensing module. Compared with existing technologies, it is less complex and has a wider range of applications. The number of first connection operations and the number of second connection operations are determined by the change in the first distance, and the judgment method is also simpler.
Claims
1. A data security interaction device for achieving physical isolation, characterized in that, include: External network module, internal network module, and interface module; The external network module includes a first main control module, a first motor module, a first distance sensing module, and a first docking module. The first main control module is connected to the first motor module, the first distance sensing module, and the first docking module, and the first motor module is connected to the first distance sensing module and the first docking module. The intranet module includes a second main control module, a second motor module, a second distance sensing module, and a second docking module. The second main control module is connected to the second motor module, the second distance sensing module, and the second docking module, respectively. The second motor module is connected to the second distance sensing module and the second docking module, respectively. The first distance sensing module is used to obtain a first distance between the external network module and the internal network module, and the second distance sensing module is used to obtain a second distance between the internal network module and the external network module; The first main control module is used to control the first motor module to drive the first docking module to move to the docking module according to the change of the first distance; The first main control module obtains the state corresponding to the first distance based on the numerical range of the first distance interval state table, and determines the positions of the first docking module and the second docking module based on the state corresponding to the first distance. The second main control module is used to control the second motor module to drive the second docking module to move to the docking module according to the change of the second distance; The second main control module obtains the state corresponding to the second distance based on the numerical range of the second distance interval state table, and determines the positions of the first docking module and the second docking module based on the state corresponding to the second distance. The external network module, the internal network module, and the docking module are arranged in a collinear manner, with the external network module and the internal network module respectively located on both sides of the docking module.
2. The data security interaction device for achieving physical isolation as described in claim 1, characterized in that: The external network module also includes a first transmission module, which is connected to the first motor module, the first distance sensing module and the first docking module respectively. The intranet module also includes a second transmission module, which is connected to the second motor module, the second distance sensing module and the second docking module respectively. The first motor module includes a first push rod motor, and the drive rod of the first push rod motor is connected to the first transmission module; The second motor module includes a second push rod motor, and the drive rod of the second push rod motor is connected to the second transmission module.
3. The data security interaction device for achieving physical isolation as described in claim 1 or 2, characterized in that: The external network module includes a first magnetic module, and the internal network module includes a second magnetic module. The first magnetic module is disposed at the first docking module and connected to the first main control module, and the second magnetic module is disposed at the second docking module and connected to the second main control module.
4. A method for achieving physically isolated secure data interaction, applied to the first main control module of the data security interaction device for achieving physically isolated data interaction as described in any one of claims 1 to 3, characterized in that, Includes the following steps: S11: The first distance between the external network module and the internal network module is obtained in real time through the first distance sensing module; S12: Update the first connection operation count of the external network module and the second connection operation count of the internal network module based on the change of the first distance; wherein, the first connection operation count is the number of times the first docking module of the external network module moves from the first initial position to the connection position and returns from the connection position to the first initial position; the second connection operation count is the number of times the second docking module of the internal network module moves from the second initial position to the connection position and returns from the connection position to the second initial position; S13: Determine the following execution status based on the difference between the first number of operations and the second number of operations: When the number of first connection operations and the number of second connection operations are -1, the first data reading task is executed; wherein, the first data reading task is: controlling the first motor module to move the first docking module from the first initial position to the connection position, performing a data reading operation on the docking module at the connection position, and then controlling the first motor module to return the first docking module from the connection position to the first initial position, returning to step S12; When the difference between the number of first connection operations and the number of second connection operations is 0, determine whether the first write data task has been obtained. If not, return to step S12. If yes, execute the first write data task. The first write data task is: control the first motor module to move the first docking module from the first initial position to the connection position, perform a write data operation on the docking module at the connection position, and then control the first motor module to return the first docking module from the connection position to the first initial position, and return to step S12. When the difference between the number of the first connection operation and the number of the second connection operation is +1, return to step S12.
5. The data security interaction method for achieving physical isolation as described in claim 4, characterized in that: When updating the first connection operation count of the external network module and the second connection operation count of the internal network module based on the first distance, the following steps are included: First state change information is determined based on the first distance and a preset first distance interval state correspondence table, and the first connection operation count of the external network module and the second connection operation count of the internal network module are updated based on the first state change information.
6. The data security interaction method for achieving physical isolation as described in claim 4, characterized in that: When executing the first write data task or the first read data task, and after the first docking module moves from the first initial position to the connection position, the intranet module is determined to be in the second initial position based on the first distance, and then the first write data task or the first read data task continues to be executed.
7. The data security interaction method for achieving physical isolation as described in claim 4, characterized in that: When updating the first connection operation count of the external network module and the second connection operation count of the internal network module based on the first distance, the following steps are included: When the intranet module moves from the second initial position to the connection position and returns from the connection position to the second initial position, if there is a situation where there is a pause for a predetermined time during the process of returning from the connection position to the second initial position, the difference between the number of the first connection operation and the number of the second operation is determined to be -1.
8. The data security interaction method for achieving physical isolation as described in any one of claims 4 to 7, characterized in that: During the execution of the first data reading task, the data read from the docking module at the connection location is decrypted during the process of reading data from the docking module at the connection location. During the execution of the first data writing task, the data is encrypted while writing data to the docking module at the connection location.
9. A method for achieving physically isolated secure data interaction, applied to the second main control module of the data security interaction device for achieving physically isolated data interaction as described in any one of claims 1 to 3, characterized in that, Includes the following steps: S21: The second distance between the external network module and the internal network module is obtained in real time through the second distance sensing module; S22: Update the first connection operation count of the external network module and the second connection operation count of the internal network module based on the change of the second distance; wherein, the first connection operation count is the number of times the first docking module of the external network module moves from the first initial position to the connection position and returns from the connection position to the first initial position; the second connection operation count is the number of times the second docking module of the internal network module moves from the second initial position to the connection position and returns from the connection position to the second initial position; S23: Determine the following execution status based on the difference between the first number of operations and the second number of operations: When the number of the first connection operation and the number of the second connection operation are +1, the second data reading task is executed; wherein, the second data reading task is: controlling the second motor module to move the second docking module from the second initial position to the connection position, performing a data reading operation on the docking module at the connection position, and then controlling the second motor module to return the second docking module from the connection position to the second initial position, returning to step S22; When the difference between the number of first connection operations and the number of second connection operations is 0, determine whether a second write data task has been obtained. If not, return to step S12. If yes, execute the second write data task. The second write data task is: control the second motor module to move the second docking module from the second initial position to the connection position, perform a write data operation on the docking module at the connection position, and then control the second motor module to return the second docking module from the connection position to the second initial position, and return to step S22. When the difference between the number of first connection operations and the number of second connection operations is -1, return to step S22.