One-way transmission security isolation method, device, electronic device and storage medium

Abstract

The present application provides a one-way transmission security isolation method, which includes: a first processing unit receives data information transmitted through a first network; processes the data information to obtain an encrypted data packet; transmits the encrypted data packet to a first conversion unit through a first high-speed bus; the first conversion unit converts the encrypted data packet into an optical signal; transmits the optical signal to a second conversion unit through a physically unidirectional single optical fiber; the second conversion unit verifies the received optical signal according to a check bit; converts the optical signal that succeeds in the verification into an encrypted data packet; sends the encrypted data packet to a second processing unit through a second high-speed bus, the second high-speed bus including a plurality of third channels; the second processing unit restores the received encrypted data packet according to the packet sequence number and the check bit to obtain restored data information; the second processing unit transmits the restored data information to a second network. This solution can ensure the accuracy of one-way transmission data.

Description

Technical Field

[0001] The present invention belongs to the technical field of network isolation, and in particular relates to a one-way transmission security isolation method, device, electronic equipment and storage medium. Background Art

[0002] When two networks exchange data, in order to ensure the security and controllability of data in one network and prevent leakage, a one-way transmission security isolation method is generally used to achieve one-way transmission of data.

[0003] In a one-way isolation system, information data can only be isolated and transmitted one-way from one network to another. Information data based on one-way isolation technology can only be isolated and transmitted one-way from the sender to the receiver, and receipt data cannot be transmitted in the reverse direction. Therefore, the accuracy of the data cannot be guaranteed. Summary of the invention

[0004] The purpose of the embodiments of this specification is to provide a one-way transmission security isolation method, device, electronic device and storage medium.

[0005] The embodiment of the present application is implemented in the following manner:

[0006] In a first aspect, the present application provides a one-way transmission security isolation method, the method comprising:

[0007] The first processing unit receives data information transmitted through the first network;

[0008] The first processing unit processes the data information to obtain an encrypted data packet, which includes the encrypted data and a corresponding packet sequence number and a check bit;

[0009] The first processing unit transmits the encrypted data packet to the first conversion unit via the first high-speed bus; wherein the first high-speed bus includes a plurality of first channels;

[0010] The first conversion unit converts the encrypted data packet into an optical signal;

[0011] The first conversion unit transmits the optical signal to the second conversion unit through a single physically unidirectional optical fiber; wherein the optical fiber includes a plurality of second channels;

[0012] The second conversion unit checks the received optical signal according to the check bit;

[0013] The second conversion unit converts the successfully verified optical signal into an encrypted data packet;

[0014] The second conversion unit sends the encrypted data packet to the second processing unit via a second high-speed bus, the second high-speed bus including a plurality of third channels;

[0015] The second processing unit performs restoration processing on the received encrypted data packet according to the packet sequence number and the check bit to obtain restored data information;

[0016] The second processing unit transmits the restored data information to the second network.

[0017] In one embodiment, the first processing unit processes the data information to obtain an encrypted data packet, including:

[0018] The first processing unit converts the data information into a first preset format to obtain encrypted data;

[0019] The first processing unit unpacks the encrypted data to obtain an encrypted data packet.

[0020] In one embodiment, the first processing unit transmits the encrypted data packet to the first conversion unit via the first high-speed bus, including:

[0021] Encrypted data in different data formats in an encrypted data packet are transmitted using different first channels; and encrypted data in the same data format in an encrypted data packet are transmitted using multiple first channels.

[0022] In one of the embodiments, if the amount of data transmitted on the optical fiber accounts for 50% or less of the bandwidth of the optical fiber;

[0023] The first conversion unit transmits the optical signal to the second conversion unit through a physically unidirectional single optical fiber, including:

[0024] The first conversion unit transmits the optical signal to the second conversion unit through the second channel; the second channel corresponds to the first channel one by one, and the second channel corresponds to the first channel through configuration.

[0025] In one of the embodiments, if the amount of data transmitted on the optical fiber accounts for more than 50% of the bandwidth of the optical fiber;

[0026] The first conversion unit transmits the optical signal to the second conversion unit through a physically unidirectional single optical fiber, including:

[0027] Under the premise of not exceeding the fiber bandwidth, the first conversion unit selects part of the second channel to transmit the optical signal to the second conversion unit.

[0028] Part of the selected second channels correspond to the first channels one by one, and part of the second channels and the first channels are selected and corresponded through configuration.

[0029] In one of the embodiments, the optical fiber further includes a bandwidth channel for transmitting the corresponding relationship between the first channel and the second channel to the second conversion unit.

[0030] In one embodiment, the second conversion unit checks the received optical signal according to the check bit, including:

[0031] If the second conversion unit verifies that any optical signal of any second channel is wrong according to the check bit, then the corresponding relationship between the first channel and the second channel is read;

[0032] If the second channel has a corresponding first channel, the optical signal of the packet number corresponding to the first channel is checked. If the check passes, the optical signal of the packet number corresponding to the first channel is copied to the second channel with an error in the check.

[0033] In a second aspect, the present application provides a one-way transmission safety isolation device, the device comprising:

[0034] A first processing unit is used to receive data information transmitted through the first network; and process the data information to obtain an encrypted data packet, the encrypted data packet including the encrypted data and the corresponding packet sequence number and the check bit; and transmit the encrypted data packet to the first conversion unit through the first high-speed bus; wherein the first high-speed bus includes a plurality of first channels;

[0035] A first conversion unit is used to receive the encrypted data packet transmitted by the first processing unit, and convert the encrypted data packet into an optical signal; and transmit the optical signal to the second conversion unit through a single physically unidirectional optical fiber; wherein the optical fiber includes a plurality of second channels;

[0036] A second conversion unit is used to receive the optical signal transmitted by the first conversion unit, and verify the received optical signal according to the check bit; and convert the optical signal that succeeds in the verification into an encrypted data packet; and send the encrypted data packet to the second processing unit through a second high-speed bus, wherein the second high-speed bus includes a plurality of third channels;

[0037] The second processing unit is used to restore the received encrypted data packet according to the packet sequence number and the check bit to obtain restored data information; and transmit the restored data information to the second network.

[0038] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the one-way transmission security isolation method of the first aspect is implemented.

[0039] In a fourth aspect, the present application provides a readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the one-way transmission security isolation method as in the first aspect.

[0040] It can be seen from the technical solution provided in the above embodiments of this specification that:

[0041] Through the physical property of optical fiber unidirectional transmission, physical unidirectional data transmission is realized to achieve safe isolation, and through high bandwidth, multi-channel methods, data is sent through corresponding channels and verification mechanisms to ensure the data accuracy of the one-way non-retransmission confirmation mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0043] Figure 1 A flowchart of the one-way transmission security isolation method provided in this application;

[0044] Figure 2 An internal block diagram of a system for implementing a one-way transmission security isolation method provided by the present application;

[0045] Figure 3 A schematic diagram of application scenario 1 provided for this application;

[0046] Figure 4 A schematic diagram of application scenario 2 provided for this application;

[0047] Figure 5 A schematic diagram of the structure of the one-way transmission safety isolation device provided in this application;

[0048] Figure 6 A schematic diagram of the structure of the electronic device provided in this application. DETAILED DESCRIPTION

[0049] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0050] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0051] It will be apparent to those skilled in the art that various modifications and variations may be made to the specific embodiments of the present application description without departing from the scope or spirit of the present application. Other embodiments derived from the present application description will be apparent to those skilled in the art. The present application description and examples are exemplary only.

[0052] The words “include,” “including,” “have,” “contain,” etc. used in this document are open-ended terms, meaning including but not limited to.

[0053] The present invention is further described in detail below with reference to the accompanying drawings and embodiments.

[0054] Reference Figure 1 , which shows a flow chart applicable to the one-way transmission security isolation method provided in the embodiment of the present application. The one-way transmission security isolation method can be applied to a security gateway, wherein the security gateway can be applicable to various fields of safe production, for example, non-coal mines, industrial control systems, data exchange of scientific research institutions, protection of sensitive data within enterprises, etc. Exemplarily, the production management system in the field of non-coal mines is in the intranet of the enterprise, while the network environment of the government regulatory department is generally a government extranet or the Internet, etc. If data is directly exchanged between the enterprise intranet and the government extranet or the Internet, there are security risks. The one-way transmission security isolation method provided by the present application can be used to transmit data and have the function of security isolation.

[0055] like Figure 2 The figure shows an internal block diagram of a system for implementing the one-way transmission safety isolation method provided by an embodiment of the present application. The system includes a first network, a first processing unit 210, a first conversion unit 220, a second conversion unit 230, a second processing unit 240, and a second network connected in sequence, wherein the first processing unit and the first conversion unit are connected via a first high-speed bus, and the first conversion unit and the second conversion unit are connected via a single physical unidirectional optical fiber, wherein the first conversion unit is provided with an optical fiber TX end, the second conversion unit is provided with an optical fiber RX end, and the second conversion unit and the second processing unit are connected via a second high-speed bus.

[0056] like Figure 1 As shown, the one-way transmission security isolation method may include:

[0057] S110. The first processing unit receives data information transmitted through the first network.

[0058] The first network may be an internal network or an external network, which is selected according to actual needs. When the first network is an internal network, the data information transmitted by the first network may be data information of one or more devices on the internal network side acquired by the internal network, wherein the one or more devices include at least one of sensors, video sources, and office systems. For example, the data information transmitted by the first network may be at least one of data information collected by various sensors on the internal network side, data information collected by various video sources, data information of office systems, etc. When the first network is an external network, the data information transmitted by the first network may be various data information acquired by the public network.

[0059] It can be understood that the data information transmitted by the first network may include video data, audio data, general data, etc. For example, sensor detection data, video source detection data, reported enterprise static data, etc.

[0060] S120: The first processing unit processes the data information to obtain an encrypted data packet, which includes the encrypted data and a corresponding packet sequence number and a check bit, and may include:

[0061] The first processing unit converts the data information into a first preset format to obtain encrypted data;

[0062] The first processing unit unpacks the encrypted data to obtain an encrypted data packet.

[0063] Specifically, the first preset format is a format that conforms to the data format of the first conversion unit, and can be set according to actual needs, for example, the name number of the variable, the specific value of the data, the length of the data, the type of the data, etc.

[0064] The conversion method of converting the data information into the first preset format can be determined according to the original data type, that is, the type of the data information, and the target data type, that is, the first preset format, etc. Different format conversion tools can be selected according to different requirements.

[0065] The encrypted data is unpacked, and the packet sequence number and check bit are added, and the encrypted data can be sub-packed and sent. It can be understood that when unpacking the encrypted data, a suitable unpacking method can be selected according to actual needs and data characteristics. Exemplarily, the unpacking method can include a fixed-length protocol method, a variable-length protocol method, a special character segmentation method, a specific format parsing method, etc.

[0066] S130: The first processing unit transmits the encrypted data packet to the first conversion unit via the first high-speed bus, wherein the first high-speed bus includes a plurality of first channels.

[0067] Specifically, the first processing unit transmits the encrypted data packet to the first conversion unit via the first high-speed bus. It is understandable that the first high-speed bus can be PCIE (Peripheral Component Interconnect Express) or USB, etc. The bandwidth of the first high-speed bus can be as high as Gigabit.

[0068] In one embodiment, the first processing unit transmits the encrypted data packet to the first conversion unit via the first high-speed bus, including:

[0069] Encrypted data in different data formats in an encrypted data packet are transmitted using different first channels; and encrypted data in the same data format in an encrypted data packet are transmitted using multiple first channels.

[0070] S140. The first conversion unit converts the encrypted data packet into an optical signal.

[0071] Specifically, the encrypted data packet is converted into an optical signal, usually by combining software with an optoelectronic conversion device. For example, the optoelectronic conversion device may be an optical terminal or an optical fiber transceiver or an optoelectronic conversion device. Figure 2 In the embodiment, the optical fiber TX end is set in the first conversion unit.

[0072] S150. The first conversion unit transmits the optical signal to the second conversion unit through a physically unidirectional single optical fiber; wherein the single optical fiber includes a plurality of second channels.

[0073] Specifically, the bandwidth of a single physically unidirectional optical fiber can be as high as a gigabit.

[0074] A single physically unidirectional optical fiber is used for transmission, and the second conversion unit cannot send information to the first conversion unit.

[0075] The second channel and the first channel can be configured in a corresponding relationship according to actual needs.

[0076] In one embodiment, if the amount of data transmitted on the optical fiber accounts for 50% or less of the bandwidth of the optical fiber;

[0077] The first conversion unit transmits the optical signal to the second conversion unit through a physically unidirectional single optical fiber, including:

[0078] The first conversion unit transmits the optical signal to the second conversion unit through the second channel; the second channel corresponds to the first channel one by one, and the second channel corresponds to the first channel through configuration.

[0079] In another embodiment, if the amount of data transmitted on the optical fiber accounts for more than 50% of the bandwidth of the optical fiber;

[0080] The first conversion unit transmits the optical signal to the second conversion unit through a physically unidirectional single optical fiber, including:

[0081] Under the premise of not exceeding the fiber bandwidth, the first conversion unit selects part of the second channel to transmit the optical signal to the second conversion unit.

[0082] Part of the selected second channels correspond to the first channels one by one, and part of the second channels and the first channels are selected and corresponded through configuration.

[0083] The first channel and the second channel transmit data in a one-to-one correspondence manner, which can ensure to the greatest extent that all transmission data or important transmission data is correctly transmitted to the second conversion unit after the second conversion unit performs data verification, thereby avoiding data loss and data errors during the transmission process.

[0084] In one embodiment, the optical fiber further includes a bandwidth channel for transmitting the corresponding relationship between the first channel and the second channel to the second conversion unit.

[0085] S160: The second conversion unit checks the received optical signal according to the check bit.

[0086] In one embodiment, the second conversion unit checks the received optical signal according to the check bit, including:

[0087] If the second conversion unit verifies that any optical signal of any second channel is wrong according to the check bit, then the corresponding relationship between the first channel and the second channel is read;

[0088] If the second channel with verification error has a corresponding first channel, the optical signal of the packet number corresponding to the first channel is verified. If the verification passes, the optical signal of the packet number corresponding to the first channel is copied to the second channel with verification error.

[0089] By verifying the received optical signal, the accuracy of the transmitted data can be ensured to the greatest extent in the case of a one-way non-retransmission confirmation mechanism.

[0090] S170. The second conversion unit converts the verified optical signal into an encrypted data packet.

[0091] Specifically, the optical signal is converted into an encrypted data packet, usually by combining software with an optoelectronic conversion device. For example, the optoelectronic conversion device may be an optical terminal or an optical fiber transceiver or an optoelectronic conversion device. Figure 2 In the embodiment, the optical fiber RX end is set in the second conversion unit.

[0092] S180. The second conversion unit sends the encrypted data packet to the second processing unit via the second high-speed bus, where the second high-speed bus includes a plurality of third channels.

[0093] Specifically, the first high-speed bus may be PCIE, or USB, etc. The bandwidth of the first high-speed bus may be as high as 1 Gigabit.

[0094] The third channel corresponds one-to-one to the first channel.

[0095] S190, the second processing unit restores the received encrypted data packet according to the packet sequence number and the check bit to obtain restored data information, including:

[0096] The second processing unit packages the encrypted data packet according to the packet sequence number and the check bit, and converts the packaged data into a second preset format to obtain restored data information, wherein the second preset format is the format required by the second processing unit.

[0097] S1100. The second processing unit transmits the restored data information to the second network.

[0098] Specifically, the second network may be an internal network or an external network, which is selected according to actual needs.

[0099] The one-way transmission security isolation method provided in the embodiment of the present application realizes physical one-way transmission of data through the physical property of one-way transmission of optical fiber, achieves security isolation, and ensures the data accuracy of the one-way non-retransmission confirmation mechanism through high bandwidth, multi-channel mode, data sending through corresponding channels, and verification mechanism.

[0100] The embodiment of the present application realizes high-bandwidth and large-volume data transmission and realizes channel-based transmission of various types of data through the first conversion unit and the second conversion unit.

[0101] like Figure 3 The figure shows a schematic diagram of a typical application scenario one, in which sensor data and other data of the internal network are transmitted to the external network through the one-way transmission security isolation method provided in the embodiment of the present application. The external network can monitor some status and data of the internal network equipment in real time, but the external network signaling, control, etc. cannot enter the internal network and will not cause any impact on the internal network.

[0102] like Figure 4 The figure shows a schematic diagram of typical application scenario 2, in which the internal network can obtain data from the external network, but the external network cannot access any data from the internal network, so the privacy and confidentiality of the data in the internal network are well protected.

[0103] Reference Figure 5 , which shows a schematic structural diagram of a one-way transmission safety isolation device described according to an embodiment of the present application.

[0104] like Figure 5As shown, the one-way transmission safety isolation device may include:

[0105] The first processing unit 510 is used to receive data information transmitted through the first network; process the data information to obtain an encrypted data packet, which includes encrypted data and a corresponding packet sequence number and a check bit; and transmit the encrypted data packet to the first conversion unit through a first high-speed bus; wherein the first high-speed bus includes a plurality of first channels;

[0106] The first conversion unit 520 is used to receive the encrypted data packet transmitted by the first processing unit, and convert the encrypted data packet into an optical signal; and transmit the optical signal to the second conversion unit through a single physically unidirectional optical fiber; wherein the optical fiber includes a plurality of second channels;

[0107] The second conversion unit 530 is used to receive the optical signal transmitted by the first conversion unit, and verify the received optical signal according to the check bit; and convert the optical signal that succeeds in the verification into an encrypted data packet; and send the encrypted data packet to the second processing unit through a second high-speed bus, and the second high-speed bus includes a plurality of third channels;

[0108] The second processing unit 540 is used to restore the received encrypted data packet according to the packet sequence number and the check bit to obtain restored data information; and transmit the restored data information to the second network.

[0109] Optionally, the first processing unit 510 is further configured to:

[0110] Converting the data information into a first preset format to obtain encrypted data;

[0111] Unpack the encrypted data to obtain an encrypted data packet.

[0112] Optionally, the first processing unit 510 is further configured to:

[0113] Encrypted data in different data formats in an encrypted data packet are transmitted using different first channels; and encrypted data in the same data format in an encrypted data packet are transmitted using multiple first channels.

[0114] Optional, if the amount of data transmitted on the optical fiber accounts for 50% or less of the optical fiber bandwidth;

[0115] The first conversion unit 520 is further configured to:

[0116] The first conversion unit transmits the optical signal to the second conversion unit through the second channel; the second channel corresponds to the first channel one by one, and the second channel corresponds to the first channel through configuration.

[0117] Optionally, if the amount of data transmitted on the optical fiber accounts for more than 50% of the optical fiber bandwidth;

[0118] The first conversion unit 520 is further configured to:

[0119] Under the premise of not exceeding the fiber bandwidth, the first conversion unit selects part of the second channel to transmit the optical signal to the second conversion unit.

[0120] Part of the selected second channels correspond to the first channels one by one, and part of the second channels and the first channels are selected and corresponded through configuration.

[0121] Optionally, the optical fiber further includes a bandwidth channel, which is used to transmit the corresponding relationship between the first channel and the second channel to the second conversion unit.

[0122] Optionally, the second conversion unit 530 is further configured to:

[0123] If any optical signal of any second channel is found to be wrong according to the check bit, the corresponding relationship between the first channel and the second channel is read;

[0124] If the second channel has a corresponding first channel, the optical signal of the packet number corresponding to the first channel is checked. If the check passes, the optical signal of the packet number corresponding to the first channel is copied to the second channel with an error in the check.

[0125] The one-way transmission safety isolation device provided in this embodiment can execute the embodiment of the above method. Its implementation principle and technical effect are similar and will not be repeated here.

[0126] Figure 6 FIG. 1 is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. Figure 6 As shown, a structural schematic diagram of an electronic device 600 suitable for implementing an embodiment of the present application is shown.

[0127] like Figure 6 As shown, the electronic device 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the device 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0128] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage section 608 as needed.

[0129] In particular, according to the embodiments of the present disclosure, the above reference Figure 1 The described process can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program tangibly contained on a machine-readable medium, and the computer program includes program code for executing the above-mentioned one-way transmission security isolation method. In such an embodiment, the computer program can be downloaded and installed from a network through the communication part 609, and / or installed from a removable medium 611.

[0130] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of the code, and the aforementioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0131] The units or modules involved in the embodiments described in the present application may be implemented by software or hardware. The units or modules described may also be arranged in a processor. The names of these units or modules do not constitute limitations on the units or modules themselves in certain circumstances.

[0132] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop, a mobile phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0133] As another aspect, the present application further provides a storage medium, which may be the storage medium included in the aforementioned device in the above embodiment; or may be a storage medium that exists independently and is not assembled into the device. The storage medium stores one or more programs, and the aforementioned programs are used by one or more processors to execute the one-way transmission security isolation method described in the present application.

[0134] Storage media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0135] It should be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of further restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0136] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

Claims

1. A one-way transmission security isolation method, characterized in that: The method comprises: The first processing unit receives data information transmitted through the first network; The first processing unit processes the data information to obtain an encrypted data packet, wherein the encrypted data packet includes encrypted data and a corresponding packet sequence number and a check bit; The first processing unit transmits the encrypted data packet to the first conversion unit via a first high-speed bus; wherein the first high-speed bus includes a plurality of first channels; The first conversion unit converts the encrypted data packet into an optical signal; The first conversion unit transmits the optical signal to the second conversion unit through a single physically unidirectional optical fiber; wherein the optical fiber includes a plurality of second channels; The second conversion unit checks the received optical signal according to the check bit; The second conversion unit converts the optical signal which has passed the verification into the encrypted data packet; The second conversion unit sends the encrypted data packet to the second processing unit via a second high-speed bus, wherein the second high-speed bus includes a plurality of third channels; The second processing unit performs restoration processing on the received encrypted data packet according to the packet sequence number and the check bit to obtain restored data information; The second processing unit transmits the restored data information to a second network; If the amount of data transmitted on the optical fiber accounts for 50% or less of the optical fiber bandwidth; The first conversion unit transmits the optical signal to the second conversion unit through a physically unidirectional single optical fiber, including: The first conversion unit transmits the optical signal to the second conversion unit through the second channel; the second channel corresponds to the first channel one by one, and the second channel corresponds to the first channel through configuration; If the amount of data transmitted on the optical fiber accounts for more than 50% of the optical fiber bandwidth; The first conversion unit transmits the optical signal to the second conversion unit through a physically unidirectional single optical fiber, including: On the premise of not exceeding the optical fiber bandwidth, the first conversion unit selects part of the second channel to transmit the optical signal to the second conversion unit, Part of the selected second channels corresponds to the first channels one by one, and part of the second channels and the first channels are selected and corresponded through configuration; The optical fiber further comprises a bandwidth channel for transmitting the corresponding relationship between the first channel and the second channel to the second conversion unit; The second conversion unit checks the received optical signal according to the check bit, including: If the second conversion unit verifies according to the check bit that any of the optical signals of any of the second channels is wrong, then reads the corresponding relationship between the first channel and the second channel; If the second channel has a corresponding first channel, the optical signal of the packet number corresponding to the first channel is verified. If the verification passes, the optical signal of the first channel corresponding to the packet number is copied to the second channel with an error in the verification.

2. The one-way transmission safety isolation method according to claim 1, characterized in that: The first processing unit processes the data information to obtain an encrypted data packet, including: The first processing unit converts the data information into a first preset format to obtain encrypted data; The first processing unit unpacks the encrypted data to obtain the encrypted data packet.

3. The one-way transmission safety isolation method according to claim 1, characterized in that: The first processing unit transmits the encrypted data packet to the first conversion unit through the first high-speed bus, including: The encrypted data in different data formats in the encrypted data packet are transmitted using different first channels; and the encrypted data in the same data format in the encrypted data packet are transmitted using multiple first channels.

4. A one-way transmission safety isolation device, characterized in that: The device comprises: A first processing unit is configured to receive data information transmitted through a first network; process the data information to obtain an encrypted data packet, wherein the encrypted data packet includes encrypted data and a corresponding packet sequence number and a check bit; and transmit the encrypted data packet to a first conversion unit through a first high-speed bus; wherein the first high-speed bus includes a plurality of first channels; A first conversion unit, configured to receive the encrypted data packet transmitted by the first processing unit, and convert the encrypted data packet into an optical signal; and transmit the optical signal to a second conversion unit through a physically unidirectional single optical fiber; wherein the optical fiber includes a plurality of second channels; a second conversion unit, configured to receive the optical signal transmitted by the first conversion unit, and verify the received optical signal according to the check bit; and convert the optical signal which succeeds in the verification into the encrypted data packet; and send the encrypted data packet to the second processing unit via a second high-speed bus, wherein the second high-speed bus includes a plurality of third channels; A second processing unit is used to restore the received encrypted data packet according to the packet sequence number and the check bit to obtain restored data information; and transmit the restored data information to a second network; If the amount of data transmitted on the optical fiber accounts for 50% or less of the optical fiber bandwidth; The first conversion unit is also used for: The first conversion unit transmits the optical signal to the second conversion unit through the second channel; the second channel corresponds to the first channel one by one, and the second channel corresponds to the first channel through configuration; If the amount of data transmitted on the optical fiber accounts for more than 50% of the optical fiber bandwidth; The first conversion unit is also used for: Under the premise of not exceeding the fiber bandwidth, the first conversion unit selects part of the second channel to transmit the optical signal to the second conversion unit. Wherein, the selected part of the second channels corresponds to the first channels one by one, and the part of the second channels and the first channels are selected and corresponded through configuration; The optical fiber also includes a bandwidth channel for transmitting the corresponding relationship between the first channel and the second channel to the second conversion unit; The second conversion unit is also used for: If any optical signal of any second channel is found to be wrong according to the check bit, the corresponding relationship between the first channel and the second channel is read; If the second channel has a corresponding first channel, the optical signal of the packet number corresponding to the first channel is checked. If the check passes, the optical signal of the packet number corresponding to the first channel is copied to the second channel with an error in the check.

5. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the one-way transmission security isolation method as described in any one of claims 1-3 is implemented.

6. A readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the one-way transmission security isolation method as described in any one of claims 1 to 3 is implemented.

Images