A Three-Network Domain Unidirectional Data Import System and Method

Abstract

A three-network domain unidirectional data import system and method proposed by the present invention belong to the technical field of data transmission. The method includes: cascadingly configuring a first unidirectional data import device and a second unidirectional data import device to achieve cascading docking of the first unidirectional data import device and the second unidirectional data import device at the same network domain level; performing cascading negotiation between the first unidirectional data import device and the second unidirectional data import device by sending and responding to a cascading request message in a preset format; after completing the cascading negotiation, generating a cascading forwarding rule; performing cascading forwarding of service data according to the cascading forwarding rule; and receiving the cascading-forwarded service data in real time through the first unidirectional data import device and the second unidirectional data import device. The present invention realizes the cascading unidirectional import ability of the three-network domain by expanding the support for the cascading protocol and function of the unidirectional transmission system on the basis of the dual-network domain unidirectional import system.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and more specifically, to a three-network-domain unidirectional data import system and method. Background Art

[0002] At present, in order to ensure the security of network data, physical isolation is often carried out in important network areas to ensure network security. Usually, a unidirectional data transmission system is used for physical isolation, that is, the unidirectional data transmission system is applied to the scenario of transmitting data from a network domain with a low security level to a network domain with a high security level. Since such a system can strictly restrict information transmission in one direction and there is no reverse data transmission, while completing data transmission, the reliable security isolation of the high-security-level network domain is ensured. Therefore, the scenarios where unidirectional data transmission systems are commonly applied include industrial control, finance, protection of important critical infrastructure, and other fields.

[0003] When a unidirectional data transmission system performs unidirectional data transmission, it is usually used to send the transmission source data in a network domain with a low security level to the destination end in a network domain with a high security level. However, if there are three or more security-level network domains in the application scenario and data needs to be transmitted from a network domain with a low security level to a network domain with a high security level, the networking deployment method based on the traditional unidirectional data transmission system cannot well meet the transmission convenience. Two sets of unidirectional transmission systems need to be separately deployed and used, and manual participation in data transmission is required.

[0004] Specifically, when deploying a unidirectional data import system between three security domains, multiple unidirectional data transmission systems need to be separately deployed between the network domains. Just using two sets of unidirectional data transmission systems cannot directly connect and transmit data, and it is necessary to rely on manual or third-party programs to cooperate to complete data transfer, resulting in low efficiency. Summary of the Invention

[0005] Aiming at the above problems, the purpose of the present invention is to provide a three-network-domain unidirectional data import system and method. By expanding the cascading protocol and function of the unidirectional transmission system on the basis of the two-network-domain unidirectional import system, the three-network-domain cascading unidirectional import ability is realized.

[0006] To achieve the above object, the present invention is realized through the following technical solutions: A three-network-domain unidirectional data import system includes: a first unidirectional data import device and a second unidirectional data import device, and the first unidirectional data import device and the second unidirectional data import device are cascaded and docked in the same network domain; both the first unidirectional data import device and the second unidirectional data import device are provided with a first network domain unit and a second network domain unit, and the first network domain unit and the second network domain unit are data-connected through a unidirectional transmission channel;

[0007] The first network domain unit of the first one-way data import device is set in the L network domain, used for data interaction in the L network domain, and sending the data in the L network domain to the second network domain unit of the first one-way data import device through a one-way transmission channel;

[0008] The second network domain unit of the first one-way data import device is set in the M network domain, used for data interaction in the M network domain, and sending the data in the L network domain or the data in the M network domain to the first network domain unit of the second one-way data import device;

[0009] The first network domain unit of the second one-way data import device is set in the M network domain, and the first network domain unit of the second one-way data import device is cascaded and docked with the second network domain unit of the first one-way data import device, used for data interaction in the M network domain, and sending the data in the M network domain or the data sent by the second network domain unit of the first one-way data import device to the second network domain unit of the second one-way data import device through a one-way transmission channel;

[0010] The second network domain unit of the second one-way data import device is set in the H network domain, used for data interaction in the H network domain, and obtaining the data sent by the second network domain unit of the second one-way data import device.

[0011] Furthermore, a management module is provided in both the first network domain unit and the second network domain unit;

[0012] The management module is used to enable the cascading function by configuring cascading logical domain tags and enabling cascading protocols.

[0013] Furthermore, a network module is provided in both the first network domain unit and the second network domain unit;

[0014] The network module is used to perform cascading negotiation, generate cascading forwarding rules, and perform cascading forwarding of service data after the management module enables the cascading function.

[0015] Correspondingly, the present invention also discloses a three-network-domain one-way data import method, including the following steps:

[0016] S1: Perform cascading configuration on the first one-way data import device and the second one-way data import device to achieve cascading docking of the first one-way data import device and the second one-way data import device in the same network domain;

[0017] S2: Perform cascading negotiation on the first one-way data import device and the second one-way data import device by sending and responding to cascading request messages in a preset format;

[0018] S3: After completing cascading negotiation, generate cascading forwarding rules;

[0019] S4: Perform cascading forwarding of service data according to the cascading forwarding rules;

[0020] S5: Receive the service data cascaded and forwarded in real time through the first unidirectional data import device and the second unidirectional data import device.

[0021] Further, step S1 includes:

[0022] In the management module of the second network domain unit of the first unidirectional data import device, enter the built-in network interface configuration interface; configure the cascade logical domain label Y through the command domain cascade label Y, and enable the cascade protocol through the command cascadeenable;

[0023] In the management module of the first network domain unit of the second unidirectional data import device, enter the built-in network interface configuration interface; configure the cascade logical domain label Y through the command domain cascade label Y, and enable the cascade protocol through the command cascadeenable.

[0024] Further, the cascading request message in the preset format includes an Ethernet data frame, and a 4-byte cascading domain field is provided before the TYPE field of the Ethernet data frame;

[0025] The cascading domain field includes a TPID field, a Reserve field, and an LID field;

[0026] The defined value of the TPID field is 0x88FF, and the defined value of the LID field is the domain label Y.

[0027] Further, the step S2 includes:

[0028] The network module of the second network domain unit of the first unidirectional data import device and the network module of the first network domain unit of the second unidirectional data import device complete the cascading negotiation of the first unidirectional data import device and the second unidirectional data import device by sending and responding to the cascading request message in the preset format.

[0029] Further, the step S3 includes:

[0030] After completing the cascading negotiation, the network module of the second network domain unit of the first unidirectional data import device or the network module of the first network domain unit of the second unidirectional data import device generates a forwarding table;

[0031] The forwarding table records the domain label and the MAC address of the cascading docking end, and their corresponding relationships.

[0032] Further, the step S4 includes:

[0033] When the network module of the second domain unit of the first one-way data import device or the network module of the first domain unit of the second one-way data import device receives service data with a domain label of Y, it queries the forwarding table according to the domain label. If the MAC address corresponding to the domain label is matched, the service data packet is unicast and sent using this MAC address.

[0034] Further, step S5 includes:

[0035] After the network module of the second domain unit of the first one-way data import device or the network module of the first domain unit of the second one-way data import device receives a service data packet with its own MAC address, it restores the service data in the protocol layer and forwards the service data.

[0036] Compared with the prior art, the beneficial effects of the present invention are as follows: The present invention discloses a three-domain one-way data import system and method, which realizes the formation of a three-domain one-way data import system by cascading two one-way data import devices, effectively expands the multi-domain support ability of the cascaded one-way data import devices, and can directly transmit multi-domain data without relying on manual or third-party program data transfer, with high scalability.

[0037] Through the device cascading method, the present invention can realize the one-way transmission of service data in three different domains only by using two one-way data import devices. Among them, the first one-way data import device can directly send service data to the second one-way data import device. The L domain can unidirectionally transmit service data to the M domain, and the L domain can also unidirectionally transmit service data to the H domain, greatly improving the scenario support ability for one-way data transmission between isolated networks.

[0038] It can be seen that compared with the prior art, the present invention has prominent substantive features and significant progress, and the beneficial effects of its implementation are also obvious. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the following drawings are only the embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained according to the provided drawings without creative efforts.

[0040] Figure 1 It is the system schematic diagram of the specific implementation manner of the present invention.

[0041] Figure 2 It is the method flow structure diagram of the specific implementation manner of the present invention.

[0042] Figure 3It is a schematic structural diagram of a cascade request message in a specific embodiment of the present invention.

[0043] In the figure, 1 is the first unidirectional data import device; 2 is the second unidirectional data import device; 3 is the first network domain unit; 4 is the second network domain unit; 5 is the unidirectional transmission channel; 6 is the management module; 7 is the network module. Specific Embodiment

[0044] In order to enable those skilled in the art of this technology to better understand the solution of the present invention, the present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without making creative efforts shall fall within the protection scope of the present invention.

[0045] See Figure 1 As shown, this embodiment provides a three-network-domain unidirectional data import system, including: the first unidirectional data import device 1 and the second unidirectional data import device 2, and the first unidirectional data import device 1 and the second unidirectional data import device 2 are cascaded and docked at the same network domain level; both the first unidirectional data import device 1 and the second unidirectional data import device 2 are provided with a first network domain unit 3 and a second network domain unit 4, and the first network domain unit 3 and the second network domain unit 4 are connected by a unidirectional transmission channel 5 for data.

[0046] Specifically, the first network domain unit 3 of the first unidirectional data import device 1 is set in the L network domain, used for data interaction in the L network domain, and sends the data of the L network domain to the second network domain unit 4 of the first unidirectional data import device 1 through the unidirectional transmission channel 5. The second network domain unit 4 of the first unidirectional data import device 1 is set in the M network domain, used for data interaction in the M network domain, and sends the data of the L network domain or the data of the M network domain to the first network domain unit 3 of the second unidirectional data import device 2.

[0047] The first network domain unit 3 of the second unidirectional data import device 2 is set in the M network domain, and the first network domain unit 3 of the second unidirectional data import device 2 is cascaded and docked with the second network domain unit 4 of the first unidirectional data import device 1, used for data interaction in the M network domain, and sends the data of the M network domain or the data sent by the second network domain unit 4 of the first unidirectional data import device 1 to the second network domain unit 4 of the second unidirectional data import device 2 through the unidirectional transmission channel 5. The second network domain unit 4 of the second unidirectional data import device 2 is set in the H network domain, used for data interaction in the H network domain, and obtains the data sent by the second network domain unit 4 of the second unidirectional data import device 2.

[0048] It should be particularly noted that the security level of the M network domain is greater than that of the L network domain, and the security level of the H network domain is greater than that of the M network domain.

[0049] In the specific implementation, the first network domain unit 3 and the second network domain unit 4 adopt the same functional architecture, both of which are provided with a management module 6 and a network module 7.

[0050] The management module 6 is used to enable the cascading function by configuring the cascading logical domain label and enabling the cascading protocol.

[0051] The network module 7 is used to perform cascading negotiation, generate cascading forwarding rules, and perform cascading forwarding of service data after the management module 6 enables the cascading function.

[0052] It can be seen that the present invention uses two dual-network domain unidirectional data import devices to form a three-network domain unidirectional data import system through a cascading method. Among them, the network module 7 in the M network domain of the first unidirectional data import device 1 is directly connected to the network module 7 in the M network domain of the second unidirectional data import device 2, and the unidirectional transmission cascading protocol is respectively configured and enabled. The two unidirectional data import devices automatically perform docking negotiation, automatically complete the configuration of the domain unit network module, and form a three-network domain unidirectional data import system.

[0053] See Figure 2 As shown, based on the above system architecture, the present invention also discloses a three-network domain unidirectional data import method, including the following steps:

[0054] S1: Perform cascading configuration on the first unidirectional data import device and the second unidirectional data import device to achieve cascading docking of the first unidirectional data import device and the second unidirectional data import device in the same network domain.

[0055] In the specific implementation, the specific implementation process of this step includes:

[0056] In the management module of the second network domain unit of the first unidirectional data import device, enter the built-in network interface configuration interface; configure the cascading logical domain label Y through the command domain cascade label Y, and enable the cascading protocol through the command cascadeenable. At this point, the network module set in the M network domain of the first unidirectional data import device can enable the cascading function after receiving the message from the management module;

[0057] In the management module of the first network domain unit of the second unidirectional data import device, enter the built-in network interface configuration interface; configure the cascading logical domain label Y through the command domain cascade label Y, and enable the cascading protocol through the command cascadeenable. At this point, the network module set in the M network domain of the second unidirectional data import device can enable the cascading function after receiving the message from the management module.

[0058] S2: Perform cascade negotiation between the first unidirectional data import device and the second unidirectional data import device by sending and responding to cascade request messages in a preset format.

[0059] In the specific implementation, as Figure 3 shown, the cascade request message in the preset format includes an Ethernet data frame. The original Ethernet data frame includes a DMAC field, an SMAC field, a TYPE field, a DATA field, and an FCS field. In this method, a 4-byte cascade domain field CASCADE-TAG is inserted before the TYPE field of the original Ethernet data frame as the cascade request message.

[0060] The cascade domain field includes a 2-byte TPID field, a 1-byte Reserve field, and a 1-byte LID field. The defined value of the TPID field is 0x88FF, and the defined value of the LID field is domain label Y. The network modules of both the first unidirectional data import device and the second unidirectional data import device support sending and receiving this type of Ethernet data message.

[0061] As an example, this step specifically includes:

[0062] The network module of the second network domain unit of the first unidirectional data import device and the network module of the first network domain unit of the second unidirectional data import device complete the cascade negotiation between the first unidirectional data import device and the second unidirectional data import device by sending and responding to cascade request messages in a preset format.

[0063] When performing cascade negotiation, the network module at one end broadcasts a cascade request message and carries the cascade domain label of its own end. Among them, TPID = 0x88FF, LID = Y. When the network module at the other end receives the broadcast message with TPID = 0x88FF, it detects the domain label of its own end according to the LID. If the domain label of the network module at its own end is also Y, the cascade docking is successful.

[0064] S3: After completing the cascade negotiation, generate a cascade forwarding rule.

[0065] In the specific implementation, after completing the cascade negotiation, the network module of the second network domain unit of the first unidirectional data import device or the network module of the first network domain unit of the second unidirectional data import device generates a forwarding table. Among them, the forwarding table records the domain label and the MAC address of the cascade docking end, and their corresponding relationships.

[0066] S4: Perform cascade forwarding of service data according to the cascade forwarding rule.

[0067] In the specific implementation, when the network module of the second domain unit of the first unidirectional data import device or the network module of the first domain unit of the second unidirectional data import device receives service data with a domain label of Y, it queries the forwarding table based on the domain label. If the MAC address corresponding to the domain label is matched, the service data packet is unicast and sent using this MAC address.

[0068] As an example, when performing the matching, the following field information needs to be verified:

[0069] DMAC = peer MAC, TPID = 0x88FF, LID = Y.

[0070] If the above requirements are met and the TYPE is an IPv4 or IPv6 upper-layer protocol, the matching is successful and cascade forwarding can be performed.

[0071] S5: Real-time receive the service data forwarded in cascade through the first unidirectional data import device and the second unidirectional data import device.

[0072] In the specific implementation, after the network module of the second domain unit of the first unidirectional data import device or the network module of the first domain unit of the second unidirectional data import device receives a unicast service data packet with the destination MAC address being the local MAC address and TPID = 0x88FF, the service data therein is restored at the protocol layer and the service data is forwarded.

[0073] In summary, based on the dual-domain unidirectional import system, the present invention extends to support the cascade protocol and functions of the unidirectional transmission system, realizing the three-domain cascade unidirectional import capability.

[0074] In this specification, the various embodiments are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. For the same or similar parts among the various embodiments, reference can be made to each other. For the methods disclosed in the embodiments, since they correspond to the systems disclosed in the embodiments, the description is relatively simple. For the relevant parts, reference can be made to the description in the method part.

[0075] Finally, it should also be noted that in this text, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or further includes elements inherent to such process, method, article or device. Without further limitation, an element defined by the statement "comprising an..." does not exclude the presence of additional identical elements in the process, method, article or device comprising the said element.

[0076] The above has introduced in detail the three-network-domain unidirectional data import system and method provided by the present invention. Specific examples are used in this text to elaborate on the principle and implementation manner of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. It should be noted that for those of ordinary skill in the art in this technical field, without departing from the principle of the present invention, several improvements and modifications can still be made to the present invention, and these improvements and modifications also fall within the protection scope of the claims of the present invention.

Claims

1. A method for unidirectional data import in three network domains, characterized in that, The method adopts a three-network-domain one-way data import system; The system includes: a first one-way data import device and a second one-way data import device, and the first one-way data import device and the second one-way data import device are cascaded and docked at the same network domain level; both the first one-way data import device and the second one-way data import device are provided with a first network domain unit and a second network domain unit, and the first network domain unit and the second network domain unit are data-connected through a one-way transmission channel; The first network domain unit of the first one-way data import device is set in the L network domain, used for data interaction in the L network domain, and sending the data in the L network domain to the second network domain unit of the first one-way data import device through the one-way transmission channel; The second network domain unit of the first one-way data import device is set in the M network domain, used for data interaction in the M network domain, and sending the data in the L network domain or the data in the M network domain to the first network domain unit of the second one-way data import device; The first network domain unit of the second one-way data import device is set in the M network domain, and the first network domain unit of the second one-way data import device is cascaded and docked with the second network domain unit of the first one-way data import device, used for data interaction in the M network domain, and sending the data in the M network domain or the data sent by the second network domain unit of the first one-way data import device to the second network domain unit of the second one-way data import device through the one-way transmission channel; The second network domain unit of the second one-way data import device is set in the H network domain, used for data interaction in the H network domain, and obtaining the data sent by the second network domain unit of the second one-way data import device; Both the first network domain unit and the second network domain unit are provided with a management module; The management module is used to enable the cascading function by configuring the cascading logical domain label and enabling the cascading protocol; Both the first network domain unit and the second network domain unit are provided with a network module; The network module is used to perform cascading negotiation, generate cascading forwarding rules, and perform cascading forwarding of service data after the management module enables the cascading function; The method includes the following steps: S1: Perform cascading configuration on the first one-way data import device and the second one-way data import device to achieve cascading and docking of the first one-way data import device and the second one-way data import device at the same network domain level; S2: Perform cascading negotiation on the first one-way data import device and the second one-way data import device by sending and responding to cascading request messages in a preset format; S3: After completing the cascading negotiation, generate cascading forwarding rules; S4: Perform cascading forwarding of service data according to the cascading forwarding rules; S5: Receive the cascading-forwarded service data in real time through the first one-way data import device and the second one-way data import device; The cascading request message in the preset format includes an Ethernet data frame, and a 4-byte cascading domain field is provided before the TYPE field of the Ethernet data frame; The cascading domain field includes a TPID field, a Reserve field, and an LID field; The defined value of the TPID field is 0x88FF, and the defined value of the LID field is the domain label Y; The step S2 includes: The network module of the second domain unit of the first one-way data import device and the network module of the first domain unit of the second one-way data import device complete the cascade negotiation between the first one-way data import device and the second one-way data import device by sending and responding to cascade request messages in a preset format; The step S3 includes: After completing the cascade negotiation, the network module of the second domain unit of the first one-way data import device or the network module of the first domain unit of the second one-way data import device generates a forwarding table; The forwarding table records the domain label and the MAC address of the cascade docking end, and their corresponding relationships; The step S4 includes: When the network module of the second domain unit of the first one-way data import device or the network module of the first domain unit of the second one-way data import device receives service data with a domain label of Y, it queries the forwarding table according to the domain label. If the MAC address corresponding to the domain label is matched, the service data message is unicast using this MAC address.

2. The three-network domain unidirectional data import method according to claim 1, wherein The step S1 includes: In the management module of the second domain unit of the first one-way data import device, enter the built-in network interface configuration interface; configure the cascade logical domain label Y through the command "domain cascade label Y", and enable the cascade protocol through the command "cascade enable"; In the management module of the first domain unit of the second one-way data import device, enter the built-in network interface configuration interface; configure the cascade logical domain label Y through the command "domain cascade label Y", and enable the cascade protocol through the command "cascade enable".

3. The three-network domain unidirectional data import method according to claim 1, wherein The step S5 includes: After the network module of the second domain unit of the first one-way data import device or the network module of the first domain unit of the second one-way data import device receives a service data message with the destination MAC address being its own MAC address, it restores the service data at the protocol layer and forwards the service data.

Images