Device violation detection method, system and medium based on unidirectional isolation transmission system

Abstract

The present application discloses a device violation detection method, system and medium based on a one-way isolated transmission system, which mainly relates to the field of device violation detection technology, and is used to solve the problem that the existing device violation detection method requires precise control and deployment of compliant devices, involves a large maintenance workload, or requires the device to access a specific monitored network, and has a small detection coverage of the device. It includes: obtaining external network asset information and internal network asset information through a one-way isolated transmission system; obtaining external area asset information of the area corresponding to the current external network client through an external asset acquisition agent component; obtaining internal area asset information of the area corresponding to the current internal network client through an internal asset acquisition agent component; and determining whether there is a violation in the external network or the internal network based on overlapping asset information.

Description

Technical Field

[0001] The present application relates to the technical field of device violation detection, and in particular to a device violation detection method, system and medium based on a unidirectional isolation transmission system. Background Art

[0002] Important network areas are often physically isolated to ensure network security. To prevent unauthorized access to network devices and computing service terminals without security measures in such important network areas, network access control is required in important network areas to detect and discover such illegal access to network devices and terminals. At the same time, illegal external connection detection programs are installed on computing service terminals in important network areas to prevent them from leaving the important network and illegally accessing external networks.

[0003] Existing methods for detecting equipment violations include: (1) access control of network equipment and computing service terminals in important network areas, and compliance control of basic equipment access. Specifically, it relies on precise control of network equipment (such as switches) in important network areas. However, this method involves a large amount of deployment and maintenance work, and requires knowing the address identification information corresponding to all compliant devices in the important network in advance. (2) Install a violation external connection detection program on the computing service terminal in the important network area. When this device is connected to a specific monitored network (such as the Internet), it can be sensed in time, but if it is connected to a non-monitored network, it cannot be effectively covered.

[0004] Therefore, there is an urgent need for a device violation detection method, system and medium based on a unidirectional isolation transmission system to solve the above technical problems. Summary of the invention

[0005] In response to the above-mentioned deficiencies in the prior art, the present application provides a device violation detection method, system and medium based on a unidirectional isolation transmission system to solve the problem that the existing device violation detection method requires precise control and deployment of compliant devices, involving a large maintenance workload, or requires the device to be connected to a specific monitored network, resulting in a small detection coverage of the device.

[0006] In a first aspect, the present application provides a device violation detection method based on a unidirectional isolated transmission system, the method comprising: setting an external network asset collection component, an internal asset collection component and an asset comparison component in a unidirectional isolated transmission system connected to both an internal network and an external network; obtaining external network asset information through the external network asset collection component; obtaining internal network asset information through the internal asset collection component; adding an external asset collection agent component to an external network client corresponding to the external network, and obtaining external area asset information of an area corresponding to the current external network client through the external asset collection agent component; adding an internal asset collection agent component to an internal network client corresponding to the internal network, and obtaining internal area asset information of an area corresponding to the current internal network client through the internal asset collection agent component; obtaining new external network asset information that has not been collected by the external network asset collection component from the external area asset information through the asset comparison component, and adding it to the external network asset information, and obtaining new internal network asset information that has not been collected by the internal network asset collection component from the internal area asset information, and adding it to the internal network asset information; determining overlapping asset information between the external network asset information and the internal network asset information; and determining whether there is a violation in the external network or the internal network based on the overlapping asset information.

[0007] Furthermore, the external area asset information is: the external network asset information obtained through the neighbor discovery function or the asset detection function; the internal area asset information is: the internal network asset information obtained through the neighbor discovery function or the asset detection function.

[0008] Furthermore, external network asset information that has not been collected by the external network asset collection component is obtained from the external area asset information, specifically including: performing pairwise comparison between the external area asset information and the external network asset information collected by the external network asset collection component, obtaining the external area asset information that does not exist in the external network asset information, and then obtaining the external network asset information that has not been collected by the external network asset collection component.

[0009] Furthermore, intranet asset information that is not collected by the intranet asset collection component is obtained from the internal area asset information, specifically including: pairwise comparison of the internal area asset information with the intranet asset information collected by the internal asset collection component to obtain the internal area asset information that does not exist in the intranet asset information, and then obtain the intranet asset information that is not collected by the intranet asset collection component.

[0010] Furthermore, based on the overlapping asset information, determine whether there is any violation in the external network or the internal network, specifically including: determining whether the overlapping asset information belongs to the preset authorized intranet assets; when the overlapping asset information does not belong to the preset authorized intranet assets, determining that there is a violation in the external network accessing the intranet network; when the overlapping asset information belongs to the preset authorized intranet assets, determining that there is an illegal external connection in the internal network.

[0011] Furthermore, based on the overlapping asset information, it is determined whether there is any violation in the external network or the internal network, which specifically includes: determining whether the overlapping asset information exists in a preset legal intranet node; when the overlapping asset information exists in a preset legal intranet node, it is determined that there is an illegal external connection of the intranet network through a network flying line.

[0012] In the second aspect, the present application provides an equipment violation detection system based on a one-way isolated transmission system, the system comprising: an external network asset collection component, arranged in a one-way isolated transmission system that can be connected to an internal network and an external network at the same time, for obtaining external network asset information; an internal network asset collection component, arranged in a one-way isolated transmission system, for obtaining internal network asset information; an external asset collection proxy component, arranged in an external network client corresponding to the external network, for obtaining external area asset information of an area corresponding to the current external network client; an internal asset collection proxy component, arranged in an internal network client corresponding to the internal network, for obtaining internal area asset information of an area corresponding to the current internal network client; an asset comparison component, arranged in a one-way isolated transmission system, for obtaining newly added external network asset information that has not been collected by the external network asset collection component from the external area asset information, and adding it to the external network asset information, and obtaining newly added internal network asset information that has not been collected by the internal network asset collection component from the internal area asset information, and adding it to the internal network asset information; determining overlapping asset information between the external network asset information and the internal network asset information; and determining whether there is a violation in the external network or the internal network based on the overlapping asset information.

[0013] Furthermore, the asset comparison component includes a first comparison unit, which is used to determine whether the overlapping asset information belongs to the preset authorized intranet assets; when the overlapping asset information does not belong to the preset authorized intranet assets, it is determined that there is an illegal phenomenon of the external network illegally accessing the intranet network; when the overlapping asset information belongs to the preset authorized intranet assets, it is determined that there is an illegal external connection phenomenon in the internal network.

[0014] Furthermore, the asset comparison component includes a second comparison unit, which is used to determine whether overlapping asset information exists in a preset legal intranet node; when the overlapping asset information exists in the preset legal intranet node, it is determined that there is an illegal external connection of the intranet network through a network flying line.

[0015] In a third aspect, the present application provides a non-volatile computer storage medium having computer instructions stored thereon, which, when executed, implement a device violation detection method based on a unidirectional isolation transmission system as described above.

[0016] Those skilled in the art can understand that the present application has at least the following beneficial effects:

[0017] By comparing the asset information of the internal and external networks, the potential overlapping asset information can be found. It is not necessary to know the list of all the internal network asset information in advance. The illegal access can be monitored from the perspective of asset behavior. The implementation and deployment are simple, and the security risk detection capability of the data isolation transmission system is enhanced. Based on the overlapping asset information, it is possible to detect whether there are violations in the external network or the internal network (for example, the illegal entry of the external network device into the internal network, the illegal access of the internal network device to the external network, and the illegal direct connection of the internal network and the external network through the physical isolation network). It solves the problem that the existing equipment violation detection method requires precise control and deployment of compliant equipment, and the maintenance workload involved is large. In addition, the present application obtains the external area asset information of the area corresponding to the current external network client through the external asset collection agent component, thereby expanding the coverage of the external network asset collection; obtains the internal area asset information of the area corresponding to the current internal network client through the internal asset collection agent component, thereby expanding the coverage of the internal network asset collection. It solves the problem that the existing solution requires the device to access a specific monitored network, and the detection coverage of the device is small. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Some embodiments of the present disclosure are described below with reference to the accompanying drawings, in which:

[0019] Figure 1 This is a flow chart of a device violation detection method based on a unidirectional isolated transmission system provided in an embodiment of the present application.

[0020] Figure 2 This is a schematic diagram of obtaining intranet asset information that is not collected by the intranet asset collection component, provided in an embodiment of the present application.

[0021] Figure 3 This is a schematic diagram of equipment violation phenomenon based on overlapping asset information provided in an embodiment of the present application.

[0022] Figure 4 It is a schematic diagram of equipment flying wire violation phenomenon based on overlapping asset information provided in an embodiment of the present application.

[0023] Figure 5 It is a schematic diagram of the internal structure of a device violation detection system based on a unidirectional isolation transmission system provided in an embodiment of the present application.

[0024] Description of reference numerals:

[0025] 200, one-way isolated transmission system; 210, external network asset collection component; 220, internal network asset collection component; 230, asset comparison component; 300, external network; 310, external asset collection agent component; 400, internal network; 410, internal asset collection agent component. DETAILED DESCRIPTION

[0026] It should be understood by those skilled in the art that the embodiments described below are only preferred embodiments of the present disclosure, and do not mean that the present disclosure can only be implemented through the preferred embodiments. The preferred embodiments are only used to explain the technical principles of the present disclosure, and are not used to limit the protection scope of the present disclosure. Based on the preferred embodiments provided by the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work should still fall within the protection scope of the present disclosure.

[0027] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0028] The technical solution proposed in the embodiments of the present application is described in detail below with reference to the accompanying drawings.

[0029] The present application embodiment provides a device violation detection method based on a unidirectional isolation transmission system, such as Figure 1 As shown, the method provided in the embodiment of the present application mainly includes the following steps:

[0030] Step 110: an external network asset collection component, an internal asset collection component and an asset comparison component are set in a one-way isolated transmission system connected to both the internal network and the external network; external network asset information is obtained through the external network asset collection component; and internal network asset information is obtained through the internal asset collection component.

[0031] It should be noted that the external network asset information can specifically include: the IP address of the device connected to the external network, the data information uploaded to the one-way isolated transmission system, etc. The internal network asset information can specifically include: the IP address of the device connected to the internal network, the data information of the device on the internal network, etc.

[0032] Since the one-way isolated transmission system can be connected to the internal network and the external network at the same time, the one-way isolated transmission system can obtain the above-mentioned external network asset information and internal network asset information. The external network asset collection component, the internal asset collection component and the asset comparison component can be specifically a program for data collection or comparison.

[0033] Step 120: Add an external asset acquisition agent component to the external client corresponding to the external network, and obtain the external area asset information of the area corresponding to the current external client through the external asset acquisition agent component.

[0034] It should be noted that the external area asset information is: the external network asset information obtained through the neighbor discovery function or the asset detection function, for example, the neighbor device IP address, etc. The external asset collection agent component can be specifically a neighbor discovery component. Using the external asset collection agent component as an observation point to discover the surrounding asset information and neighbor information can expand the coverage of external network asset collection.

[0035] Step 130: Add an internal asset collection agent component to the intranet client corresponding to the internal network, and obtain the internal area asset information of the area corresponding to the current intranet client through the internal asset collection agent component.

[0036] It should be noted that the internal area asset information is: the intranet asset information obtained through the neighbor discovery function or the asset detection function, for example, the neighbor device IP address, etc. The internal asset collection agent component can be specifically a neighbor discovery component. Using the internal asset collection agent component as an observation point to discover the surrounding asset information and neighbor information can expand the coverage of intranet asset collection.

[0037] Step 140: Obtain new external network asset information that has not been collected by the external network asset collection component from the external area asset information through the asset comparison component, and add it to the external network asset information; obtain new internal network asset information that has not been collected by the internal network asset collection component from the internal area asset information, and add it to the internal network asset information; determine the overlapping asset information between the external network asset information and the internal network asset information; and determine whether there is any violation in the external network or the internal network based on the overlapping asset information.

[0038] In the step, the external network asset information that is not collected by the external network asset collection component is obtained from the external area asset information, which can be specifically:

[0039] The external area asset information is compared with the external network asset information collected by the external network asset collection component, and the external area asset information that does not exist in the external network asset information is obtained, and then the external network asset information that is not collected by the external network asset collection component is obtained.

[0040] In the step, the intranet asset information that is not collected by the intranet asset collection component is obtained from the internal area asset information, which can be specifically:

[0041] The internal area asset information is compared with the intranet asset information collected by the internal asset collection component in pairs to obtain the internal area asset information that does not exist in the intranet asset information, and then obtain the intranet asset information that has not been collected by the intranet asset collection component.

[0042] The above-mentioned intranet asset information obtained from the internal area asset information that is not collected by the intranet asset collection component can be further specifically as follows: Figure 2 As shown:

[0043] Inside the network, asset nodes 1, 2, 4, 6, 7, and 8 can be detected by the one-way data isolation transmission system, or the one-way data isolation transmission system client is deployed. Through the one-way data isolation transmission system client, node 3, which was not detected in the network, is detected by nodes 1 and 2 (the internal area asset information obtains the intranet asset information that is not collected by the intranet asset collection component: node 3), and the data is reported to the one-way data isolation transmission system asset collection unit for comparison of intranet and intranet assets.

[0044] In the step, based on the overlapping asset information, it is determined whether there is any violation in the external network or the internal network, which can be specifically:

[0045] Determine whether the overlapping asset information belongs to the preset authorized intranet assets; when the overlapping asset information does not belong to the preset authorized intranet assets, determine that there is an illegal external network access to the intranet network; when the overlapping asset information belongs to the preset authorized intranet assets, determine that there is an illegal external connection in the internal network.

[0046] More specifically, if Figure 3 As shown:

[0047] If asset ① does not belong to the preset authorized intranet assets, but is found to exist on the intranet through the comparison between intranet and intranet assets, it is considered illegal access to the intranet. If asset ① belongs to the preset authorized intranet assets, but is found to appear on the extranet through the comparison between intranet and intranet assets, it is considered illegal external connection.

[0048] In the step, based on the overlapping asset information, it is determined whether there is any violation in the external network or the internal network, which may be specifically:

[0049] Determine whether overlapping asset information exists in the preset legal intranet node; when overlapping asset information exists in the preset legal intranet node, determine that there is an illegal external connection of the intranet network through network flying lines.

[0050] More specifically, if Figure 4 As shown:

[0051] If the intranet and extranet break through the physical isolation restrictions and there are illegal network flying lines, the asset neighbor nodes A, B, and C are discovered and collected through the data one-way isolation transmission system and its client, and reported to the asset collection and synchronization unit of the data one-way isolation transmission system. Then, through asset comparison on the intranet side of the data one-way isolation transmission system, it is discovered that the intranet assets are illegally connected to the outside through network flying lines.

[0052] besides, Figure 5 The present application provides an equipment violation detection system based on a one-way isolated transmission system. Figure 5As shown, the system provided in the embodiment of the present application mainly includes:

[0053] The external network asset collection component 210 is arranged in the one-way isolation transmission system 200 which can be connected to the internal network 400 and the external network 300 at the same time, and is used to obtain the external network asset information.

[0054] The intranet asset collection component 220 is arranged in the one-way isolated transmission system 200 and is used to obtain the intranet asset information.

[0055] The external asset acquisition agent component 310 is set in the external network client corresponding to the external network 300, and is used to obtain the external area asset information of the area corresponding to the current external network client.

[0056] The internal asset collection agent component 410 is set in the internal network client corresponding to the internal network 400, and is used to obtain the internal area asset information of the area corresponding to the current internal network client.

[0057] The asset comparison component 230 is arranged in the one-way isolation transmission system 200, and is used to obtain the newly added external network asset information that has not been collected by the external network asset collection component 210 from the external area asset information, and add it to the external network asset information; obtain the newly added internal network asset information that has not been collected by the internal network asset collection component 220 from the internal area asset information, and add it to the internal network asset information; determine the overlapping asset information between the external network asset information and the internal network asset information; based on the overlapping asset information, determine whether there is any violation in the external network 300 or the internal network 400.

[0058] The asset comparison component 230 includes a first comparison unit, which is used to determine whether the overlapping asset information belongs to the preset authorized intranet assets; when the overlapping asset information does not belong to the preset authorized intranet assets, it is determined that the external network 300 has illegally accessed the intranet network; when the overlapping asset information belongs to the preset authorized intranet assets, it is determined that the internal network 400 has illegally connected to the outside world.

[0059] The asset comparison component 230 includes a second comparison unit, which is used to determine whether the overlapping asset information exists in the preset legal intranet node; when the overlapping asset information exists in the preset legal intranet node, it is determined that there is an illegal external connection phenomenon of the intranet network through the network flying line.

[0060] In addition, an embodiment of the present application further provides a non-volatile computer storage medium on which executable instructions are stored. When the executable instructions are executed, a device violation detection method based on a unidirectional isolation transmission system as described above is implemented.

[0061] So far, the technical solutions of the present disclosure have been described in combination with the above multiple embodiments, but it is easy for those skilled in the art to understand that the protection scope of the present disclosure is not limited to these specific embodiments. Without departing from the technical principles of the present disclosure, those skilled in the art can split and combine the technical solutions in the above-mentioned various embodiments, and can also make equivalent changes or replacements to the relevant technical features. Any changes, equivalent replacements, improvements, etc. made within the technical concept and / or technical principle of the present disclosure will fall within the protection scope of the present disclosure.

Claims

1. A device violation detection method based on a unidirectional isolation transmission system, characterized in that: The method comprises: An external network asset collection component, an internal asset collection component, and an asset comparison component are set in a one-way isolated transmission system connected to both the internal network and the external network; external network asset information is obtained through the external network asset collection component; and internal network asset information is obtained through the internal asset collection component. Add an external asset collection agent component to the external client corresponding to the external network, and obtain the external area asset information of the area corresponding to the current external client through the external asset collection agent component; Add an internal asset collection agent component to the intranet client corresponding to the internal network, and obtain the internal area asset information of the area corresponding to the current intranet client through the internal asset collection agent component; Through the asset comparison component, the newly added external network asset information that has not been collected by the external network asset collection component is obtained from the external area asset information and added to the external network asset information; Wherein, obtaining the external network asset information that is not collected by the external network asset collection component from the external region asset information specifically includes: performing a pairwise comparison between the external region asset information and the external network asset information collected by the external network asset collection component, obtaining the external region asset information that is not present in the external network asset information, and then obtaining the external network asset information that is not collected by the external network asset collection component; Obtain new intranet asset information that is not collected by the intranet asset collection component from the internal area asset information, and add it to the intranet asset information; The intranet asset information that is not collected by the intranet asset collection component is obtained from the internal area asset information, specifically including: Compare the internal area asset information with the intranet asset information collected by the internal asset collection component, obtain the internal area asset information that does not exist in the intranet asset information, and then obtain the intranet asset information that is not collected by the intranet asset collection component; Determine the overlapping asset information between the external network asset information and the internal network asset information; based on the overlapping asset information, determine whether there is any violation in the external network or the internal network.

2. The device violation detection method based on the one-way isolation transmission system according to claim 1 is characterized in that: External area asset information is: external network asset information obtained through neighbor discovery function or asset detection function; Internal area asset information refers to intranet asset information obtained through the neighbor discovery function or the asset detection function.

3. The device violation detection method based on the one-way isolation transmission system according to claim 1 is characterized in that: Based on the overlapping asset information, determine whether there are any violations in the external network or the internal network, including: Determine whether the overlapping asset information belongs to the preset authorized intranet assets; When the overlapping asset information does not belong to the preset authorized intranet assets, it is determined that there is a violation of the external network's illegal access to the intranet network; When the overlapping asset information belongs to the preset authorized intranet assets, it is determined that there is illegal external connection in the internal network.

4. The device violation detection method based on the one-way isolation transmission system according to claim 1 is characterized in that: Based on the overlapping asset information, determine whether there are any violations in the external network or the internal network, including: Determine whether the overlapping asset information exists in the preset legal intranet node; When overlapping asset information exists in the preset legal intranet node, it is determined that the intranet network is illegally connected to the outside through the network flying line.

5. A device violation detection system based on a one-way isolation transmission system, characterized in that: The system comprises: The external network asset collection component is set in a one-way isolated transmission system that can be connected to the internal network and the external network at the same time, and is used to obtain the external network asset information; The intranet asset collection component is set in the one-way isolated transmission system to obtain intranet asset information; The external asset acquisition agent component is set in the external network client corresponding to the external network, and is used to obtain the external area asset information of the area corresponding to the current external network client; The internal asset collection agent component is set in the intranet client corresponding to the internal network, and is used to obtain the internal area asset information of the area corresponding to the current intranet client; The asset comparison component is set in the one-way isolated transmission system, and is used to obtain the newly added external network asset information that has not been collected by the external network asset collection component from the external area asset information, and add it to the external network asset information; obtain the newly added internal network asset information that has not been collected by the internal network asset collection component from the internal area asset information, and add it to the internal network asset information; determine the overlapping asset information between the external network asset information and the internal network asset information; based on the overlapping asset information, determine whether there is a violation of the external network or the internal network; Wherein, obtaining the external network asset information that is not collected by the external network asset collection component from the external region asset information specifically includes: performing a pairwise comparison between the external region asset information and the external network asset information collected by the external network asset collection component, obtaining the external region asset information that is not present in the external network asset information, and then obtaining the external network asset information that is not collected by the external network asset collection component; The intranet asset information that is not collected by the intranet asset collection component is obtained from the internal area asset information, specifically including: The internal area asset information is compared with the intranet asset information collected by the internal asset collection component in pairs to obtain the internal area asset information that does not exist in the intranet asset information, and then obtain the intranet asset information that has not been collected by the intranet asset collection component.

6. The device violation detection system based on the one-way isolation transmission system according to claim 5 is characterized in that: The asset comparison component includes a first comparison unit, Used to determine whether the overlapping asset information belongs to the preset authorized intranet assets; When the overlapping asset information does not belong to the preset authorized intranet assets, it is determined that there is a violation of the external network's illegal access to the intranet network; When the overlapping asset information belongs to the preset authorized intranet assets, it is determined that there is illegal external connection in the internal network.

7. The device violation detection system based on the one-way isolation transmission system according to claim 5 is characterized in that: The asset comparison component includes a second comparison unit, Used to determine whether overlapping asset information exists in the preset legal intranet node; When overlapping asset information exists in the preset legal intranet node, it is determined that the intranet network is illegally connected to the outside world through network flying lines.

8. A non-volatile computer storage medium, characterized in that: Computer instructions are stored thereon, and when the computer instructions are executed, the method for detecting device violations based on a unidirectional isolated transmission system as described in any one of claims 1 to 4 is implemented.

Images